Function at 0x140031370
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
mov rsi, rcx
lea rcx, str.RMAN_ARCHITECTURE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x1400313c0
lea r8, str._architecture__s
lea r9, str.windows_x86_64
lea rdi, [rsp + 0x30]
mov edx, 0x100
mov rcx, rdi
call fcn.140031660
mov rcx, rdi
call fcn.14001ed20
test rax, rax
lea rdi, str.windows_x86_64
cmovne rdi, rax
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
movzx r15d, byte [rsi]
cmp rax, 4
jb 0x140031500
mov rbx, rax
cmp r15b, 0x2f
jne 0x14003141f
movsx ebp, byte [rsi + 1]
cmp ebp, 0x2f
jne 0x14003142e
movsx r14d, byte [rsi + 2]
mov ecx, r14d
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
test eax, eax
je 0x14003142e
cmp byte [rsi + 3], 0x2f
jne 0x14003142e
lea rdx, str._c:_
lea rcx, [rsp + 0x30]
mov r8d, r14d
jmp 0x140031455
cmp rbx, 4
ja 0x1400314ab
jmp 0x14003151d
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
test eax, eax
je 0x140031463
cmp byte [rsi + 2], 0x7c
jne 0x140031463
cmp byte [rsi + 3], 0x2f
jne 0x140031463
lea rdx, str._c:_
lea rcx, [rsp + 0x30]
mov r8d, ebp
call fcn.140004730
add rsi, 4
jmp 0x140031522
mov al, 0x2f
cmp rbx, 4
jbe 0x140031503
cmp bpl, 0x2f
jne 0x1400314ab
movsx ebp, byte [rsi + 2]
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
test eax, eax
je 0x1400314ab
cmp byte [rsi + 3], 0x7c
jne 0x1400314ab
cmp byte [rsi + 4], 0x2f
jne 0x1400314ab
lea rdx, str._c:_
lea rcx, [rsp + 0x30]
mov r8d, ebp
call fcn.140004730
add rsi, 5
jmp 0x140031522
cmp rbx, 6
jb 0x140031500
cmp r15b, 0x2f
jne 0x14003151d
movzx ebp, byte [rsi + 1]
cmp bpl, 0x2f
jne 0x14003150b
mov bpl, 0x2f
cmp byte [rsi + 2], 0x2f
jne 0x14003150b
movsx ebx, byte [rsi + 3]
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
test eax, eax
je 0x14003150b
cmp byte [rsi + 4], 0x7c
jne 0x14003150b
cmp byte [rsi + 5], 0x2f
jne 0x14003150b
lea rdx, str._c:_
lea rcx, [rsp + 0x30]
mov r8d, ebx
call fcn.140004730
add rsi, 6
jmp 0x140031522
mov eax, r15d
cmp al, 0x2f
jne 0x14003151d
movzx ebp, byte [rsi + 1]
cmp bpl, 0x2f
jne 0x14003151d
inc rsi
mov word [rsp + 0x30], 0x2f
jmp 0x140031522
mov byte [rsp + 0x30], 0
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r15, rax
add r15d, 0xfffffffb
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r14, rax
lea rcx, [rsp + 0x30]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rbx, rax
add eax, r14d
inc eax
movsxd r14, eax
movsxd rbp, r15d
lea r15, [0x1401247aa]
lea r12, str._ARCH
mov r13, rsi
jmp 0x14003157a
add rax, 5
add r14, rbp
mov r13, rax
mov rcx, r13
mov rdx, r15
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x140031570
mov rcx, r13
mov rdx, r12
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x140031570
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov qword [rsp + 0x28], r14
add rbx, r14
lea r15, [0x1401247aa]
lea r12, str._ARCH
mov r14, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x140031614
mov eax, r13d
sub eax, esi
movsxd rbp, eax
mov rcx, rbx
mov rdx, rsi
mov r8, rbp
call r14
add rbx, rbp
mov rcx, rbx
mov rdx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add rbx, rax
add r13, 5
mov rsi, r13
mov rcx, rsi
mov rdx, r15
call sub.VCRUNTIME140.dll_strstr
mov r13, rax
test rax, rax
jne 0x1400315e0
mov rcx, rsi
mov rdx, r12
call sub.VCRUNTIME140.dll_strstr
mov r13, rax
test rax, rax
jne 0x1400315e0
mov rcx, rbx
mov rdx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov rax, qword [rsp + 0x28]
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret