Function at 0x14035b170
Capabilities:
Get system information on windows
Query environment variable

Disassembly:
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0xd0
mov r14, rdx
mov dword [rsp + 0x110], r8d
mov r15, rcx
cmp qword [r14], 0
je 0x14035b1bf
test r8d, 1
je 0x14035b1b3
mov eax, 0x97
add rsp, 0xd0
pop rbp
pop r15
pop r14
pop r13
pop r12
ret
mov ecx, 0x97
xor edx, edx
call fcn.140383960
mov eax, dword [0x141940844]
test eax, eax
je 0x14035b376
mov eax, dword [0x141940844]
test eax, eax
je 0x14035b376
lea rcx, [0x141a57ce0]
call fcn.140340e60
mov eax, dword [0x141a57ce4]
test eax, eax
jne 0x14035b220
lea rcx, str.FOR_DISABLE_KMP_MALLOC
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
test rax, rax
ja 0x14035b20c
je 0x14035b216
mov dword [0x141940844], 0
mov dword [0x141a57ce4], 1
lea rax, [fcn.14035cd60]
lea rbp, [fcn.14035cd80]
mov qword [rsp + 0x68], rax
lea r9, [0x14035cd70]
mov qword [rsp + 0x70], rbp
lea r10, [fcn.14035cd60]
mov qword [rsp + 0x78], r9
lea r11, [fcn.14035cd80]
mov qword [rsp + 0x80], r10
lea r12, [0x14035cd70]
mov qword [rsp + 0x88], r11
mov qword [rsp + 0x90], r12
mov r13, qword [rsp + 0x68]
mov rax, qword [rsp + 0x80]
cmp r13, rax
je 0x14035b2b1
mov rax, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x88]
cmp rax, rbp
je 0x14035b2b1
mov rax, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x90]
cmp rax, rbp
je 0x14035b2b1
mov dword [0x141a57ce8], 1
lea rax, [fcn.14035cd90]
lea rbp, [fcn.14035cda0]
mov qword [rsp + 0x98], rax
lea r9, [fcn.14035cdb0]
mov qword [rsp + 0xa0], rbp
lea r10, [fcn.14035cd90]
mov qword [rsp + 0xa8], r9
lea r11, [fcn.14035cda0]
mov qword [rsp + 0xb0], r10
lea r12, [fcn.14035cdb0]
mov qword [rsp + 0xb8], r11
mov qword [rsp + 0xc0], r12
mov r13, qword [rsp + 0x98]
mov rax, qword [rsp + 0xb0]
cmp r13, rax
je 0x14035b354
mov rax, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xb8]
cmp rax, rbp
je 0x14035b354
mov rax, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0xc0]
cmp rax, rbp
je 0x14035b354
mov dword [0x141a57cec], 1
mov eax, dword [0x141a57cec]
test eax, eax
je 0x14035b368
mov dword [0x141a57cf0], 1
xor eax, eax
mov dword [0x141940844], eax
mov dword [0x141a57ce0], eax
mov r9b, byte [rsp + 0x110]
mov r13b, r9b
mov r12b, byte [rsp + 0x113]
and r13b, 0x20
and r12b, 2
shr r12b, 1
test r9b, 0x10
je 0x14035b3ca
test r9b, 1
je 0x14035b3b6
mov eax, 0xb3
add rsp, 0xd0
pop rbp
pop r15
pop r14
pop r13
pop r12
ret
mov ecx, 0xb3
xor edx, edx
call fcn.140383960
mov r9b, byte [rsp + 0x110]
mov ebp, 1
mov eax, 1
test r15, r15
movzx ecx, byte [rsp + 0x112]
cmove r15, rax
shl ebp, cl
movsxd rbp, ebp
cmp rbp, 0x20
jae 0x14035b412
test r9b, 0x80
jne 0x14035b40b
test r12b, r12b
jne 0x14035b412
movzx eax, word [rsp + 0x112]
and eax, 0x1e0
cmp eax, 0x20
jne 0x14035b412
mov ebp, 0x20
jmp 0x14035b41f
mov eax, 0x10
cmp rbp, 0x10
cmovb rbp, rax
test r9b, 8
je 0x14035b5be
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebp, dword [rsp + 0x24]
cmp rbp, 0x800000
jle 0x14035b44b
mov ebp, 0x18
jmp 0x14035b5be
cmp rbp, 0x400000
jle 0x14035b45e
mov ebp, 0x17
jmp 0x14035b5be
cmp rbp, 0x200000
jle 0x14035b471
mov ebp, 0x16
jmp 0x14035b5be
cmp rbp, 0x100000
