Function at 0x180035540
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
lea eax, [rdx + 0x44a]
mov qword [rsp + 0x40], r8
mov dword [rsp + 0x30], edx
mov edi, edx
mov dword [rsp + 0x38], eax
mov r13, rcx
cmp edx, eax
jae 0x1800358bd
movsxd rbp, dword [rsp + 0x38]
lea rcx, [0x1800859d0]
mov rsi, qword [rsp + 0x68]
mov r14, rbp
mov r15d, dword [rsp + 0x38]
nop dword [rax]
cmp edi, 0x103
ja 0x180035676
je 0x1800358d9
mov eax, edi
sub eax, 0x34
je 0x180035660
sub eax, 0x19
je 0x1800358ac
sub eax, 0x7a
je 0x1800355d7
cmp eax, 0x31
jne 0x1800358ac
mov rcx, r8
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [rsp + 0x60], rax
jmp 0x1800358a0
mov qword [rsp + 0x68], rcx
lea r8, [rsp + 0x48]
mov ecx, ILFree
mov dword [rsp + 0x48], 0
lea rdx, [rsp + 0x68]
call fcn.180085090
xor edx, edx
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x30], edx
mov ebx, 0xff
mov ecx, ebx
sub ecx, 2
je 0x180035628
sub ecx, 0x90
je 0x1800358a0
cmp ecx, 0x6d
jne 0x18003564d
mov dword [0x1800a6c78], edx
jmp 0x18003564d
mov eax, dword [pe_dos_header]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov edx, 0x34
xor ecx, ecx
call fcn.180030540
mov edx, dword [rsp + 0x30]
add ebx, 0x90
cmp ebx, 0x2af
jb 0x180035608
jmp 0x1800358a0
movzx eax, byte [r8]
mov byte [r13], al
movzx eax, byte [r8 + 1]
mov byte [r13 + 1], al
jmp 0x1800358ac
mov eax, edi
sub eax, 0x141
je 0x1800358ac
sub eax, 0x31
je 0x1800356e0
sub eax, 0x49
je 0x1800356ae
cmp eax, 0x7a
jne 0x1800358ac
mov rcx, qword [rsp + 0x58]
lea r9d, [rax - 0x28]
xor r8d, r8d
xor edx, edx
call fcn.180051760
jmp 0x1800358a0
mov ebx, ILClone
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rsp + 0x58]
mov r9d, 0xce
xor r8d, r8d
xor ecx, ecx
call fcn.1800213c0
sub rbx, 1
jne 0x1800356c0
jmp 0x1800358a0
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x1800358ac
mov ecx, 0xa6
mov eax, ecx
sub eax, 0xa6
je 0x18003588b
sub eax, 1
je 0x180035884
sub eax, 1
je 0x180035730
cmp eax, 1
jne 0x18003588e
mov edi, 0x172
mov dword [rsp + 0x30], edi
jmp 0x180035892
mov r12d, 0xaa
movsxd rdi, r15d
nop dword [rax]
mov eax, r12d
sub eax, 0xa9
je 0x18003576e
cmp eax, 1
jne 0x180035863
cmp byte [r14 + rsi], 0
je 0x180035878
movsxd rax, ebp
xor ebp, ebp
add rsi, rax
xor r14d, r14d
jmp 0x180035863
movsx ecx, byte [rsi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x180035791
nop dword [rax + rax]
movsx ecx, byte [rsi + 1]
inc rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
jne 0x180035780
movzx eax, byte [r14 + rsi]
test al, al
je 0x1800357bc
nop word [rax + rax]
movsx ecx, al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
jne 0x1800357bc
movzx eax, byte [r14 + rsi + 1]
inc r14
inc ebp
test al, al
jne 0x1800357a0
test ebp, ebp
jle 0x180035863
mov ebx, 0x107
nop dword [rax]
mov eax, ebx
sub eax, 0x107
je 0x18003583e
cmp eax, 0x4b
jne 0x180035854
xor edx, edx
lea r9, [0x1800a7e30]
test rdi, rdi
jle 0x180035805
mov r8, rsi
sub r8, r9
lea rcx, [rdx + r9]
inc rdx
movzx eax, byte [r8 + rcx]
mov byte [rcx], al
cmp rdx, rdi
jl 0x1800357f2
cmp rdi, 0x40a
jae 0x1800358df
mov byte [rdi + r9], 0
xor edx, edx
mov rax, qword [r13]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov r8d, 0x82
mov qword [rsp + 0x20], 0
call fcn.180021a30
mov qword [r13], rax
jmp 0x180035854
mov r15d, ebp
mov rdi, r14
cmp ebp, 0x400
jle 0x180035854
mov edi, 0x400
mov r15d, edi
add ebx, 0x4b
cmp ebx, 0x19d
jb 0x1800357d0
dec r12d
cmp r12d, 0xa8
ja 0x180035740
jmp 0x180035730
mov rdx, qword [rsp + 0x60]
mov ecx, 0xa8
jmp 0x18003588e
xor ebp, ebp
xor r14d, r14d
jmp 0x18003588e
mov rsi, rdx
mov edi, dword [rsp + 0x30]
inc ecx
cmp ecx, 0xaa
jb 0x1800356f3
mov r8, qword [rsp + 0x40]
lea rcx, [0x1800859d0]
add edi, 0x7a
mov dword [rsp + 0x30], edi
cmp edi, dword [rsp + 0x38]
jb 0x180035590
mov eax, dword [rsp + 0x38]
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [r13 + 0x60]
jmp 0x1800358c1
call fcn.180086188
int3