Function at 0x1400361bc
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov dword [rsp + 0x20], r9d
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x870
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + CWnd::CreateDlgIndirect], rax
mov r12d, r9d
mov qword [rsp + 0x40], r8
mov r13, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov rax, qword [rcx + 0x88]
xor ebx, ebx
test rax, rax
jne 0x140036245
lea r9, [0x14000bed8]
xor r8d, r8d
lea edx, [rax + 0xa]
call fcn.14003e2b8
mov rax, qword [rdi]
test rax, rax
je 0x14003623e
bts dword [rdi + 0x64], 0x14
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xc]
mov rcx, qword [rdi + 8]
call rax
xor eax, eax
jmp 0x140036550
mov dword [rcx + 0xb4], r9d
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r14, rbx
mov qword [rsp + 0x38], rbx
test r12b, 2
je 0x1400362b5
mov rax, qword [rax + 0x38]
mov rdx, qword [rax + 0xa8]
test rdx, rdx
je 0x140036276
cmp byte [rdx], bl
jne 0x14003627d
lea rdx, [0x1400013d8]
lea r8, [rsp + 0x38]
call fcn.140036d0c
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400362ab
mov rdx, rax
lea rcx, [0x140002f6c]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov r14, qword [rsp + 0x38]
jmp 0x1400362b0
mov qword [rsp + 0x38], rbx
test rsi, rsi
jne 0x14003630b
xor r8d, r8d
xor edx, edx
lea rcx, [0x140002f6c]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov r15d, eax
test eax, eax
je 0x14003630b
mov ecx, r15d
call qword [sym.imp.msvcrt.dll_malloc]
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14003630b
mov r8d, r15d
mov rdx, rax
lea rcx, [0x140002f6c]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, r15d
jbe 0x14003630b
lea rcx, [rsp + 0x30]
call fcn.140027d90
mov rsi, qword [rsp + 0x30]
mov r9, rsi
mov r15, qword [rsp + 0x40]
mov r8, r15
mov rdx, r13
mov rcx, rdi
call fcn.140036824
test byte [rdi + 0xb4], 0x10
je 0x1400363b2
mov rdx, qword [0x140049600]
test rdx, rdx
je 0x14003634c
mov r8d, 0x800
lea rcx, [rsp + 0x60]
call fcn.140027e84
jmp 0x140036350
mov byte [rsp + 0x60], bl
lea r8, [rsp + 0x60]
lea rdx, [0x1400014e0]
mov ecx, 0x8e
call fcn.14002905c
test al, al
je 0x1400363b2
mov rax, qword [0x140049600]
test rax, rax
je 0x140036395
lea r8, [rsp + 0x60]
sub r8, rax
movzx ecx, byte [rax]
movzx edx, byte [rax + r8]
sub ecx, edx
jne 0x140036391
inc rax
test edx, edx
jne 0x14003637e
test ecx, ecx
je 0x1400363b2
lea rcx, [0x140049600]
call fcn.140027d90
lea rcx, [rsp + 0x60]
call fcn.140027cfc
mov qword [0x140049600], rax
mov byte [rdi + 0xb1], bl
mov dword [rdi + 0x70], ebx
mov qword [rdi + 0x78], rbx
mov dword [rdi + 0x80], ebx
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
call fcn.140039f8c
mov r10, qword [rdi]
test r10, r10
je 0x1400363ed
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, qword [rdi + 8]
call r10
mov ecx, pe_nt_image_headers64
call qword [sym.imp.MFC42.dll_CReBarCtrl::SetColorScheme]
mov rsi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14003648a
mov qword [rax], rbx
mov byte [rax + 8], bl
mov dword [rax + 0xc], ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbx
mov qword [rax + 0x28], rbx
mov qword [rax + 0x30], rbx
mov qword [rax + 0x38], rbx
mov dword [rax + 0xf0], ebx
lea rcx, [rax + 0x40]
xor edx, edx
mov r8d, 0xb0
call sub.msvcrt.dll_memset
cmp byte [0x1400495e8], bl
jne 0x14003645d
lea rcx, [0x140049170]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [0x1400495e8], 1
lea rcx, [0x140049170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x1400495f8]
mov qword [rsi], rax
mov qword [0x1400495f8], rsi
lea rcx, [0x140049170]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14003648d
mov rsi, rbx
mov qword [rsp + 0x40], rsi
test rsi, rsi
jne 0x1400364ac
xor r9d, r9d
xor r8d, r8d
lea edx, [rsi + 1]
mov ecx, 0xc0000017
call qword [sym.imp.KERNEL32.dll_RaiseException]
xor r8d, r8d
mov dl, 1
mov rcx, qword [rdi + 0x88]
call fcn.1400353f0
mov r8, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov r9, r13
mov rdx, rdi
mov rcx, rsi
call fcn.1400135ec
mov qword [rdi + 0xb8], rax
jmp 0x1400364fa
test r12b, 2
je 0x140036515
test r14, r14
je 0x140036515
mov rdx, r14
lea rcx, [0x140002f6c]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea rcx, [rsp + 0x30]
call fcn.140027d90
cmp qword [rdi + 0xb8], rbx
jne 0x14003654b
cmp dword [rsi + 0x30], ebx
jne 0x140036532
bts dword [rdi + 0x64], 0x14
mov rcx, rsi
call fcn.1400134c8
mov rax, qword [rdi]
test rax, rax
je 0x14003623e
jmp 0x14003622e
mov eax, 1
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.14003f730
add rsp, 0x870
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret