Function at 0x140003b5c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2f0
mov rax, qword [0x140017150]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rdi, rdx
movsxd rsi, ecx
call fcn.14000307c
mov dword [rsp + 0xa8], 5
lea rcx, [rsp + 0xb0]
call fcn.140002b08
mov ebx, 1
mov byte [rsp + 0xd0], bl
cmp esi, ebx
jle 0x140003be8
xor r12d, r12d
mov dword [rsp + 0xa8], r12d
lea rdx, str.install
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003c58
mov dword [rsp + 0xa8], ebx
lea rcx, [rsp + 0xe0]
call fcn.140004850
nop
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0xe0]
call fcn.140005684
mov ebx, eax
lea rcx, [rsp + 0xe0]
call fcn.140002d9c
nop
lea rcx, [rsp + 0xb0]
call fcn.140002cb8
mov eax, ebx
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.140001510
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rdx, str.uninstall
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003c83
mov dword [rsp + 0xa8], 2
jmp 0x140003be8
lea rdx, str.stop
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003cae
mov dword [rsp + 0xa8], 4
jmp 0x140003be8
lea rdx, str.start
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003cd9
mov dword [rsp + 0xa8], 3
jmp 0x140003be8
lea rdx, str.test
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003d04
mov dword [rsp + 0xa8], 7
jmp 0x140003be8
lea rdx, str.testOneCore
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003d2f
mov dword [rsp + 0xa8], 8
jmp 0x140003be8
lea rdx, str.authorize
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003fa9
cmp esi, 3
jl 0x140003c1b
lea rdx, [rsp + 0x90]
mov rcx, qword [rdi + 0x10]
call fcn.1400032fc
test eax, eax
jns 0x140003d81
mov dword [rsp + 0x40], eax
lea rdx, [0x140014158]
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
mov byte [rsp + 0x30], r12b
lea rcx, [rsp + 0x30]
call fcn.140003400
test eax, eax
jns 0x140003da9
mov dword [rsp + 0x44], eax
lea rdx, [0x140014158]
lea rcx, [rsp + 0x44]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
mov qword [rsp + 0x70], r12
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [0x1400114d8]
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [0x1400114c8]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
nop dword [rax + rax]
test eax, eax
jns 0x140003df1
mov dword [rsp + 0x48], eax
lea rdx, [0x140014158]
lea rcx, [rsp + 0x48]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x80], r12
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
movabs r10, 0x88ed36c03a596370
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x90]
mov rax, qword [rax + 0x20]
call qword [0x140010da0]
test eax, eax
jns 0x140003e48
mov dword [rsp + 0x4c], eax
lea rdx, [0x140014158]
lea rcx, [rsp + 0x4c]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
mov qword [rsp + 0x68], r12
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
movabs r10, 0x8618a61d70ddf370
lea rdx, [rsp + 0x68]
mov rax, qword [rax + 0x18]
call qword [0x140010da0]
test eax, eax
jns 0x140003e87
mov dword [rsp + 0x50], eax
lea rdx, [0x140014158]
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
mov qword [rsp + 0x78], r12
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
call fcn.14000c5ec
test eax, eax
jns 0x140003eb4
mov dword [rsp + 0x54], eax
lea rdx, [0x140014158]
lea rcx, [rsp + 0x54]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
mov qword [rsp + 0x60], r12
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
movabs r10, 0xdee01e7974d59970
