Function at 0x1401402a0
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r12, qword [rsp + 0xb8]
xor r13d, r13d
mov rbx, r9
mov r14, qword [rsp + 0xb0]
mov r9, rdx
mov byte [rsp + 0x40], 0
cmp byte [rsp + 0xc8], r13b
jne 0x14014056e
mov rax, qword [r8]
lea r8, [r11 - 0x38]
mov r10d, dword [rbx]
mov ecx, dword [r9]
lea r9, [r11 - 0x40]
movzx ebp, byte [rsp + 0xd0]
sub ecx, r10d
lea rdx, [rax + r10*8]
lea rax, [r11 - 0x48]
mov qword [r11 - 0x50], rax
lea rax, [0x1407e4d80]
mov byte [rsp + 0x30], bpl
mov qword [r11 - 0x60], rax
lea rax, [0x1407e4b50]
mov qword [r11 - 0x68], rax
call fcn.14013ed00
add dword [rbx], eax
cmp qword [0x1407e4b50], r13
jne 0x140140353
lea rcx, str.MYSQL_GROUP_SUFFIX
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [0x1407e4b50], rax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140140384
cmp byte [0x1407e4d88], r13b
jne 0x140140384
lea rbx, [0x1407e4f90]
mov rdx, rbx
call fcn.14013ebc0
test eax, eax
jne 0x140140550
mov qword [0x1407e4b48], rbx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1401403b5
cmp byte [0x1407e4d88], r13b
jne 0x1401403b5
lea rbx, [0x1407e4d90]
mov rdx, rbx
call fcn.14013ebc0
test eax, eax
jne 0x140140550
mov qword [0x1407e4b58], rbx
mov byte [0x1407e4d88], 1
call fcn.14013f0e0
mov rax, qword [0x1407e4b50]
test rax, rax
je 0x140140510
lea rcx, [0x1401429f0]
cmp r14, rcx
jne 0x140140510
mov rbp, 0xffffffffffffffff
mov rsi, rbp
nop dword [rax + rax]
cmp byte [rax + rsi + 1], r13b
lea rsi, [rsi + 1]
jne 0x1401403f0
mov rcx, qword [r12]
mov r15, qword [r12 + 0x10]
mov r14, qword [rcx + 8]
mov rdx, qword [r15]
mov rax, qword [rcx + 0x10]
shl rdx, 4
sub rax, r14
add rdx, 0xf
and rdx, 0xfffffffffffffff8
cmp rax, rdx
jb 0x14014042d
lea rax, [r14 + rdx]
mov qword [rcx + 8], rax
jmp 0x140140435
call fcn.140128e80
mov r14, rax
test r14, r14
je 0x1401406b4
mov rax, qword [r15]
mov dword [rsp + 0x48], r13d
test rax, rax
je 0x1401404f2
nop
mov rax, qword [r15 + 0x10]
mov rbx, rbp
mov rcx, qword [rax + r13*8]
mov qword [r14 + r13*8], rcx
nop
inc rbx
cmp byte [rcx + rbx], 0
jne 0x140140460
mov rcx, qword [r12]
lea rdx, [rsi + 1]
add rdx, rbx
mov edx, edx
add rdx, 7
mov rdi, qword [rcx + 8]
and rdx, 0xfffffffffffffff8
mov rax, qword [rcx + 0x10]
sub rax, rdi
cmp rax, rdx
jb 0x140140498
lea rax, [rdi + rdx]
mov qword [rcx + 8], rax
jmp 0x1401404a0
call fcn.140128e80
mov rdi, rax
test rdi, rdi
je 0x1401406b4
mov r8, qword [r15]
mov rcx, rdi
add r8, r13
mov qword [r14 + r8*8], rdi
mov r8, rbx
mov rdx, qword [r14 + r13*8]
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [0x1407e4b50]
lea r8, [rsi + 1]
lea rcx, [rdi + rbx]
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [rsp + 0x48]
mov rax, qword [r15]
inc edx
mov r13d, edx
mov dword [rsp + 0x48], edx
cmp r13, rax
jb 0x140140450
xor r13d, r13d
add rax, rax
mov qword [r15 + 0x10], r14
mov qword [r15], rax
mov qword [r14 + rax*8], r13
mov r14, qword [rsp + 0xb0]
movzx ebp, byte [rsp + 0xd0]
mov rsi, qword [rsp + 0x90]
mov rcx, rsi
call fcn.1401300a0
test rax, rax
je 0x1401406be
movzx eax, byte [rsp + 0xc8]
mov r9, rsi
