Function at 0x451ee0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x80]
mov r15, qword [rcx]
sub rsp, 0x70
mov rbx, rcx
mov qword [rbp + 0x28], rdx
lea rax, [rsp + 0x30]
test r15, r15
mov qword [rbp - 0x48], rax
je 0x4522e1
mov r13, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rsi, rcx
mov r12d, 1
xor edi, edi
mov r14d, 0xffffffff
mov edx, 0x3d
mov rcx, r15
call sub.msvcrt.dll_strchr
test rax, rax
je 0x451f74
xor edx, edx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, r14d
mov r8, r15
mov ecx, 0xfde9
call r13
test eax, eax
jle 0x452270
cdqe
add r12, 1
add rdi, rax
add rsi, 8
mov r15, qword [rsi]
test r15, r15
jne 0x451f30
lea rcx, [rdi + rdi]
call fcn.0043ebc0
test rax, rax
mov r13, rax
je 0x4522d7
lea rax, [r12*8 + 0x1e]
and rax, 0xfffffffffffffff0
call fcn.0047f1f0
mov r8, qword [rbx]
sub rsp, rax
lea r14, [rsp + 0x30]
test r8, r8
mov qword [rbp - 0x38], r14
mov rsi, r14
je 0x4522f0
mov r15, r13
mov qword [rbp - 0x40], r14
mov rsi, r8
nop dword [rax + rax]
mov edx, 0x3d
mov rcx, rsi
call sub.msvcrt.dll_strchr
mov rdx, r15
sub rdx, r13
sar rdx, 1
test rax, rax
mov rcx, rdx
je 0x45202f
mov eax, edi
mov qword [rsp + 0x20], r15
mov r9d, 0xffffffff
sub eax, edx
mov r8, rsi
xor edx, edx
mov dword [rsp + 0x28], eax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jle 0x4522c0
cdqe
mov qword [r14], r15
add r14, 8
lea r15, [r15 + rax*2]
mov rcx, r15
sub rcx, r13
sar rcx, 1
add rbx, 8
mov rsi, qword [rbx]
test rsi, rsi
jne 0x451fd0
mov rsi, qword [rbp - 0x40]
cmp rdi, rcx
mov qword [r14], 0
jne 0x452280
mov rbx, qword [rbp - 0x38]
lea rdx, [r12 - 1]
lea r9, [0x00451ed0]
mov r8d, 8
xor r15d, r15d
lea r12, [0x004b2020]
mov rcx, rbx
call sub.msvcrt.dll_qsort
jmp 0x4520a9
lea rax, [r15 + r15*2]
lea rax, [r12 + rax*8]
mov edx, dword [rax + 0x10]
mov rcx, qword [rax + 8]
call fcn.00451cf0
test eax, eax
js 0x4520b1
add rbx, 8
cmp eax, 1
adc r15, 0
cmp r15, 0xb
je 0x4520e6
mov r8, qword [rbx]
test r8, r8
jne 0x452080
lea rax, [r15 + r15*2]
xor r8d, r8d
xor edx, edx
lea r14, [r12 + rax*8]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbp - 0x48]
test eax, eax
mov dword [rcx + r15*4], eax
je 0x4520dc
add rdi, qword [r14 + 0x10]
mov eax, eax
add rdi, rax
add r15, 1
cmp r15, 0xb
jne 0x4520a9
lea rcx, [rdi + rdi + 2]
call fcn.0043ebc0
test rax, rax
mov qword [rbp - 0x38], rax
je 0x4522fb
xor r15d, r15d
mov qword [rbp - 0x50], r13
mov rbx, rax
mov qword [rbp - 0x40], rdi
mov r13, r15
mov r14, qword [rbp - 0x48]
jmp 0x45213d
mov rcx, r8
add rsi, 8
call sub.msvcrt.dll_wcslen
lea r9d, [rax + 1]
mov rdx, qword [rsi - 8]
mov rcx, rbx
movsxd r9, r9d
lea r15, [r9 + r9]
mov r8, r15
call sub.msvcrt.dll_memcpy
add rbx, r15
mov r8, qword [rsi]
test r8, r8
je 0x4521a0
cmp r13, 0xa
ja 0x452114
lea rax, [r13 + r13*2]
lea rax, [r12 + rax*8]
mov edx, dword [rax + 0x10]
mov rcx, qword [rax + 8]
call fcn.00451cf0
test eax, eax
mov edi, eax
js 0x4521a6
mov rcx, qword [rsi]
add rsi, 8
call sub.msvcrt.dll_wcslen
lea r9d, [rax + 1]
mov rdx, qword [rsi - 8]
mov rcx, rbx
movsxd r9, r9d
lea r15, [r9 + r9]
mov r8, r15
call sub.msvcrt.dll_memcpy
test edi, edi
jne 0x45213a
add r13, 1
jmp 0x45213a
cmp r13, 0xa
ja 0x4521c0
mov edi, dword [r14 + r13*4]
test edi, edi
jne 0x452210
movsxd r9, edi
add r13, 1
lea r15, [r9 + r9]
jmp 0x45213a
mov rax, rbx
sub rax, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x40]
mov r13, qword [rbp - 0x50]
sar rax, 1
cmp rax, rdi
jne 0x4522a0
xor eax, eax
mov rcx, r13
mov word [rbx], ax
call fcn.0043ebd0
mov rax, qword [rbp + 0x28]
mov rdi, qword [rbp - 0x38]
mov qword [rax], rdi
xor eax, eax
lea rsp, [rbp - 0x28]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rax, [r13 + r13*2]
mov rcx, rbx
lea r15, [r12 + rax*8]
mov rdx, qword [r15 + 8]
call sub.msvcrt.dll_wcscpy
mov rax, qword [r15 + 0x10]
mov r8d, dword [rbp - 0x40]
mov rcx, qword [r15]
lea rbx, [rbx + rax*2]
mov rax, rbx
sub rax, qword [rbp - 0x38]
mov rdx, rbx
sar rax, 1
sub r8d, eax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rdi - 1]
cmp edx, eax
je 0x4521ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetEnvironmentVariableW
mov ecx, eax
call fcn.00441940
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4521f5
lea rdx, str.src_win_process.c
lea rcx, str.env_len__ptr___dst_copy
mov r8d, 0x2e6
call fcn.00480c40
jmp 0x45204f
lea rdx, str.src_win_process.c
lea rcx, str.env_len___ptr___dst_
mov r8d, 0x332
call fcn.00480c40
jmp 0x4521db
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r13
mov ebx, eax
call fcn.0043ebd0
mov eax, ebx
jmp 0x4521f5
mov eax, 0xe
jmp 0x4521f5
xor ecx, ecx
mov r12d, 1
xor edi, edi
jmp 0x451f84
mov r14, qword [rbp - 0x38]
xor ecx, ecx
jmp 0x45203f
mov rcx, r13
call fcn.0043ebd0
mov eax, 0xe
jmp 0x4521f5