Function at 0x140033fe0
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r12, qword [rsp + 0xa8]
xor r13d, r13d
mov rbx, r9
mov r14, qword [rsp + 0xa0]
mov r9, rdx
cmp byte [rsp + 0xb8], r13b
jne 0x14003429e
mov rax, qword [r8]
lea r8, [r11 - 0x30]
mov r10d, dword [rbx]
mov ecx, dword [r9]
lea r9, [r11 - 0x38]
movzx ebp, byte [rsp + 0xc0]
sub ecx, r10d
mov byte [rsp + 0x30], bpl
lea rdx, [rax + r10*8]
lea rax, [0x140713780]
mov qword [r11 - 0x50], rax
lea rax, [0x140713550]
mov qword [r11 - 0x58], rax
call fcn.140032860
add dword [rbx], eax
cmp qword [0x140713550], r13
jne 0x140034086
lea rcx, str.MYSQL_GROUP_SUFFIX
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [0x140713550], rax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400340b7
cmp byte [0x140713788], r13b
jne 0x1400340b7
lea rbx, [0x140713990]
mov rdx, rbx
call fcn.140032720
test eax, eax
jne 0x140034280
mov qword [0x140713548], rbx
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400340e8
cmp byte [0x140713788], r13b
jne 0x1400340e8
lea rbx, [0x140713790]
mov rdx, rbx
call fcn.140032720
test eax, eax
jne 0x140034280
mov qword [0x140713558], rbx
mov byte [0x140713788], 1
call fcn.140032ba0
mov rax, qword [0x140713550]
test rax, rax
je 0x140034240
lea rcx, [0x140036bb0]
cmp r14, rcx
jne 0x140034240
mov rbp, 0xffffffffffffffff
mov rsi, rbp
nop
cmp byte [rax + rsi + 1], r13b
lea rsi, [rsi + 1]
jne 0x140034120
mov rcx, qword [r12]
mov r15, qword [r12 + 0x10]
mov r14, qword [rcx + 8]
mov rdx, qword [r15]
mov rax, qword [rcx + 0x10]
shl rdx, 4
sub rax, r14
add rdx, 0xf
and rdx, 0xfffffffffffffff8
cmp rax, rdx
jb 0x14003415d
lea rax, [r14 + rdx]
mov qword [rcx + 8], rax
jmp 0x140034165
call fcn.14000dd30
mov r14, rax
test r14, r14
je 0x1400343e4
mov rax, qword [r15]
mov dword [rsp + 0x40], r13d
test rax, rax
je 0x140034222
nop
mov rax, qword [r15 + 0x10]
mov rbx, rbp
mov rcx, qword [rax + r13*8]
mov qword [r14 + r13*8], rcx
nop
inc rbx
cmp byte [rcx + rbx], 0
jne 0x140034190
mov rcx, qword [r12]
lea rdx, [rsi + 1]
add rdx, rbx
mov edx, edx
add rdx, 7
mov rdi, qword [rcx + 8]
and rdx, 0xfffffffffffffff8
mov rax, qword [rcx + 0x10]
sub rax, rdi
cmp rax, rdx
jb 0x1400341c8
lea rax, [rdi + rdx]
mov qword [rcx + 8], rax
jmp 0x1400341d0
call fcn.14000dd30
mov rdi, rax
test rdi, rdi
je 0x1400343e4
mov r8, qword [r15]
mov rcx, rdi
add r8, r13
mov qword [r14 + r8*8], rdi
mov r8, rbx
mov rdx, qword [r14 + r13*8]
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [0x140713550]
lea r8, [rsi + 1]
lea rcx, [rdi + rbx]
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [rsp + 0x40]
mov rax, qword [r15]
inc edx
mov r13d, edx
mov dword [rsp + 0x40], edx
cmp r13, rax
jb 0x140034180
xor r13d, r13d
add rax, rax
mov qword [r15 + 0x10], r14
mov qword [r15], rax
mov qword [r14 + rax*8], r13
mov r14, qword [rsp + 0xa0]
movzx ebp, byte [rsp + 0xc0]
mov rsi, qword [rsp + 0x80]
mov rcx, rsi
call fcn.1400456f0
test rax, rax
je 0x1400343ee
movzx eax, byte [rsp + 0xb8]
mov r9, rsi
xor r8d, r8d
mov byte [rsp + 0x20], al
