Function at 0x180051f00
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x440]
sub rsp, 0x540
mov rax, qword [0x180121650]
xor rax, rsp
mov qword [rbp + 0x430], rax
mov r11, qword [rbp + 0x4a0]
lea eax, [rdx - 0xa]
mov rsi, qword [rbp - 0x78]
mov r13d, edx
mov r14, qword [rbp - 0x78]
mov r12, r8
mov ebx, dword [rsp + 0x50]
mov r10, rcx
mov qword [rbp - 8], r9
lea rdx, [0x180000000]
mov r9, qword [rbp - 0x78]
mov qword [rbp - 0x70], r9
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x50], r11
mov dword [rsp + 0x58], eax
cmp r13d, eax
jbe 0x180052205
mov rax, qword [rbp - 0x78]
lea edi, [r13 - 0x104]
mov rcx, qword [rbp - 0x78]
mov r15d, dword [rbp - 0x28]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x70], rax
mov rax, qword [rbp - 0x78]
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x78], rcx
mov ecx, dword [rsp + 0x58]
mov qword [rsp + 0x68], rax
cmp edi, 0x2a
ja case.default.0x180051fcc
movzx eax, byte [rdx + rdi + 0x528d4]
mov ecx, dword [rdx + rax*4 + 0x528a8]
add rcx, rdx
jmp rcx
lea rax, [rbp + 0x30]
mov dword [rsp + 0x50], r15d
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0xdb
mov rcx, r10
call fcn.18002dea0
mov r9, qword [rbp - 0x70]
xor ebx, ebx
jmp 0x180052140
mov r11, qword [rbp - 0x38]
mov rax, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x38]
mov ecx, dword [rsp + 0x58]
mov qword [rsp + 0x70], r11
mov qword [rbp - 0x40], rax
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x68], r8
jmp 0x180052157
lea rax, [rbp + 0x30]
mov dword [rsp + 0x50], 9
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r8d, 0x112
lea rdx, str.Undefined
xor ecx, ecx
call fcn.180061110
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp + 0x30]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov r15d, eax
test eax, eax
je 0x18005289e
mov r9, qword [rbp - 0x70]
jmp 0x180052140
xor r9d, r9d
cmp dword [r10], 2
jl 0x1800521d1
mov rax, qword [r12]
lea r8, [rbp - 0x48]
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xac
call fcn.180093140
cmp dword [rbp - 0x48], 1
mov qword [rsp + 0x70], rax
jl 0x180052177
mov r10, qword [rbp - 0x68]
mov r11, rax
mov r9, qword [rbp - 0x70]
mov ecx, dword [rsp + 0x58]
jmp 0x18005214d
mov r9, r11
mov dword [rsp + 0x50], 5
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0xfe
call fcn.1800dee70
mov r9, qword [rbp - 0x70]
jmp 0x180052140
mov rsi, qword [rbp - 0x38]
jmp case.0x180051fcc.10
mov rax, qword [rbp - 8]
mov eax, dword [rax]
cmp dword [r12], eax
je case.0x180052280.271
jmp case.0x180051fcc.10
xor r10d, r10d
mov qword [rbp - 0x68], r10
jmp case.0x180051fcc.10
mov rax, qword [rbp - 8]
lea r9, str._COOKIE
mov r14, qword [rbp - 0x38]
lea r8, [rsp + 0x50]
mov edx, 0x1a
mov dword [rsp + 0x50], 7
mov rcx, r11
mov eax, dword [rax]
add rax, r12
mov qword [rbp - 0x30], rax
call fcn.1800921f0
mov r9, rax
mov qword [rbp - 0x70], rax
mov r10, qword [rbp - 0x68]
mov ecx, dword [rsp + 0x58]
mov r11, qword [rsp + 0x70]
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x78]
dec edi
lea eax, [rdi + 0x104]
cmp eax, ecx
jbe 0x180052232
mov r11, qword [rbp - 0x50]
lea rdx, [0x180000000]
jmp 0x180051fb1
xor ebx, ebx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x50], ebx
mov rdx, qword [rbp - 0x50]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], StrCmpICW
xor ecx, ecx
call fcn.1800e4220
mov eax, ebx
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.1800fd9d0
mov rbx, qword [rsp + 0x588]
add rsp, 0x540
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r11
mov dword [rsp + 0x20], StrCmpICW
xor ecx, ecx
mov dword [rsp + 0x50], 0
call fcn.1800e4220
xor eax, eax
jmp 0x1800521a7
mov rdi, qword [rbp - 0x78]
mov r11, qword [rbp - 0x78]
mov r15, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x78]
mov r8, qword [rbp - 0x78]
mov qword [rbp - 0x30], rdi
mov qword [rsp + 0x70], r11
