Function at 0x180026940
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x48
mov r10, rcx
test rcx, rcx
je 0x180026cb5
movzx r8d, byte [rcx]
mov rdx, rcx
test r8b, r8b
je 0x180026a31
cmp r8b, 0x80
jb 0x180026a20
movzx ecx, byte [rdx]
movzx eax, cl
cmp r8b, 0xe0
jae 0x180026985
cmp r8b, 0xc2
jb 0x180026a35
jmp 0x180026a0d
cmp r8b, 0xf0
jae 0x1800269af
movzx ecx, byte [rdx + 1]
inc rdx
movzx r9d, r8b
and r9d, 0xf
je 0x1800269a7
cmp r9d, 0xd
jne 0x180026a05
and cl, 0xe0
jmp 0x180026a08
and cl, 0xe0
cmp cl, 0xa0
jmp 0x180026a0b
movzx eax, r8b
cmp r8b, 0xf5
jae 0x180026a35
movzx r9d, byte [rdx + 1]
movzx eax, cl
movzx ecx, r8b
and ecx, 7
je 0x1800269e7
cmp ecx, 4
je 0x1800269db
and r9b, 0xc0
cmp r9b, 0x80
jne 0x180026a35
jmp 0x1800269f9
and r9b, 0xf0
cmp r9b, 0x80
jne 0x180026a35
jmp 0x1800269f9
movzx ecx, r9b
and cl, 0xc0
cmp cl, 0x80
jne 0x180026a35
test r9b, 0x30
je 0x180026a35
movzx ecx, byte [rdx + 2]
add rdx, 2
movzx eax, r8b
and cl, 0xc0
cmp cl, 0x80
jne 0x180026a35
movzx ecx, byte [rdx + 1]
inc rdx
and cl, 0xc0
movzx eax, r8b
cmp cl, 0x80
jne 0x180026a35
movzx r8d, byte [rdx + 1]
inc rdx
test r8b, r8b
jne 0x180026960
movzx eax, r8b
test al, al
jne 0x180026c94
mov qword [rsp + 0x58], rbx
xor r9d, r9d
mov qword [rsp + 0x60], rbp
xor r8d, r8d
mov qword [rsp + 0x68], rsi
mov rcx, r10
xor esi, esi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x20], rsi
lea edx, [rsi - 1]
call sym.glib_2.0.dll_g_utf8_to_utf16
mov r15d, 2
lea rdx, [rsp + 0x50]
mov r8d, r15d
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, eax
test eax, eax
jne 0x180026b27
test rdi, rdi
je 0x180026aa0
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x180026b6e
mov rax, qword [0x18011ef58]
lea rcx, [0x18011ead0]
call qword [case.0x180005f92.0]
xor edx, edx
lea rcx, [0x1800eaba1]
call fcn.1800502e0
mov ebx, eax
lea rcx, [0x18011ead0]
mov rax, qword [0x18011ef68]
call qword [case.0x180005f92.0]
lock or dword [rsp], esi
mov ecx, dword [0x18011eabc]
lock or dword [rsp], esi
mov rdx, qword [0x18011eac0]
cmp ebx, ecx
jae 0x180026b06
mov rsi, qword [rdx + rbx*8]
mov rax, rsi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov r15, qword [rsp + 0x30]
add rsp, 0x48
ret
cmp ebp, 1
mov rdx, r15
cmove ebp, r15d
movsxd rcx, ebp
call sym.glib_2.0.dll_g_malloc_n
mov r8d, ebp
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rbp - 1]
cmp eax, ecx
je 0x180026b72
test rdi, rdi
je 0x180026b60
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x180026b6e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
jmp 0x180026b09
mov edx, 0x25
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
je 0x180026bed
mov r8d, r15d
mov qword [rsp + 0x38], r14
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov rbp, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
movsxd r14, eax
test eax, eax
jle 0x180026be8
mov rcx, r14
mov rdx, r15
call sym.glib_2.0.dll_g_malloc_n
mov r8d, r14d
mov rdx, rax
mov rcx, rbp
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, r14d
je 0x180026bda
test rbx, rbx
je 0x180026bd5
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, rbp
jmp 0x180026be8
test rbp, rbp
je 0x180026be8
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r14, qword [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 - 1]
call sym.glib_2.0.dll_g_utf16_to_utf8
mov rbp, rax
test rdi, rdi
je 0x180026c15
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x180026c23
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbp, rbp
jne 0x180026c2c
mov ebx, esi
jmp 0x180026c6c
mov rax, qword [0x18011ef58]
lea rcx, [0x18011ead0]
call qword [case.0x180005f92.0]
mov edx, 1
mov rcx, rbp
call fcn.1800502e0
mov ebx, eax
lea rcx, [0x18011ead0]
mov rax, qword [0x18011ef68]
call qword [case.0x180005f92.0]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lock or dword [rsp], esi
mov ecx, dword [0x18011eabc]
lock or dword [rsp], esi
mov rdx, qword [0x18011eac0]
cmp ebx, ecx
jae 0x180026b06
mov eax, ebx
mov rsi, qword [rdx + rax*8]
jmp 0x180026b06
lea r8, str.g_utf8_validate__variable___1__NULL_
lea rdx, [0x1800ee958]
lea rcx, [0x18009cbc8]
call sym.glib_2.0.dll_g_return_if_fail_warning
xor eax, eax
add rsp, 0x48
ret
lea r8, str.variable___NULL
jmp 0x180026c9b