Function at 0x180028fe0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x40], rbx
mov ebx, dword [rbp + 0x60]
mov r13, rcx
test ebx, ebx
je 0x18002901b
cmp qword [rbp + 0x68], 0
je 0x180029473
lea rax, [rcx + 0x1000]
cmp rax, 0x2000
jb 0x180029473
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x180029473
mov r12, qword [rbp + 0x98]
mov r14, qword [rbp + 0xa0]
mov qword [rcx], 0
test r12, r12
je 0x180029070
lea r8, str.unknown_error
mov rdx, r14
mov rcx, r12
call sym.VBoxRT.dll_RTStrPrintf
mov edx, dword [rbp + 0x48]
mov r15d, dword [rbp + 0x80]
cmp r15d, 0x100000
jb 0x18002908a
mov eax, 0xffffffca
jmp 0x180029478
lea eax, [rbx*4 + 0xc024]
movsxd rdi, eax
mov eax, edx
add rdi, 7
and rdi, 0xfffffffffffffff8
and eax, 0x400
lea rcx, [rdi + 0x1078]
mov dword [rbp + 0x60], eax
je 0x1800290b3
lea rcx, [rcx + rbx*4]
lea rdx, str.D:_tinderboxwin_4.2_srcVBoxRuntimecommonloglog.cpp
call sym.VBoxRT.dll_RTMemAllocZVarTag
mov rsi, rax
test rax, rax
je 0x18002946a
mov ecx, dword [rbp + 0x70]
mov dword [rax + 0xc004], 0x19281207
mov dword [rax + 0xc020], ebx
mov eax, dword [rbp + 0x48]
mov dword [rsi + 0xc00c], ecx
lea rcx, [rsi + rdi]
mov qword [rsi + 0xc010], rcx
mov dword [rsi + 0xc008], eax
mov dword [rcx], 9
mov rax, qword [rsi + 0xc010]
mov rcx, qword [rbp + 0x68]
xor edi, edi
mov dword [rax + 4], 0x1078
mov rax, qword [rsi + 0xc010]
mov qword [rax + 8], rdi
mov rax, qword [rsi + 0xc010]
mov qword [rax + 0x10], rdi
mov rax, qword [rsi + 0xc010]
mov qword [rax + 0x18], rdi
mov rax, qword [rsi + 0xc010]
mov qword [rax + 0x20], rdi
mov rax, qword [rsi + 0xc010]
mov byte [rax + 0x29], dil
mov rax, qword [rsi + 0xc010]
mov byte [rax + 0x2a], dil
mov rax, qword [rsi + 0xc010]
mov byte [rax + 0x2b], dil
mov rax, qword [rsi + 0xc010]
mov dword [rax + 0x2c], ebx
mov rax, qword [rsi + 0xc010]
mov qword [rax + 0x30], rcx
cmp dword [rbp + 0x60], edi
je 0x18002918d
mov rcx, qword [rsi + 0xc010]
lea rax, [rcx + 0x1078]
mov qword [rcx + 0x38], rax
jmp 0x180029198
mov rax, qword [rsi + 0xc010]
mov qword [rax + 0x38], rdi
mov rax, qword [rsi + 0xc010]
mov dword [rax + 0x40], 0xffffffff
mov rcx, qword [rsi + 0xc010]
mov rax, qword [rbp + 0x78]
mov qword [rcx + 0x48], rax
mov rax, qword [rsi + 0xc010]
mov rcx, qword [rbp + 0x88]
mov qword [rax + 0x50], 0xffffffffffffffff
mov rax, qword [rsi + 0xc010]
mov dword [rax + 0x70], r15d
mov rax, qword [rsi + 0xc010]
test rcx, rcx
jne 0x1800291ec
mov qword [rax + 0x58], 0xffffffffffffffff
jmp 0x1800291f0
mov qword [rax + 0x58], rcx
mov ecx, dword [rbp + 0x90]
mov rax, qword [rsi + 0xc010]
test ecx, ecx
jne 0x18002920a
mov dword [rax + 0x68], 0xffffffff
jmp 0x18002920d
mov dword [rax + 0x68], ecx
mov rax, qword [rbp + 0x50]
test rax, rax
je 0x180029221
mov rdx, rax
mov rcx, rsi
call sym.VBoxRT.dll_RTLogGroupSettings
mov r8, qword [rbp + 0xa8]
test r8, r8
je 0x180029250
mov rcx, qword [rsi + 0xc010]
mov r9, qword [rbp + 0xb0]
mov edx, 0x1004
add rcx, 0x74
call sym.VBoxRT.dll_RTStrPrintfV
or dword [rsi + 0xc00c], 1
