Function at 0x14035c480
Capabilities:
Query environment variable

Disassembly:
push rbx
push rsi
push r15
sub rsp, 0xa0
mov r15, rcx
mov dword [rsp + 0xc8], edx
test dl, 4
je 0x14035c4bc
test dl, 1
je 0x14035c4b0
mov eax, 0xad
add rsp, 0xa0
pop r15
pop rsi
pop rbx
ret
mov ecx, 0xad
xor edx, edx
call fcn.140383960
test r15, r15
jne 0x14035c4e8
test byte [rsp + 0xc8], 1
je 0x14035c4dc
mov eax, 0x99
add rsp, 0xa0
pop r15
pop rsi
pop rbx
ret
mov ecx, 0x99
xor edx, edx
call fcn.140383960
mov eax, dword [0x141940844]
test eax, eax
je 0x14035c67b
mov eax, dword [0x141940844]
test eax, eax
je 0x14035c67b
lea rcx, [0x141a57ce0]
call fcn.140340e60
mov eax, dword [0x141a57ce4]
test eax, eax
jne 0x14035c549
lea rcx, str.FOR_DISABLE_KMP_MALLOC
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
test rax, rax
ja 0x14035c535
je 0x14035c53f
mov dword [0x141940844], 0
mov dword [0x141a57ce4], 1
lea rax, [fcn.14035cd60]
lea rbx, [fcn.14035cd80]
mov qword [rsp + 0x68], rax
lea rsi, [0x14035cd70]
mov qword [rsp + 0x70], rbx
lea r8, [fcn.14035cd60]
mov qword [rsp + 0x78], rsi
lea r9, [fcn.14035cd80]
mov qword [rsp + 0x80], r8
lea r10, [0x14035cd70]
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x90], r10
mov r11, qword [rsp + 0x68]
mov rax, qword [rsp + 0x80]
cmp r11, rax
je 0x14035c5da
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x88]
cmp rax, rbx
je 0x14035c5da
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x90]
cmp rax, rbx
je 0x14035c5da
mov dword [0x141a57ce8], 1
lea rax, [fcn.14035cd90]
lea rbx, [fcn.14035cda0]
mov qword [rsp + 0x38], rax
lea rsi, [fcn.14035cdb0]
mov qword [rsp + 0x40], rbx
lea r8, [fcn.14035cd90]
mov qword [rsp + 0x48], rsi
lea r9, [fcn.14035cda0]
mov qword [rsp + 0x50], r8
lea r10, [fcn.14035cdb0]
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x60], r10
mov r11, qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
cmp r11, rax
je 0x14035c659
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
cmp rax, rbx
je 0x14035c659
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x60]
cmp rax, rbx
je 0x14035c659
mov dword [0x141a57cec], 1
mov eax, dword [0x141a57cec]
test eax, eax
je 0x14035c66d
mov dword [0x141a57cf0], 1
xor eax, eax
mov dword [0x141940844], eax
mov dword [0x141a57ce0], eax
mov bl, byte [rsp + 0xcb]
movzx esi, byte [rsp + 0xc8]
and bl, 2
test esi, 4
je 0x14035c6ad
test esi, 1
jne 0x14035c49f
mov ecx, 0xad
xor edx, edx
call fcn.140383960
test bl, bl
je 0x14035c702
mov eax, dword [0x141a57cf0]
test eax, eax
je 0x14035c702
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
movq qword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x20]
call 0x141a6daf0
movzx r8d, word [rsp + 0xca]
and r8d, 0x1e0
shr r8d, 5
cmp r8d, 0xf
je 0x14035c7bb
mov ecx, eax
mov rdx, r15
call fcn.14035cdb0
jmp 0x14035c7ad
test byte [rsp + 0xc8], 0x40
jne 0x14035c7ca
test byte [rsp + 0xc9], 1
je 0x14035c72e
mov eax, dword [0x141a57ce8]
test eax, eax
je 0x14035c72e
mov rcx, r15
call fcn.14035cd80
jmp 0x14035c7ad
lea rcx, [0x141a57cf8]
call fcn.140340e60
mov rbx, r15
lea rax, [0x140000000]
shr rbx, 0x1c
and rbx, 0xfff
cmp r15, qword [rax + rbx*8 + 0x1a4fae0]
je 0x14035c77f
mov dword [0x141a57cf8], 0
test esi, 0x20
jne 0x14035c775
mov eax, dword [0x141a57ce8]
test eax, eax
jne 0x14035c724
mov rcx, r15
call fcn.140453940
jmp 0x14035c7ad
mov rcx, r15
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rax, [0x140000000]
mov dword [0x141a57cf8], 0
mov qword [rax + rbx*8 + 0x1a4fae0], 0
xor eax, eax
add rsp, 0xa0
pop r15
pop rsi
pop rbx
ret
mov ecx, eax
mov rdx, r15
xor r8d, r8d
call fcn.14035cdb0
jmp 0x14035c7ad
mov rcx, r15
call fcn.1403d3d70
jmp 0x14035c7ad