mov qword [rbp - 0x40], r15
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x68], r8
jmp 0x18005223e
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x40]
mov eax, dword [rsp + 0x58]
cmp r13d, eax
jbe case.0x180052280.280
nop word [rax + rax]
lea eax, [r13 - 0x10f]
cmp eax, 0x1f
ja case.0x180052280.273
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0x52928]
mov ecx, dword [rcx + rax*4 + 0x52900]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
test r9, r9
je 0x18005287c
test byte [r9 + 0x10], 0x40
je 0x18005287c
nop word [rax + rax]
mov r15d, 0x1a
nop word [rax + rax]
cmp r15d, 0x3212
ja 0x1800523f1
je 0x1800523e2
cmp r15d, 0x1a
je 0x1800523bd
cmp r15d, 0xc98
je 0x18005239a
cmp r15d, 0x1916
je 0x180052368
cmp r15d, 0x2594
jne 0x18005234b
cmp rsi, r14
jae 0x180052302
cmp byte [rsi], 0x3d
je 0x180052302
inc rsi
cmp rsi, r14
jb 0x1800522f5
mov eax, 1
lea r8, [rsp + 0x60]
mov dword [rbp - 0x80], eax
lea rdx, [rbp]
lea rax, [0x18005bf20]
mov r9d, 0x26
mov qword [rbp], rax
mov rcx, r12
mov eax, esi
sub eax, r12d
mov dword [rsp + 0x60], eax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r10
call fcn.18000cad0
mov r10, qword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x30]
add r15d, 0xc7e
cmp r15d, 0x63f0
jbe 0x1800522b0
jmp 0x1800522a0
xor r9d, r9d
mov qword [rsp + 0x20], r10
xor edx, edx
lea rcx, [rbp + 8]
lea r8d, [r9 + 0x79]
call fcn.1800d9350
mov r14, r12
cmp r12, rdi
jae 0x180052395
cmp byte [r14], 0x3b
je 0x180052395
inc r14
cmp r14, rdi
jb 0x180052387
mov rsi, r12
jmp 0x180052343
cmp r12, rdi
jb 0x18005234b
mov r15, qword [rbp - 0x40]
mov r13d, 0x11a
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x68]
mov r11, qword [rsp + 0x70]
jmp case.0x180052280.273
cmp r12, rdi
jae 0x18005234b
movsx ecx, byte [r12]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x180052343
inc r12
cmp r12, rdi
jb 0x1800523c2
jmp 0x180052343
mov eax, dword [r10 + 0x10]
inc rsi
mov dword [rbp - 0x58], eax
jmp 0x18005234b
cmp r15d, 0x3e90
je 0x18005245d
cmp r15d, 0x4b0e
je 0x18005244c
cmp r15d, 0x578c
jne 0x18005234b
mov eax, dword [rsp + 0x50]
lea rdx, [rbp - 0x80]
mov r8, qword [rbp - 0x38]
mov ecx, 0xad
mov dword [rsp + 0x60], eax
mov eax, dword [rbp - 0x58]
mov dword [rbp - 0x80], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [r9 + 8]
mov r9, qword [rbp - 0x78]
mov qword [rsp + 0x20], rax
call fcn.18009a4f0
jmp 0x180052343
mov rax, qword [r10 + 8]
lea r12, [r14 + 1]
mov qword [rbp - 0x38], rax
jmp 0x18005234b
xor eax, eax
mov qword [rbp - 0x78], rax
mov dword [rsp + 0x50], eax
cmp rsi, r14
jae 0x18005234b
mov edi, dword [r10 + 0x10]
lea r8, [rbp - 0x80]
mov eax, 1
lea rdx, [rbp]
mov dword [rsp + 0x60], eax
mov r9d, 0x26
lea rax, [0x18005bf20]
mov rcx, rsi
mov qword [rbp], rax
mov eax, r14d
sub eax, esi
mov dword [rbp - 0x80], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r10
call fcn.18000cad0
mov r10, qword [rbp - 0x68]
mov ecx, edi
add rcx, qword [r10 + 8]
mov eax, dword [r10 + 0x10]
sub eax, edi
mov qword [rbp - 0x78], rcx
mov dword [rsp + 0x50], eax
jmp 0x180052347
mov r9, qword [rbp - 0x50]
xor eax, eax
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
lea ecx, [rax + 0x6b]
call fcn.1800a2750
cmp qword [rbp - 0x20], 0
mov qword [rbp - 0x10], rax
je 0x180052886
test rax, rax
je 0x180052886
mov dword [rbp - 0x60], 0x7fffffff
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x68]
mov r9, qword [rbp - 0x70]
mov r11, qword [rsp + 0x70]
jmp case.0x180052280.273
mov rax, qword [r12 + 8]
lea r8, [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xac
call fcn.180093140
movsxd rcx, dword [rbp - 0x18]
mov r15, rax
mov qword [rbp - 0x40], rax
cmp ecx, 1
jl 0x180052886
add rax, rcx
xor edx, edx
mov rcx, qword [rbp - 0x50]
mov r8d, 0x10b
mov qword [rsp + 0x68], rax
call fcn.18002b4e0
mov qword [rbp - 0x20], rax