xor r8d, r8d
mov byte [rsp + 0x20], al
mov rdx, r12
mov rcx, r14
call fcn.140140de0
test eax, eax
js 0x1401407c6
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp qword [0x1407e4d80], r13
je 0x140140508
lea rcx, [0x1401429f0]
cmp r14, rcx
jne 0x140140508
mov rcx, qword [r12]
mov rbx, qword [r12 + 0x10]
mov r14, qword [rcx + 8]
mov rax, qword [rbx]
lea rdx, [rax*8 + 0x1f]
mov rax, qword [rcx + 0x10]
sub rax, r14
and rdx, 0xfffffffffffffff8
cmp rax, rdx
jb 0x1401405b5
lea rax, [r14 + rdx]
mov qword [rcx + 8], rax
jmp 0x1401405bd
call fcn.140128e80
mov r14, rax
test r14, r14
je 0x1401406b4
mov edi, r13d
cmp qword [rbx], rdi
jbe 0x1401405f5
mov rdx, r13
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
inc edi
mov rcx, qword [rax + rdx*8]
mov qword [r14 + rdx*8], rcx
mov edx, edi
cmp rdx, qword [rbx]
jb 0x1401405e0
mov rcx, qword [0x1407e4d80]
mov eax, edi
lea r13, [r14 + rax*8]
mov qword [r13], rcx
mov rax, qword [0x1407e4b50]
test rax, rax
je 0x1401406a2
mov rbp, 0xffffffffffffffff
mov rsi, rbp
inc rsi
cmp byte [rax + rsi], 0
jne 0x140140620
nop dword [rax]
inc rbp
cmp byte [rcx + rbp], 0
jne 0x140140630
mov rcx, qword [r12]
lea rdx, [rbp + 1]
add rdx, rsi
mov edx, edx
add rdx, 7
mov r15, qword [rcx + 8]
and rdx, 0xfffffffffffffff8
mov rax, qword [rcx + 0x10]
sub rax, r15
cmp rax, rdx
jb 0x140140668
lea rax, [r15 + rdx]
mov qword [rcx + 8], rax
jmp 0x140140670
call fcn.140128e80
mov r15, rax
test r15, r15
je 0x1401406b4
mov rdx, qword [r13]
lea ecx, [rdi + 1]
mov qword [r14 + rcx*8], r15
mov r8, rbp
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [0x1407e4b50]
lea r8, [rsi + 1]
lea rcx, [r15 + rbp]
call sub.VCRUNTIME140.dll_memcpy
inc qword [rbx]
inc qword [rbx]
mov rax, qword [rbx]
xor r13d, r13d
mov qword [rbx + 0x10], r14
jmp 0x1401404fc
mov eax, 2
jmp 0x140140550
mov rax, qword [0x1407e4b58]
test rax, rax
je 0x140140719
movzx edi, byte [rsp + 0xc8]
lea r9, [0x1404df8b6]
mov byte [rsp + 0x38], 0
lea r8, [0x1404df8b6]
mov byte [rsp + 0x30], dil
mov rdx, r12
mov dword [rsp + 0x28], r13d
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.140140eb0
test eax, eax
js 0x1401407c6
jle 0x14014054e
mov r8, qword [0x1407e4b58]
jmp 0x1401407b9
test bpl, bpl
jne 0x14014054e
mov rbx, qword [rsp + 0xc0]
mov rax, qword [rbx]
test rax, rax
je 0x14014054e
movzx edi, byte [rsp + 0xc8]
nop
cmp byte [rax], 0
je 0x140140761
mov r9, rsi
mov byte [rsp + 0x20], dil
mov r8, rax
mov rdx, r12
mov rcx, r14
call fcn.140140de0
test eax, eax
js 0x1401407c6
jmp 0x1401407a0
mov rax, qword [0x1407e4b48]
test rax, rax
je 0x1401407a0
mov byte [rsp + 0x38], 0
lea r9, [0x1404df8b6]
mov byte [rsp + 0x30], dil
lea r8, [0x1404df8b6]
mov dword [rsp + 0x28], r13d
mov rdx, r12
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.140140eb0
test eax, eax
js 0x1401407c6
jg 0x1401407b2
mov rax, qword [rbx + 8]
add rbx, 8
test rax, rax
jne 0x140140740
jmp 0x14014054e
mov r8, qword [0x1407e4b48]
mov edx, Ordinal_50
lea ecx, [rdx - 0x2e]
call fcn.14012f780
mov edx, Ordinal_50
lea ecx, [rdx - 0x2f]
call fcn.14012f780
mov eax, 1
jmp 0x140140550