Function at 0x140003530
Capabilities:
Check os version
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov rsi, rcx
mov r13, qword [0x1400f74a8]
mov rax, qword [r13]
xor rax, rsp
mov qword [rsp + 0x470], rax
test rdx, rdx
je 0x14000363e
mov ebp, r8d
mov r14, rdx
mov rcx, rdx
mov edx, 0x5c
call sub.api_ms_win_crt_private_l1_1_0.dll_strrchr
test rax, rax
je 0x140003913
mov r15, rax
sub r15, r14
lea r12, [r15 + 1]
lea rcx, [r15 + 9]
call sub.mozglue.dll_malloc
mov rdi, rax
mov rcx, rax
mov rdx, r14
mov r8, r12
call sub.ntdll.dll_memcpy
movabs rax, 0x6c6c642e6c7578
mov qword [rdi + r15 + 1], rax
movzx eax, byte [rdi]
test al, al
je 0x140003651
xor r14d, r14d
mov rcx, rdi
nop word cs:[rax + rax]
cmp al, 0x2f
cmove r14, rcx
cmp al, 0x5c
cmove r14, rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400035d0
test r14, r14
je 0x140003651
sub r14, rdi
cmp r14, 0xf0
ja 0x140003923
lea rcx, [rsp + 0x150]
mov r9d, 0x104
mov rdx, rdi
mov r8, r14
call fcn.1400c8810
movups xmm0, xmmword [0x1400f7507]
movups xmmword [rsp + r14 + 0x150], xmm0
mov dword [rsp + r14 + 0x160], 0x747369
lea rbx, [rsp + r14]
add rbx, 0x151
jmp 0x140003673
mov byte [rsi + 8], 1
mov byte [rsi + 4], 0
mov dword [rsi], 0x80070057
jmp 0x14000393c
movups xmm0, xmmword [str.dependentlibs.list]
movaps xmmword [rsp + 0x150], xmm0
mov dword [rsp + 0x15f], 0x747369
lea rbx, [rsp + 0x150]
lea rcx, str.MOZ_RUN_GTEST
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x14000369e
lea rdx, str..gtest
lea rcx, [rsp + 0x150]
mov r8d, 0x104
call fcn.1400c8900
lea r14, [rsp + 0x260]
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x28], 0x104
lea r8, [rsp + 0x150]
mov ecx, 0xfde9
xor edx, edx
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdx, [0x1400f7544]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
test rax, rax
je 0x140003923
mov r14, rax
mov dword [rsp + 0x3c], ebp
mov byte [rbx], 0
lea rcx, [rsp + 0x40]
mov edx, 0x104
mov r8, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fgets
test rax, rax
je 0x14000396b
mov r15, rbx
lea rax, [rsp + 0x150]
sub r15, rax
lea rbp, [rsp + 0x40]
jmp 0x140003749
mov rcx, rbp
mov edx, 0x104
mov r8, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fgets
test rax, rax
je 0x14000396b
mov rcx, rbp
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r13, rax
test r13d, r13d
je 0x140003730
cmp byte [rsp + 0x40], 0x23
je 0x140003730
mov ecx, dword [0x1401376dc]
mov al, 1
cmp ecx, 0x9ffffff
ja 0x14000383a
mov eax, dword [section..data]
cmp eax, 0xa000001
jb 0x14000384c
mov r8d, 0x110
lea rcx, [rsp + 0x26c]
xor edx, edx
call sub.ntdll.dll_memset
movabs rax, 0xa0000011c
mov qword [rsp + 0x260], rax
mov dword [rsp + 0x268], 0
xor ecx, ecx
mov edx, 2
mov r8b, 3
mov rax, qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov r12, rdi
mov rdi, r15
mov r15, rbx
mov rbx, rax
call rax
mov rcx, rax
mov edx, 1
mov r8b, 3
call rbx
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call rbx
mov rcx, rax
mov edx, 0x10
mov r8b, 3
call rbx
mov rbx, r15
mov r15, rdi
mov rdi, r12
lea rcx, [rsp + 0x260]
mov edx, 0x33
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
setne al
lea rcx, section..data
lea rdx, [0x1401376dc]
cmovne rcx, rdx
mov edx, 0xa000000
xchg dword [rcx], edx
test al, al
je 0x14000384c
cmp dword [rsp + 0x40], 0x2d697061
je 0x140003730
shl r13, 0x20
movabs rax, 0xffffffff00000000
add rax, r13
sar rax, 0x20
cmp byte [rsp + rax + 0x40], 0xa
jne 0x14000386d
mov byte [rsp + rax + 0x40], 0
sar r13, 0x20
add r13, r15
cmp r13, 0x104
lea r12, [rsp + 0x260]
ja 0x1400039f2
mov rcx, rbx
mov rdx, rbp
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x28], 0x104
mov ecx, 0xfde9
xor edx, edx
lea r8, [rsp + 0x150]
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp dword [rsp + 0x3c], 1
jne 0x1400038cb
mov rcx, r12
call fcn.140002960
mov rcx, r12
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
je 0x1400039fb
mov r13, rax
mov ecx, 0x10
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rcx, qword [0x140135488]
mov qword [rax + 8], rcx
mov qword [rax], r13
mov qword [0x140135488], rax
call qword [method.mozilla.PollPreXULSkeletonUIEvents__]
jmp 0x140003730
mov byte [rsi + 8], 1
mov byte [rsi + 4], 0
mov dword [rsi], 0x80520009
jmp 0x14000393c
mov ebx, 0x80004005
xor ebp, ebp
mov byte [rsi + 8], 1
mov byte [rsi + 4], bpl
mov dword [rsi], ebx
mov rcx, rdi
call sub.mozglue.dll_free
mov rax, qword [rsp + 0x470]
xor rax, rsp
mov rcx, qword [r13]
cmp rcx, rax
jne 0x140003a59
mov rax, rsi
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov rax, qword [0x140135488]
test rax, rax
je 0x1400039c5
mov rcx, qword [rax]
lea rdx, str.XRE_GetBootstrap
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov r13, qword [0x1400f74a8]
je 0x1400039df
mov qword [rsp + 0x260], 0
lea rcx, [rsp + 0x260]
call rax
mov byte [rsi + 8], 0
mov rax, qword [rsp + 0x260]
mov qword [rsi], rax
jmp 0x140003934
mov byte [rsi + 8], 1
mov byte [rsi + 4], 0
mov dword [rsi], 0x80040111
mov r13, qword [0x1400f74a8]
jmp 0x140003934
mov byte [rsi + 8], 1
mov byte [rsi + 4], 0
mov dword [rsi], 0x80040111
jmp 0x140003934
mov ebx, 0x80004005
xor ebp, ebp
jmp 0x140003a45
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r12, qword [0x140135488]
mov bpl, 1
test r12, r12
je 0x140003a45
mov r15, qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r13, qword [0x1400f74a8]
mov rcx, qword [r12]
call r15
mov rcx, qword [0x140135488]
mov r12, qword [rcx + 8]
mov qword [0x140135488], r12
call sub.mozglue.dll_free
test r12, r12
jne 0x140003a20
jmp 0x140003a4c
mov r13, qword [0x1400f74a8]
mov rcx, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
jmp 0x14000392a
call fcn.1400c8850
int3