jmp 0x18005250e
mov edi, 0xac
nop word [rax + rax]
mov eax, edi
sub eax, 0xac
je 0x180052661
sub eax, 1
je 0x1800525f4
sub eax, 1
je 0x1800525e4
cmp eax, 1
jne 0x1800526cb
mov rax, qword [rbp - 0x10]
xor ecx, ecx
mov qword [rsp + 0x38], rcx
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x28], rcx
mov r8d, 0xd8
mov qword [rsp + 0x20], rcx
call fcn.1800e58a0
mov rdx, qword [rsp + 0x78]
jmp 0x1800526c1
movsxd r15, dword [rbp - 0x48]
add r15, rdx
mov qword [rbp - 0x40], r15
jmp 0x1800526cb
cmp rdx, r15
jbe 0x1800526cb
mov r13, qword [rbp - 0x10]
mov eax, edx
sub eax, r15d
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov rcx, r15
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x5b]
call fcn.1800e2fb0
mov rdx, qword [rbp - 0x20]
xor eax, eax
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r13
mov ecx, 0x90
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call fcn.1800ad5f0
mov rdx, qword [rsp + 0x78]
jmp 0x1800526c1
cmp r15, r8
jae 0x18005273e
mov eax, dword [rbp - 0x48]
lea rcx, [rbp - 0x28]
mov dword [rsp + 0x60], eax
mov r9, r11
mov eax, r8d
mov dword [rsp + 0x28], 0xf6
sub eax, r15d
lea r8, [rbp - 0x80]
mov dword [rbp - 0x80], eax
mov rdx, r15
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.1800e5fa0
test eax, eax
jne 0x1800526de
mov r8, qword [rbp - 0x20]
lea edx, [rax + 9]
xor ecx, ecx
call fcn.1800c1a70
cmp dword [rbp - 0x60], eax
jle 0x1800526de
mov edx, dword [rbp - 0x28]
add rdx, r15
mov qword [rsp + 0x78], rdx
mov r8, qword [rsp + 0x68]
mov r11, qword [rsp + 0x70]
inc edi
cmp edi, 0xb0
jb 0x180052590
jmp case.0x180052280.299
mov rax, qword [rsp + 0x68]
xor r9d, r9d
mov rdi, qword [rbp - 0x10]
sub eax, r15d
mov dword [rsp + 0x60], eax
xor r8d, r8d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rdi
lea edx, [r9 + 0x5b]
mov qword [rsp + 0x20], rax
mov rcx, r15
call fcn.1800e2fb0
mov rdx, qword [rbp - 0x20]
xor eax, eax
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov ecx, 0x90
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call fcn.1800ad5f0
mov r9, qword [rbp - 0x20]
mov r13d, 0x12b
mov rdx, qword [rbp - 0x50]
xor ecx, ecx
lea r8d, [r13 - 9]
call fcn.1800e50a0
jmp 0x18005250e
mov eax, dword [r12]
xor edi, edi
dec eax
cmp dword [r10 + rax*4], edi
jbe case.0x180052280.273
nop
mov eax, dword [r12]
mov edx, 1
mov ecx, dword [r10 + rax*4]
shl rcx, 2
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
test rax, rax
je 0x18005289e
mov rdx, qword [rbp - 0x50]
lea r9, [rsp + 0x60]
mov ecx, eax
lea r8, [rbp - 0x80]
mov rax, qword [rbp - 8]
mov qword [rsp + 0x20], rcx
mov dword [rdx + rdi*4], ecx
mov edx, 0x110
mov rcx, qword [rbp - 0x68]
mov eax, dword [rax]
mov dword [rsp + 0x60], eax
mov eax, dword [r12]
inc eax
mov dword [rbp - 0x80], eax
call fcn.180051f00
mov eax, dword [r12]
inc edi
mov r10, qword [rbp - 0x68]
dec eax
cmp edi, dword [r10 + rax*4]
jb 0x180052770
jmp 0x18005250e
cmp dword [r10], 2
jle case.0x180052280.273
mov r15d, dword [rbp - 0x60]
mov edi, 0x11c
nop
cmp edi, 0x11c
je 0x180052823
cmp edi, 0x2a28
je 0x180052819
cmp edi, 0x5334
jne 0x180052844
test r15d, r15d
mov eax, 1
cmove r15d, eax
dec r15d
jmp 0x180052844
test r15d, r15d
jns 0x180052844
neg r15d
jmp 0x180052844
mov rcx, qword [r12 + 0x10]
mov r9d, StrCmpICW
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
call fcn.180022030
mov r15d, eax
add edi, 0x290c
cmp edi, 0x7b24
jbe 0x1800527f0
mov dword [rbp - 0x60], r15d
mov r15, qword [rbp - 0x40]
jmp 0x18005250e
xor ebx, ebx
dec r13d
cmp r13d, dword [rsp + 0x58]
jbe case.0x180052280.280
mov rdi, qword [rbp - 0x30]
mov r10, qword [rbp - 0x68]
jmp 0x180052250
mov eax, 0xfffffffa
jmp 0x1800521a7
xor ebx, ebx
lea rax, [rbp - 0x58]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov dword [rbp - 0x58], ebx
jmp 0x18005218c
mov eax, 0xffffffff
jmp 0x1800521a7