Function at 0x409820
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r13d, dword [0x0040b020]
mov r15, rcx
cmp r13d, 0xffffffff
je 0x4098d0
sub r13d, 1
js 0x409889
mov r12, qword [0x00412128]
mov rdi, qword [sym.imp.ucrtbase.dll_strcmp]
lea rbp, [r15 + 1]
xor r14d, r14d
nop
lea esi, [r13 + r14]
mov rcx, rbp
sar esi, 1
movsxd rbx, esi
shl rbx, 4
add rbx, r12
lea rdx, [rbx + 1]
call rdi
test eax, eax
je 0x4098c8
js 0x4098b0
lea r14d, [rsi + 1]
cmp r14d, r13d
jle 0x409860
cmp byte [r15], 0
movzx eax, byte [0x0040b024]
js 0x4098c0
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r13d, [rsi - 1]
cmp r13d, r14d
jge 0x409860
jmp 0x409889
mov byte [r15], al
jmp 0x409896
movzx eax, byte [rbx]
jmp 0x409896
lea rcx, str.WINEDEBUG
call qword [sym.imp.ucrtbase.dll_getenv]
mov dword [0x0040b020], 0
mov rcx, rax
test rax, rax
je 0x409889
call qword [sym.imp.ucrtbase.dll__strdup]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x4099f1
mov qword [rsp + 0xa0], r15
mov r13, rax
jmp 0x40994c
cmp rcx, r13
jbe 0x409a18
cmp rax, 5
jne 0x409b50
cmp dword [r13], 0x6d786966
je 0x409b9d
cmp dword [r13], 0x63617274
je 0x409bc8
nop
test rbp, rbp
je 0x4099de
mov r13, rbp
mov edx, 0x2c
mov rcx, r13
xor ebp, ebp
call qword [sym.imp.ucrtbase.dll_strchr]
test rax, rax
je 0x409968
mov byte [rax], 0
lea rbp, [rax + 1]
lea rdx, [0x0040efaa]
mov rcx, r13
call qword [sym.imp.ucrtbase.dll_strcspn]
lea rcx, [r13 + rax]
movzx edx, byte [rcx]
test dl, dl
jne 0x409910
movzx edx, byte [r13]
cmp dl, 0x2d
je 0x409a00
lea ebx, [rdx - 0x2b]
and ebx, 0xfd
je 0x409b40
mov r12d, 0xffffffff
xor ebx, ebx
test dl, dl
je 0x409940
mov ecx, 4
mov rsi, r13
lea rdi, [0x0040efbd]
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x409a20
not ebx
and bl, byte [0x0040b024]
or r12d, ebx
mov byte [0x0040b024], r12b
test rbp, rbp
jne 0x409949
mov r15, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ucrtbase.dll_free]
mov r13d, dword [0x0040b020]
jmp 0x409844
mov ebx, 0xffffffff
xor r12d, r12d
mov rcx, r13
movzx edx, byte [rcx + 1]
lea r13, [rcx + 1]
jmp 0x4099a5
mov r13, rcx
jmp 0x409989
mov rcx, r13
call qword [sym.imp.ucrtbase.dll_strlen]
mov qword [rsp + 0x48], rax
cmp rax, 0xe
ja 0x409940
mov eax, dword [0x0040b020]
mov rdi, qword [0x00412128]
mov dword [rsp + 0x44], eax
sub eax, 1
mov qword [rsp + 0x28], rdi
mov edi, eax
js 0x409cd5
mov rax, qword [sym.imp.ucrtbase.dll_strcmp]
xor r15d, r15d
mov qword [rsp + 0x30], rax
nop dword [rax + rax]
lea r14d, [rdi + r15]
mov rax, qword [rsp + 0x30]
mov rcx, r13
sar r14d, 1
movsxd rsi, r14d
shl rsi, 4
add rsi, qword [rsp + 0x28]
lea rdx, [rsi + 1]
call rax
test eax, eax
je 0x409bf0
js 0x409b28
lea r15d, [r14 + 1]
cmp edi, r15d
jge 0x409a70
movsxd rsi, r15d
mov r14, rsi
shl r14, 4
