{"type": "func", "start": 6443740164, "end": 6443740421, "name": "__dcrt_get_narrow_environment_from_os", "pseudocode": "// \n// __dcrt_get_narrow_environment_from_os from 0x18013ac04 to 0x18013ad05 (257 bytes)\n// \n// 2 xrefs:\n// > common_initialize_environment_nolock @ 0x180131e52\n// > @ 0x1802038b4\n// \n// This function is hookable on this platform!\n// \n// Using BromaIDA 8.0.0 @ https://github.com/Stazzical/BromaIDA\n// Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings\n// \n\nCHAR *_dcrt_get_narrow_environment_from_os()\n{\n LPWCH EnvironmentStringsW; // rax\n WCHAR *v1; // rbx\n char *v2; // rsi\n __int64 v3; // rax\n __int64 v4; // rsi\n int v5; // eax\n int v6; // ebp\n CHAR *v7; // rax\n CHAR *v8; // rdi\n CHAR *v9; // rsi\n\n EnvironmentStringsW = GetEnvironmentStringsW();\n v1 = EnvironmentStringsW;\n if ( !EnvironmentStringsW )\n goto LABEL_12;\n v2 = (char *)EnvironmentStringsW;\n if ( *EnvironmentStringsW )\n {\n do\n {\n v3 = -1;\n do\n ++v3;\n while ( *(_WORD *)&v2[2 * v3] );\n v2 += 2 * v3 + 2;\n }\n while ( *(_WORD *)v2 );\n }\n v4 = (v2 - (char *)v1 + 2) >> 1;\n v5 = _acrt_WideCharToMultiByte(0, 0, v1, v4, nullptr, 0, nullptr, nullptr);\n v6 = v5;\n if ( v5 )\n {\n v7 = (CHAR *)malloc_base(v5);\n v8 = v7;\n if ( v7 && _acrt_WideCharToMultiByte(0, 0, v1, v4, v7, v6, nullptr, nullptr) )\n {\n v9 = v8;\n v8 = nullptr;\n }\n else\n {\n v9 = nullptr;\n }\n free_base(v8);\n }\n else\n {\nLABEL_12:\n v9 = nullptr;\n }\n if ( v1 )\n FreeEnvironmentStringsW(v1);\n return v9;\n}", "assembly": "; \n; __dcrt_get_narrow_environment_from_os from 0x18013ac04 to 0x18013ad05 (257 bytes)\n; \n; 2 xrefs:\n; > common_initialize_environment_nolock @ 0x180131e52\n; > @ 0x1802038b4\n; \n; This function is hookable on this platform!\n; \n; Using BromaIDA 8.0.0 @ https:;github.com/Stazzical/BromaIDA\n; Using bindings at commit ba9f177b at Thu Jul 16 22:52:06 2026 from https:;github.com/geode-sdk/bindings\n; \n\nmov rax, rsp ; +0x0, 0x18013ac04\nmov [rax+8], rbx ; +0x3, 0x18013ac07\nmov [rax+10h], rbp ; +0x7, 0x18013ac0b\nmov [rax+18h], rsi ; +0xb, 0x18013ac0f\nmov [rax+20h], rdi ; +0xf, 0x18013ac13\npush r14 ; +0x13, 0x18013ac17\nsub rsp, 40h ; +0x15, 0x18013ac19\ncall cs:GetEnvironmentStringsW ; +0x19, 0x18013ac1d\nxor r14d, r14d ; +0x1f, 0x18013ac23\nmov rbx, rax ; +0x22, 0x18013ac26\ntest rax, rax ; +0x25, 0x18013ac29\njz loc_18013ACD6 ; +0x28, 0x18013ac2c\nmov rsi, rax ; +0x2e, 0x18013ac32\ncmp [rax], r14w ; +0x31, 0x18013ac35\njz short loc_18013AC57 ; +0x35, 0x18013ac39\nor rax, 0FFFFFFFFFFFFFFFFh ; +0x37, 0x18013ac3b\ninc rax ; +0x3b, 0x18013ac3f\ncmp [rsi+rax*2], r14w ; +0x3e, 0x18013ac42\njnz short loc_18013AC3F ; +0x43, 0x18013ac47\nlea rsi, [rsi+rax*2] ; +0x45, 0x18013ac49\nadd rsi, 2 ; +0x49, 0x18013ac4d\ncmp [rsi], r14w ; +0x4d, 0x18013ac51\njnz short loc_18013AC3B ; +0x51, 0x18013ac55\nmov [rsp+48h+var_10], r14 ; +0x53, 0x18013ac57\nsub rsi, rbx ; +0x58, 0x18013ac5c\nmov [rsp+48h+var_18], r14 ; +0x5b, 0x18013ac5f\nadd rsi, 2 ; +0x60, 0x18013ac64\nsar rsi, 1 ; +0x64, 0x18013ac68\nmov r8, rbx ; +0x67, 0x18013ac6b\nmov r9d, esi ; +0x6a, 0x18013ac6e\nmov [rsp+48h+var_20], r14d ; +0x6d, 0x18013ac71\nxor edx, edx ; +0x72, 0x18013ac76\nmov [rsp+48h+var_28], r14 ; +0x74, 0x18013ac78\nxor ecx, ecx ; +0x79, 0x18013ac7d\ncall __acrt_WideCharToMultiByte ; +0x7b, 0x18013ac7f\nmovsxd rbp, eax ; +0x80, 0x18013ac84\ntest eax, eax ; +0x83, 0x18013ac87\njz short loc_18013ACD6 ; +0x85, 0x18013ac89\nmov rcx, rbp; Size ; +0x87, 0x18013ac8b\ncall _malloc_base ; +0x8a, 0x18013ac8e\nmov rdi, rax ; +0x8f, 0x18013ac93\ntest rax, rax ; +0x92, 0x18013ac96\njz short loc_18013ACC9 ; +0x95, 0x18013ac99\nmov [rsp+48h+var_10], r14 ; +0x97, 0x18013ac9b\nmov r9d, esi ; +0x9c, 0x18013aca0\nmov [rsp+48h+var_18], r14 ; +0x9f, 0x18013aca3\nmov r8, rbx ; +0xa4, 0x18013aca8\nmov [rsp+48h+var_20], ebp ; +0xa7, 0x18013acab\nxor edx, edx ; +0xab, 0x18013acaf\nxor ecx, ecx ; +0xad, 0x18013acb1\nmov [rsp+48h+var_28], rax ; +0xaf, 0x18013acb3\ncall __acrt_WideCharToMultiByte ; +0xb4, 0x18013acb8\ntest eax, eax ; +0xb9, 0x18013acbd\njz short loc_18013ACC9 ; +0xbb, 0x18013acbf\nmov rsi, rdi ; +0xbd, 0x18013acc1\nmov rdi, r14 ; +0xc0, 0x18013acc4\njmp short loc_18013ACCC ; +0xc3, 0x18013acc7\nmov rsi, r14 ; +0xc5, 0x18013acc9\nmov rcx, rdi; Block ; +0xc8, 0x18013accc\ncall _free_base ; +0xcb, 0x18013accf\njmp short loc_18013ACD9 ; +0xd0, 0x18013acd4\nmov rsi, r14 ; +0xd2, 0x18013acd6\ntest rbx, rbx ; +0xd5, 0x18013acd9\njz short loc_18013ACE7 ; +0xd8, 0x18013acdc\nmov rcx, rbx; penv ; +0xda, 0x18013acde\ncall cs:FreeEnvironmentStringsW ; +0xdd, 0x18013ace1\nmov rbx, [rsp+48h+arg_0] ; +0xe3, 0x18013ace7\nmov rax, rsi ; +0xe8, 0x18013acec\nmov rsi, [rsp+48h+arg_10] ; +0xeb, 0x18013acef\nmov rbp, [rsp+48h+arg_8] ; +0xf0, 0x18013acf4\nmov rdi, [rsp+48h+arg_18] ; +0xf5, 0x18013acf9\nadd rsp, 40h ; +0xfa, 0x18013acfe\npop r14 ; +0xfe, 0x18013ad02\nretn ; +0x100, 0x18013ad04", "xrefs": ["common_initialize_environment_nolock @ 0x180131e52", " @ 0x1802038b4"], "is_objc": false, "is_arm32": false, "is_arm64": false, "bida_info": "8.0.0 @ https://github.com/Stazzical/BromaIDA", "bindings_info": "commit ba9f177b at Thu Jul 16 22:52:06 2026 from https://github.com/geode-sdk/bindings"}