mov rdx, r12
mov rcx, r14
call fcn.140034dc0
test eax, eax
js 0x1400344f6
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp qword [0x140713780], r13
je 0x140034238
lea rcx, [0x140036bb0]
cmp r14, rcx
jne 0x140034238
mov rcx, qword [r12]
mov rbx, qword [r12 + 0x10]
mov r14, qword [rcx + 8]
mov rax, qword [rbx]
lea rdx, [rax*8 + 0x1f]
mov rax, qword [rcx + 0x10]
sub rax, r14
and rdx, 0xfffffffffffffff8
cmp rax, rdx
jb 0x1400342e5
lea rax, [r14 + rdx]
mov qword [rcx + 8], rax
jmp 0x1400342ed
call fcn.14000dd30
mov r14, rax
test r14, r14
je 0x1400343e4
mov edi, r13d
cmp qword [rbx], rdi
jbe 0x140034325
mov rdx, r13
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
inc edi
mov rcx, qword [rax + rdx*8]
mov qword [r14 + rdx*8], rcx
mov edx, edi
cmp rdx, qword [rbx]
jb 0x140034310
mov rcx, qword [0x140713780]
mov eax, edi
lea r13, [r14 + rax*8]
mov qword [r13], rcx
mov rax, qword [0x140713550]
test rax, rax
je 0x1400343d2
mov rbp, 0xffffffffffffffff
mov rsi, rbp
inc rsi
cmp byte [rax + rsi], 0
jne 0x140034350
nop dword [rax]
inc rbp
cmp byte [rcx + rbp], 0
jne 0x140034360
mov rcx, qword [r12]
lea rdx, [rbp + 1]
add rdx, rsi
mov edx, edx
add rdx, 7
mov r15, qword [rcx + 8]
and rdx, 0xfffffffffffffff8
mov rax, qword [rcx + 0x10]
sub rax, r15
cmp rax, rdx
jb 0x140034398
lea rax, [r15 + rdx]
mov qword [rcx + 8], rax
jmp 0x1400343a0
call fcn.14000dd30
mov r15, rax
test r15, r15
je 0x1400343e4
mov rdx, qword [r13]
lea ecx, [rdi + 1]
mov qword [r14 + rcx*8], r15
mov r8, rbp
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [0x140713550]
lea r8, [rsi + 1]
lea rcx, [r15 + rbp]
call sub.VCRUNTIME140.dll_memcpy
inc qword [rbx]
inc qword [rbx]
mov rax, qword [rbx]
xor r13d, r13d
mov qword [rbx + 0x10], r14
jmp 0x14003422c
mov eax, 2
jmp 0x140034280
mov rax, qword [0x140713558]
test rax, rax
je 0x140034449
movzx edi, byte [rsp + 0xb8]
lea r9, [0x1400fb935]
mov byte [rsp + 0x38], 0
lea r8, [0x1400fb935]
mov byte [rsp + 0x30], dil
mov rdx, r12
mov dword [rsp + 0x28], r13d
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.140034e90
test eax, eax
js 0x1400344f6
jle 0x14003427e
mov r8, qword [0x140713558]
jmp 0x1400344e9
test bpl, bpl
jne 0x14003427e
mov rbx, qword [rsp + 0xb0]
mov rax, qword [rbx]
test rax, rax
je 0x14003427e
movzx edi, byte [rsp + 0xb8]
nop
cmp byte [rax], 0
je 0x140034491
mov r9, rsi
mov byte [rsp + 0x20], dil
mov r8, rax
mov rdx, r12
mov rcx, r14
call fcn.140034dc0
test eax, eax
js 0x1400344f6
jmp 0x1400344d0
mov rax, qword [0x140713548]
test rax, rax
je 0x1400344d0
mov byte [rsp + 0x38], 0
lea r9, [0x1400fb935]
mov byte [rsp + 0x30], dil
lea r8, [0x1400fb935]
mov dword [rsp + 0x28], r13d
mov rdx, r12
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.140034e90
test eax, eax
js 0x1400344f6
jg 0x1400344e2
mov rax, qword [rbx + 8]
add rbx, 8
test rax, rax
jne 0x140034470
jmp 0x14003427e
mov r8, qword [0x140713548]
mov edx, 0x2f
lea ecx, [rdx - 0x2e]
call fcn.140041370
mov edx, 0x30
lea ecx, [rdx - 0x2f]
call fcn.140041370
mov eax, 1
jmp 0x140034280