Function at 0x14035be00
Capabilities:
Query environment variable

Disassembly:
push r13
push r14
push r15
sub rsp, 0xa0
mov r14, rcx
mov eax, dword [0x141940844]
xor r15b, r15b
mov dword [rsp + 0xc8], edx
test eax, eax
je 0x14035bfad
mov eax, dword [0x141940844]
test eax, eax
je 0x14035bfad
lea rcx, [0x141a57ce0]
call fcn.140340e60
mov eax, dword [0x141a57ce4]
test eax, eax
jne 0x14035be7b
lea rcx, str.FOR_DISABLE_KMP_MALLOC
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
test rax, rax
ja 0x14035be67
je 0x14035be71
mov dword [0x141940844], 0
mov dword [0x141a57ce4], 1
lea rax, [fcn.14035cd60]
lea r8, [fcn.14035cd80]
mov qword [rsp + 0x68], rax
lea r9, [0x14035cd70]
mov qword [rsp + 0x70], r8
lea r10, [fcn.14035cd60]
mov qword [rsp + 0x78], r9
lea r11, [fcn.14035cd80]
mov qword [rsp + 0x80], r10
lea r13, [0x14035cd70]
mov qword [rsp + 0x88], r11
mov qword [rsp + 0x90], r13
mov rax, qword [rsp + 0x68]
mov r8, qword [rsp + 0x80]
cmp rax, r8
je 0x14035bf0c
mov rax, qword [rsp + 0x70]
mov r8, qword [rsp + 0x88]
cmp rax, r8
je 0x14035bf0c
mov rax, qword [rsp + 0x78]
mov r8, qword [rsp + 0x90]
cmp rax, r8
je 0x14035bf0c
mov dword [0x141a57ce8], 1
lea rax, [fcn.14035cd90]
lea r8, [fcn.14035cda0]
mov qword [rsp + 0x38], rax
lea r9, [fcn.14035cdb0]
mov qword [rsp + 0x40], r8
lea r10, [fcn.14035cd90]
mov qword [rsp + 0x48], r9
lea r11, [fcn.14035cda0]
mov qword [rsp + 0x50], r10
lea r13, [fcn.14035cdb0]
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x60], r13
mov rax, qword [rsp + 0x38]
mov r8, qword [rsp + 0x50]
cmp rax, r8
je 0x14035bf8b
mov rax, qword [rsp + 0x40]
mov r8, qword [rsp + 0x58]
cmp rax, r8
je 0x14035bf8b
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x60]
cmp rax, r8
je 0x14035bf8b
mov dword [0x141a57cec], 1
mov eax, dword [0x141a57cec]
test eax, eax
je 0x14035bf9f
mov dword [0x141a57cf0], 1
xor eax, eax
mov dword [0x141940844], eax
mov dword [0x141a57ce0], eax
movzx r8d, byte [rsp + 0xc8]
mov eax, r8d
mov r13d, r8d
and eax, 4
shr eax, 2
and r13d, 0x20
test byte [rsp + 0xcb], 2
je 0x14035bfd9
mov r15b, 1
test eax, eax
jne 0x14035bfe1
jmp 0x14035c00e
test eax, eax
je 0x14035c068
test r8d, 1
je 0x14035bffd
mov eax, 0xad
add rsp, 0xa0
pop r15
pop r14
pop r13
ret
mov ecx, 0xad
xor edx, edx
call fcn.140383960
test r15b, r15b
je 0x14035c05f
mov eax, dword [0x141a57cf0]
test eax, eax
je 0x14035c05f
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
movq qword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x20]
call 0x141a6daf0
movzx r8d, word [rsp + 0xca]
and r8d, 0x1e0
shr r8d, 5
cmp r8d, 0xf
je 0x14035c11f
mov ecx, eax
mov rdx, r14
call fcn.14035cdb0
jmp 0x14035c10f
movzx r8d, byte [rsp + 0xc8]
test r8d, 0x40
jne 0x14035c12e
test byte [rsp + 0xc9], 1
je 0x14035c093
mov eax, dword [0x141a57ce8]
test eax, eax
je 0x14035c093
mov rcx, r14
call fcn.14035cd80
jmp 0x14035c10f
lea rcx, [0x141a57cf8]
call fcn.140340e60
mov r15, r14
lea rax, [0x140000000]
shr r15, 0x1c
and r15, 0xfff
cmp r14, qword [rax + r15*8 + 0x1a4fae0]
je 0x14035c0e1
mov dword [0x141a57cf8], 0
test r13d, r13d
jne 0x14035c0d7
mov eax, dword [0x141a57ce8]
test eax, eax
jne 0x14035c089
mov rcx, r14
call fcn.140453940
jmp 0x14035c10f
mov rcx, r14
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rax, [0x140000000]
mov dword [0x141a57cf8], 0
mov qword [rax + r15*8 + 0x1a4fae0], 0
xor eax, eax
add rsp, 0xa0
pop r15
pop r14
pop r13
ret
mov ecx, eax
mov rdx, r14
xor r8d, r8d
call fcn.14035cdb0
jmp 0x14035c10f
mov rcx, r14
call fcn.1403d3d70
jmp 0x14035c10f