Function at 0x140004b70
Capabilities:
Query environment variable

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
mov rsi, rcx
mov qword [rsp + 0x58], rbp
mov ecx, 0x18
mov qword [rsp + 0x60], r12
mov ebx, edx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor r14d, r14d
mov rdi, rax
test rax, rax
jne 0x140004ba4
mov edi, r14d
jmp 0x140004be1
mov ecx, 0x6000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
jne 0x140004bbc
mov rdi, r14
jmp 0x140004be1
xor edx, edx
mov r8d, 0x6000
mov rcx, rbp
call fcn.140021acb
mov qword [rdi], rbp
mov qword [rdi + 8], rbp
mov dword [rdi + 0x10], 0x6000
mov dword [rdi + 0x14], 0x6000
mov ecx, dword [rdi + 0x10]
mov qword [rsp + 0x68], r13
cmp ecx, 0x2000
jge 0x140004bf9
mov r12, r14
mov r13, r14
jmp 0x140004c55
mov rdx, qword [rdi + 8]
add ecx, 0xffffe000
mov dword [rdi + 0x10], ecx
mov r12, rdx
lea rax, [rdx + 0x2000]
mov qword [rdi + 8], rax
cmp ecx, 0x2000
jge 0x140004c21
mov r13, r14
jmp 0x140004c55
add ecx, 0xffffe000
mov r13, rax
add rax, 0x2000
mov dword [rdi + 0x10], ecx
mov qword [rdi + 8], rax
cmp ecx, 0x2000
jl 0x140004c55
mov r14, rax
add rax, 0x2000
mov qword [rdi + 8], rax
lea eax, [rcx - 0x2000]
mov dword [rdi + 0x10], eax
cmp ebx, 4
jb 0x140004ca5
mov ecx, dword [rsi]
call qword [sym.imp.WS2_32.dll_ntohl]
lea rdx, [rsi + 4]
lea ecx, [rbx - 4]
mov rsi, rdx
mov ebx, ecx
test eax, eax
je 0x140004ca5
cmp eax, 0x2000
jge 0x140004ca5
cmp ecx, eax
jl 0x140004ca5
mov qword [rsp + 0x20], r15
sub ebx, eax
movsxd r15, eax
lea rsi, [r15 + rdx]
test rdx, rdx
je 0x140004ca0
mov r8, r15
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + r12], 0
mov r15, qword [rsp + 0x20]
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ebp, eax
test eax, eax
je 0x140004ce3
lea ecx, [rax + 1]
cmp ecx, 0x2000
jae 0x140004ce3
xor edx, edx
mov r8d, 0x2000
mov rcx, r13
call fcn.140021acb
mov r8d, ebp
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp ebx, 4
jb 0x140004d21
mov ecx, dword [rsi]
call qword [sym.imp.WS2_32.dll_ntohl]
add rsi, 4
sub ebx, 4
test eax, eax
je 0x140004d21
cmp eax, 0x2000
jge 0x140004d21
cmp ebx, eax
jl 0x140004d21
test rsi, rsi
je 0x140004d21
movsxd rbx, eax
mov rdx, rsi
mov r8, rbx
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r14], 0
mov rsi, qword [0x140036cf8]
test rsi, rsi
je 0x140004d67
mov r9, rsi
cmp dword [r9], 1
jne 0x140004d5b
lea r8, [r9 + 4]
mov rax, r13
sub r8, r13
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140004d53
inc rax
test ecx, ecx
jne 0x140004d40
test edx, edx
je 0x140004e58
mov r9, qword [r9 + 0x4008]
test r9, r9
jne 0x140004d30
mov ecx, 0x4008
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, 0x4004
xor edx, edx
mov rbx, rax
lea rcx, [rax + 4]
call fcn.140021acb
mov qword [0x140036cf8], rbx
mov qword [rbx + 0x4008], rsi
xor r8d, r8d
mov dword [rbx], 1
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov r13, qword [rsp + 0x68]
mov esi, eax
test eax, eax
je 0x140004ddf
lea ecx, [rax + 1]
cmp ecx, 0x2000
jae 0x140004ddf
xor edx, edx
lea rcx, [rbx + 4]
mov r8d, 0x2000
call fcn.140021acb
mov r8d, esi
lea rdx, [rbx + 4]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor r8d, r8d
lea rsi, [rbx + 0x2004]
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov r12, qword [rsp + 0x60]
mov ebx, eax
mov rbp, qword [rsp + 0x58]
test eax, eax
je 0x140004e2e
lea ecx, [rax + 1]
cmp ecx, 0x2000
jae 0x140004e2e
xor edx, edx
mov r8d, 0x2000
mov rcx, rsi
call fcn.140021acb
mov r8d, ebx
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
movsxd r8, dword [rdi + 0x14]
xor edx, edx
mov rcx, qword [rdi]
call fcn.140021acb
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rbx, qword [rsp + 0x50]
jmp 0x140004d94