jle 0x14035b484
mov ebp, 0x15
jmp 0x14035b5be
cmp rbp, 0x80000
jle 0x14035b497
mov ebp, 0x14
jmp 0x14035b5be
cmp rbp, 0x40000
jle 0x14035b4aa
mov ebp, 0x13
jmp 0x14035b5be
cmp rbp, 0x20000
jle 0x14035b4bd
mov ebp, 0x11
jmp 0x14035b5be
cmp rbp, 0x10000
jle 0x14035b4d0
mov ebp, 0x10
jmp 0x14035b5be
cmp rbp, 0x8000
jle 0x14035b4e3
mov ebp, 0xf
jmp 0x14035b5be
cmp rbp, 0x4000
jle 0x14035b4f6
mov ebp, 0xe
jmp 0x14035b5be
cmp rbp, 0x2000
jle 0x14035b509
mov ebp, 0xd
jmp 0x14035b5be
cmp rbp, 0x1000
jle 0x14035b51c
mov ebp, 0xc
jmp 0x14035b5be
cmp rbp, 0x800
jle 0x14035b52f
mov ebp, 0xb
jmp 0x14035b5be
cmp rbp, 0x400
jle 0x14035b542
mov ebp, 0xa
jmp 0x14035b5be
cmp rbp, 0x200
jle 0x14035b552
mov ebp, 9
jmp 0x14035b5be
cmp rbp, 0x100
jle 0x14035b562
mov ebp, 8
jmp 0x14035b5be
cmp rbp, 0x80
jle 0x14035b572
mov ebp, 7
jmp 0x14035b5be
cmp rbp, 0x40
jle 0x14035b57f
mov ebp, 6
jmp 0x14035b5be
cmp rbp, 0x20
jle 0x14035b58c
mov ebp, 5
jmp 0x14035b5be
cmp rbp, 0x10
jle 0x14035b599
mov ebp, 4
jmp 0x14035b5be
cmp rbp, 8
jle 0x14035b5a6
mov ebp, 3
jmp 0x14035b5be
cmp rbp, 4
jle 0x14035b5b3
mov ebp, 2
jmp 0x14035b5be
neg rbp
add rbp, 2
shr rbp, 0x3f
test r12b, r12b
je 0x14035b654
mov eax, dword [0x141a57cf0]
test eax, eax
je 0x14035b654
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
movq qword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x50]
call 0x141a6daf0
movzx r8d, word [rsp + 0x112]
mov ecx, eax
and r8d, 0x1e0
shr r8d, 5
cmp r8d, 0xf
je 0x14035b759
mov eax, dword [0x141a57cf4]
test eax, eax
jne 0x14035b644
mov eax, dword [0x141a57cec]
test eax, eax
jne 0x14035b63a
test r12b, r12b
je 0x14035b6ac
mov ecx, 0x312
xor edx, edx
call fcn.140383960
jmp 0x14035b6ac
mov rdx, r15
call fcn.14035cda0
jmp 0x14035b6b7
mov r9d, r8d
mov rdx, rbp
mov r8, r15
call fcn.14035cd90
jmp 0x14035b6b7
test byte [rsp + 0x110], 0x40
jne 0x14035b79c
test byte [rsp + 0x111], 1
je 0x14035b683
mov eax, dword [0x141a57ce8]
test eax, eax
je 0x14035b683
mov rcx, r15
mov rdx, rbp
call fcn.14035cd60
jmp 0x14035b6b7
cmp r15, 0x10000000
jae 0x14035b6f1
test r13b, r13b
jne 0x14035b69b
mov eax, dword [0x141a57ce8]
test eax, eax
jne 0x14035b676
test r12b, r12b
je 0x14035b6ac
mov ecx, 0x312
xor edx, edx
call fcn.140383960
mov rcx, r15
mov rdx, rbp
call fcn.14045395c
mov qword [r14], rax
test rax, rax
jne 0x14035b746
test byte [rsp + 0x110], 1
je 0x14035b6e3
mov eax, 0x29
add rsp, 0xd0
pop rbp
pop r15
pop r14
pop r13
pop r12
ret
mov ecx, 0x29
xor edx, edx
call fcn.140383960
jmp 0x14035b746
lea rcx, [0x141a57cf8]
call fcn.140340e60
xor ecx, ecx
mov rdx, r15
mov r8d, 0x1000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rax
test rcx, rcx
je 0x14035b786
mov rdx, rcx
lea rax, [0x140000000]
shr rdx, 0x1c
mov dword [0x141a57cf8], 0
and rdx, 0xfff
mov qword [r14], rcx
mov qword [rax + rdx*8 + 0x1a4fae0], rcx
xor eax, eax
add rsp, 0xd0
pop rbp
pop r15
pop r14
pop r13
pop r12
ret
mov eax, dword [0x141a57cf4]
test eax, eax
je 0x14035b776
mov rdx, rbp
mov r8, r15
xor r9d, r9d
call fcn.14035cd90
jmp 0x14035b6b7
mov rdx, r15
xor r8d, r8d
call fcn.14035cda0
jmp 0x14035b6b7
mov dword [0x141a57cf8], 0
mov qword [r14], 0
jmp 0x14035b6c3
mov rcx, r15
call fcn.1403d39b0
jmp 0x14035b6b7