lea r8, [rsp + 0x60]
lea rdx, [0x1400114b8]
mov rax, qword [rax]
call qword [0x140010da0]
nop
test eax, eax
jns 0x140003efa
mov dword [rsp + 0x58], eax
lea rdx, [0x140014158]
lea rcx, [rsp + 0x58]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
movabs r10, 0x91690efa18570b70
lea rdx, [rsp + 0x90]
mov rax, qword [rax + 0x18]
call qword [0x140010da0]
test eax, eax
jns 0x140003f38
mov dword [rsp + 0x5c], eax
lea rdx, [0x140014158]
lea rcx, [rsp + 0x5c]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
nop
lea rcx, [rsp + 0x60]
call fcn.140002c04
nop
lea rcx, [rsp + 0x78]
call fcn.140002cfc
nop
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
nop
lea rcx, [rsp + 0x80]
call fcn.140002c04
nop
lea rcx, [rsp + 0x38]
call fcn.140002c04
nop
lea rcx, [rsp + 0x70]
call fcn.140002c04
nop
cmp byte [rsp + 0x30], r12b
je 0x140003f98
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop dword [rax + rax]
nop
xor ebx, ebx
jmp 0x140003c1b
mov r13, rsi
lea rdx, str.merge
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400040f5
cmp esi, 4
jge 0x140003fd8
lea ebx, [rax + 0x57]
jmp 0x140003c1b
mov r15, qword [rdi + 0x10]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x90], xmm0
mov rcx, r12
mov qword [rsp + 0xa0], rcx
cmp r13, 3
jbe 0x140004050
lea rsi, [rdi + 0x18]
lea r14, [r13 - 3]
mov rdi, qword [rsp + 0x98]
cmp rdi, rcx
je 0x140004022
mov rax, qword [rsi]
mov qword [rdi], rax
add rdi, 8
mov qword [rsp + 0x98], rdi
jmp 0x140004045
mov r8, rsi
mov rdx, rdi
lea rcx, [rsp + 0x90]
call fcn.140002808
mov rcx, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x98]
add rsi, 8
sub r14, rbx
jne 0x140004009
jmp 0x140004058
mov rdi, qword [rsp + 0x98]
mov ebx, 0x1f
xor r8d, r8d
xor edx, edx
lea rcx, str.XPERF_EmbeddedPdbPath
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov ecx, 0x11f
test eax, eax
cmovne ebx, ecx
xor r8d, r8d
xor edx, edx
lea rcx, str.DIAGHUB_DataInjectOnly
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
test eax, eax
je 0x14000409f
bts ebx, 0x1e
lea rcx, [rsp + 0x1b0]
call fcn.14000c71c
nop
mov r8, qword [rsp + 0x90]
sub rdi, r8
sar rdi, 3
mov dword [rsp + 0x20], ebx
mov r9d, edi
mov rdx, r15
lea rcx, [rsp + 0x1b0]
call fcn.14000c930
mov ebx, eax
lea rcx, [rsp + 0x1b0]
call fcn.14000c7bc
nop
lea rcx, [rsp + 0x90]
call fcn.140003a5c
jmp 0x140003c1b
lea rdx, str.service
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400041ec
mov dword [rsp + 0xa8], 6
mov byte [rsp + 0xd0], bl
lea r14d, [rax + 2]
cmp r14, r13
jge 0x140003be8
mov r15, qword [rdi + r14*8]
add r15, 2
lea rdx, [0x1400113e0]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsstr]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x140004178
mov word [rax], r12w
add rsi, 2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r12w
jne 0x140004165
neg rax
sbb rax, rax
and rsi, rax
lea rdx, str.LaunchCompleteEventName
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400041b7
test rsi, rsi
je 0x1400041e0
or r8, 0xffffffffffffffff
inc r8
cmp word [rsi + r8*2], r12w
jne 0x14000419b
mov rdx, rsi
lea rcx, [rsp + 0xb0]
call fcn.140003ac4
jmp 0x1400041d8
lea rdx, str.NoTimeout
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
neg eax
sbb cl, cl
and byte [rsp + 0xd0], cl
add r14, rbx
jmp 0x14000412a
mov rdx, r15
lea rcx, str.Invalid_argument_for_flag:__s_n
jmp 0x1400041f7
mov rdx, qword [rdi + 8]
lea rcx, str.Unrecognized_option:__s_n
call fcn.14000225c
jmp 0x140003c1b