mov eax, dword [0x00412130]
cmp dword [rsp + 0x44], eax
jge 0x409c75
add r14, qword [rsp + 0x28]
cmp r15d, dword [rsp + 0x44]
jl 0x409c4b
mov rax, qword [rsp + 0x48]
lea rdx, [r14 + 1]
add rax, 1
cmp eax, 8
jae 0x409bff
test al, 4
jne 0x409cf1
test eax, eax
je 0x409b05
movzx ecx, byte [r13]
mov byte [r14 + 1], cl
test al, 2
jne 0x409d19
mov eax, dword [rsp + 0x44]
not ebx
and bl, byte [0x0040b024]
or r12d, ebx
add eax, 1
mov byte [r14], r12b
mov dword [0x0040b020], eax
jmp 0x409940
lea edi, [r14 - 1]
cmp edi, r15d
jge 0x409a70
jmp 0x409aa8
mov rcx, r13
mov r12d, 0xffffffff
jmp 0x409a0b
cmp rax, 3
jne 0x409d2b
cmp word [r13], 0x7265
jne 0x409940
cmp byte [r13 + 2], 0x72
jne 0x409940
mov ebx, 2
cmp dl, 0x2b
je 0x409d09
sub edx, 0x2b
and edx, 0xfd
mov r12d, edx
je 0x409a0b
mov r13, rcx
xor r12d, r12d
jmp 0x4099a9
cmp byte [r13 + 4], 0x65
jne 0x409931
mov ebx, 1
cmp dl, 0x2b
jne 0x409b80
mov r13, rcx
xor ebx, ebx
mov r12d, 1
jmp 0x409a08
cmp byte [r13 + 4], 0x65
jne 0x409940
mov ebx, 8
cmp dl, 0x2b
jne 0x409b80
mov r13, rcx
xor ebx, ebx
mov r12d, 8
jmp 0x409a08
not ebx
and bl, byte [rsi]
or r12d, ebx
mov byte [rsi], r12b
jmp 0x409940
mov rcx, qword [r13]
mov qword [r14 + 1], rcx
mov ecx, eax
mov r8, qword [r13 + rcx - 8]
mov qword [rdx + rcx - 8], r8
lea r8, [r14 + 9]
and r8, 0xfffffffffffffff8
sub rdx, r8
add eax, edx
sub r13, rdx
and eax, 0xfffffff8
cmp eax, 8
jb 0x409b05
and eax, 0xfffffff8
xor edx, edx
mov ecx, edx
add edx, 8
mov r9, qword [r13 + rcx]
mov qword [r8 + rcx], r9
cmp edx, eax
jb 0x409c34
jmp 0x409b05
mov r8d, dword [rsp + 0x44]
lea rcx, [rsi + 1]
mov rdx, r14
shl rcx, 4
add rcx, qword [rsp + 0x28]
sub r8d, r15d
movsxd r8, r8d
shl r8, 4
call qword [sym.imp.ucrtbase.dll_memmove]
jmp 0x409ad2
add eax, eax
mov edx, 0x10
cmp eax, 0x10
cmovl eax, edx
mov dword [0x00412130], eax
cdqe
shl rax, 4
mov r8, rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
cmp qword [rsp + 0x28], 0
mov rcx, qword [rax + 0x30]
je 0x409ce2
mov r9, r8
xor edx, edx
mov r8, qword [rsp + 0x28]
call qword [sym.imp.kernel32.dll_HeapReAlloc]
mov qword [rsp + 0x28], rax
mov qword [0x00412128], rax
mov eax, dword [0x0040b020]
mov dword [rsp + 0x44], eax
jmp 0x409ac2
xor r14d, r14d
xor esi, esi
xor r15d, r15d
jmp 0x409ab2
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov qword [rsp + 0x28], rax
jmp 0x409cbf
mov ecx, dword [r13]
mov eax, eax
mov dword [r14 + 1], ecx
mov ecx, dword [r13 + rax - 4]
mov dword [rdx + rax - 4], ecx
jmp 0x409b05
mov r13, rcx
xor ebx, ebx
mov r12d, 2
jmp 0x409a08
mov ecx, eax
movzx eax, word [r13 + rcx - 2]
mov word [rdx + rcx - 2], ax
jmp 0x409b05
cmp rax, 4
jne 0x409940
cmp dword [r13], 0x6e726177
jne 0x409940
mov ebx, 4
cmp dl, 0x2b
jne 0x409b80
mov r13, rcx
xor ebx, ebx
mov r12d, 4
jmp 0x409a08