mov rdx, qword [rbp + 0x58]
test rdx, rdx
je 0x180029328
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea rax, [rcx + 0xf]
lea rbx, [rcx - 1]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x180029286
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.18008c1c0
sub rsp, rcx
mov r8, rbx
lea rdi, [rsp + 0x20]
mov rcx, rdi
call sub.MSVCR100.dll_memcpy
mov eax, dword [str._DEST]
mov rcx, rdi
mov dword [rdi + rbx], eax
movzx eax, word [0x180261450]
mov word [rdi + rbx + 4], ax
call sym.VBoxRT.dll_RTEnvGet
test rax, rax
je 0x1800292d2
mov rdx, rax
mov rcx, rsi
call sym.VBoxRT.dll_RTLogDestinations
mov eax, dword [str._FLAGS]
mov rcx, rdi
mov dword [rdi + rbx], eax
movzx eax, word [0x180261448]
mov word [rdi + rbx + 4], ax
movzx eax, byte [0x18026144a]
mov byte [rdi + rbx + 6], al
call sym.VBoxRT.dll_RTEnvGet
test rax, rax
je 0x18002930a
mov rdx, rax
mov rcx, rsi
call sym.VBoxRT.dll_RTLogFlags
mov rcx, rdi
mov byte [rdi + rbx], 0
call sym.VBoxRT.dll_RTEnvGet
test rax, rax
je 0x180029326
mov rdx, rax
mov rcx, rsi
call sym.VBoxRT.dll_RTLogGroupSettings
xor edi, edi
test byte [rsi + 0xc00c], 1
je 0x18002939c
test byte [rsi + 0xc008], 0x20
mov rcx, rsi
je 0x180029359
mov r8, r14
mov rdx, r12
call fcn.1800263f0
mov r8b, 1
xor edx, edx
mov rcx, rsi
mov edi, eax
call fcn.1800264d0
jmp 0x180029394
mov rax, qword [rsi + 0xc010]
mov r8b, 1
xor edx, edx
mov qword [rax + 0x60], 0xffffffffffffffff
call fcn.1800264d0
mov rdx, qword [rsi + 0xc010]
cmp qword [rdx + 0x50], 0xffffffffffffffff
jne 0x18002939c
mov qword [rdx + 0x60], rdi
mov r8, r14
mov rcx, rsi
mov rdx, r12
call fcn.1800263f0
mov edi, eax
test edi, edi
js 0x18002943d
mov rcx, qword [rsi + 0xc010]
mov edx, 1
add rcx, 8
call sym.VBoxRT.dll_RTSemSpinMutexCreate
mov edi, eax
test eax, eax
js 0x180029426
call sym.VBoxRT.dll_RTThreadSelf
mov rbx, rax
test rax, rax
je 0x180029400
mov rcx, rax
call sym.VBoxRT.dll_RTLockValidatorWriteLockGetCount
mov rcx, qword [rsi + 0xc010]
mov rcx, qword [rcx + 8]
mov edi, eax
call sym.VBoxRT.dll_RTSemSpinMutexRequest
mov rcx, rbx
call sym.VBoxRT.dll_RTLockValidatorWriteLockGetCount
mov rcx, qword [rsi + 0xc010]
mov rcx, qword [rcx + 8]
mov ebx, eax
sub ebx, edi
call sym.VBoxRT.dll_RTSemSpinMutexRelease
xchg dword [0x1803d5e98], ebx
mov rax, qword [rsi + 0xc010]
mov rax, qword [rax + 0x48]
test rax, rax
je 0x18002941e
lea r8, [0x180028f70]
xor edx, edx
mov rcx, rsi
call rax
mov qword [r13], rsi
xor eax, eax
jmp 0x180029478
test r12, r12
je 0x18002943d
lea r8, str.failed_to_create_semaphore
mov rdx, r14
mov rcx, r12
call sym.VBoxRT.dll_RTStrPrintf
mov rcx, qword [rsi + 0xc010]
mov rcx, qword [rcx + 0x50]
call sym.VBoxRT.dll_RTFileClose
mov rcx, qword [rsi + 0xc018]
mov edx, 0x40
call sym.VBoxRT.dll_RTMemExecFree
mov rcx, rsi
call sym.VBoxRT.dll_RTMemFree
mov eax, edi
jmp 0x180029478
mov edi, 0xfffffff8
mov eax, edi
jmp 0x180029478
mov eax, 0xfffffffe
mov rbx, qword [rbp + 0x40]
mov rsp, rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret