Function at 0x14035a550
Capabilities:
Get system information on windows
Query environment variable

Disassembly:
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0xd0
mov r14, rdx
mov eax, dword [0x141940844]
mov r15, rcx
mov dword [rsp + 0x110], r8d
test eax, eax
je 0x14035a725
mov eax, dword [0x141940844]
test eax, eax
je 0x14035a725
lea rcx, [0x141a57ce0]
call fcn.140340e60
mov eax, dword [0x141a57ce4]
test eax, eax
jne 0x14035a5cf
lea rcx, str.FOR_DISABLE_KMP_MALLOC
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
test rax, rax
ja 0x14035a5bb
je 0x14035a5c5
mov dword [0x141940844], 0
mov dword [0x141a57ce4], 1
lea rax, [fcn.14035cd60]
lea rbp, [fcn.14035cd80]
mov qword [rsp + 0x98], rax
lea r9, [0x14035cd70]
mov qword [rsp + 0xa0], rbp
lea r10, [fcn.14035cd60]
mov qword [rsp + 0xa8], r9
lea r11, [fcn.14035cd80]
mov qword [rsp + 0xb0], r10
lea r12, [0x14035cd70]
mov qword [rsp + 0xb8], r11
mov qword [rsp + 0xc0], r12
mov r13, qword [rsp + 0x98]
mov rax, qword [rsp + 0xb0]
cmp r13, rax
je 0x14035a672
mov rax, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xb8]
cmp rax, rbp
je 0x14035a672
mov rax, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0xc0]
cmp rax, rbp
je 0x14035a672
mov dword [0x141a57ce8], 1
lea rax, [fcn.14035cd90]
lea rbp, [fcn.14035cda0]
mov qword [rsp + 0x68], rax
lea r9, [fcn.14035cdb0]
mov qword [rsp + 0x70], rbp
lea r10, [fcn.14035cd90]
mov qword [rsp + 0x78], r9
lea r11, [fcn.14035cda0]
mov qword [rsp + 0x80], r10
lea r12, [fcn.14035cdb0]
mov qword [rsp + 0x88], r11
mov qword [rsp + 0x90], r12
mov r13, qword [rsp + 0x68]
mov rax, qword [rsp + 0x80]
cmp r13, rax
je 0x14035a703
mov rax, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x88]
cmp rax, rbp
je 0x14035a703
mov rax, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x90]
cmp rax, rbp
je 0x14035a703
mov dword [0x141a57cec], 1
mov eax, dword [0x141a57cec]
test eax, eax
je 0x14035a717
mov dword [0x141a57cf0], 1
xor eax, eax
mov dword [0x141940844], eax
mov dword [0x141a57ce0], eax
mov r9b, byte [rsp + 0x110]
mov r13b, r9b
mov r12b, byte [rsp + 0x113]
and r13b, 0x20
and r12b, 2
shr r12b, 1
test r9b, 0x10
je 0x14035a779
test r9b, 1
je 0x14035a765
mov eax, 0xb3
add rsp, 0xd0
pop rbp
pop r15
pop r14
pop r13
pop r12
ret
mov ecx, 0xb3
xor edx, edx
call fcn.140383960
mov r9b, byte [rsp + 0x110]
mov ebp, 1
mov eax, 1
test r15, r15
movzx ecx, byte [rsp + 0x112]
cmove r15, rax
shl ebp, cl
movsxd rbp, ebp
cmp rbp, 0x20
jae 0x14035a7c1
test r9b, 0x80
jne 0x14035a7ba
test r12b, r12b
jne 0x14035a7c1
movzx eax, word [rsp + 0x112]
and eax, 0x1e0
cmp eax, 0x20
jne 0x14035a7c1
mov ebp, 0x20
jmp 0x14035a7ce
mov eax, 0x10
cmp rbp, 0x10
cmovb rbp, rax
test r9b, 8
je 0x14035a96d
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebp, dword [rsp + 0x24]
cmp rbp, 0x800000
jle 0x14035a7fa
mov ebp, 0x18
jmp 0x14035a96d
cmp rbp, 0x400000
jle 0x14035a80d
mov ebp, 0x17
jmp 0x14035a96d
cmp rbp, 0x200000
jle 0x14035a820
mov ebp, 0x16
jmp 0x14035a96d
cmp rbp, 0x100000
jle 0x14035a833
mov ebp, 0x15
jmp 0x14035a96d
cmp rbp, 0x80000
jle 0x14035a846
mov ebp, 0x14
jmp 0x14035a96d
cmp rbp, 0x40000
jle 0x14035a859
mov ebp, 0x13
jmp 0x14035a96d
cmp rbp, 0x20000
jle 0x14035a86c
mov ebp, 0x11
jmp 0x14035a96d
cmp rbp, 0x10000
jle 0x14035a87f
mov ebp, 0x10
jmp 0x14035a96d
cmp rbp, 0x8000
jle 0x14035a892
mov ebp, 0xf
jmp 0x14035a96d
cmp rbp, 0x4000
jle 0x14035a8a5
mov ebp, 0xe
jmp 0x14035a96d
cmp rbp, 0x2000
jle 0x14035a8b8
mov ebp, 0xd
jmp 0x14035a96d
cmp rbp, 0x1000
jle 0x14035a8cb
mov ebp, 0xc
jmp 0x14035a96d
cmp rbp, 0x800
jle 0x14035a8de
mov ebp, 0xb
jmp 0x14035a96d
cmp rbp, 0x400
jle 0x14035a8f1
mov ebp, 0xa
jmp 0x14035a96d
cmp rbp, 0x200
jle 0x14035a901
mov ebp, 9
jmp 0x14035a96d
cmp rbp, 0x100
jle 0x14035a911
mov ebp, 8
jmp 0x14035a96d
cmp rbp, 0x80
jle 0x14035a921
mov ebp, 7
jmp 0x14035a96d
cmp rbp, 0x40
jle 0x14035a92e
mov ebp, 6
jmp 0x14035a96d
cmp rbp, 0x20
jle 0x14035a93b
mov ebp, 5
jmp 0x14035a96d
cmp rbp, 0x10
jle 0x14035a948
mov ebp, 4
jmp 0x14035a96d
cmp rbp, 8
jle 0x14035a955
mov ebp, 3
jmp 0x14035a96d
cmp rbp, 4
jle 0x14035a962
mov ebp, 2
jmp 0x14035a96d
neg rbp
add rbp, 2
shr rbp, 0x3f
test r12b, r12b
je 0x14035aa03
mov eax, dword [0x141a57cf0]
test eax, eax
je 0x14035aa03
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
movq qword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x50]
call 0x141a6daf0
movzx r8d, word [rsp + 0x112]
mov ecx, eax
and r8d, 0x1e0
shr r8d, 5
cmp r8d, 0xf
je 0x14035ab08
mov eax, dword [0x141a57cf4]
test eax, eax
jne 0x14035a9f3
mov eax, dword [0x141a57cec]
test eax, eax
jne 0x14035a9e9
test r12b, r12b
je 0x14035aa5b
mov ecx, 0x312
xor edx, edx
call fcn.140383960
jmp 0x14035aa5b
mov rdx, r15
call fcn.14035cda0
jmp 0x14035aa66
mov r9d, r8d
mov rdx, rbp
mov r8, r15
call fcn.14035cd90
jmp 0x14035aa66
test byte [rsp + 0x110], 0x40
jne 0x14035ab4b
test byte [rsp + 0x111], 1
je 0x14035aa32
mov eax, dword [0x141a57ce8]
test eax, eax
je 0x14035aa32
mov rcx, r15
mov rdx, rbp
call fcn.14035cd60
jmp 0x14035aa66
cmp r15, 0x10000000
jae 0x14035aaa0
test r13b, r13b
jne 0x14035aa4a
mov eax, dword [0x141a57ce8]
test eax, eax
jne 0x14035aa25
test r12b, r12b
je 0x14035aa5b
mov ecx, 0x312
xor edx, edx
call fcn.140383960
mov rcx, r15
mov rdx, rbp
call fcn.14045395c
mov qword [r14], rax
test rax, rax
jne 0x14035aaf5
test byte [rsp + 0x110], 1
je 0x14035aa92
mov eax, 0x29
add rsp, 0xd0
pop rbp
pop r15
pop r14
pop r13
pop r12
ret
mov ecx, 0x29
xor edx, edx
call fcn.140383960
jmp 0x14035aaf5
lea rcx, [0x141a57cf8]
call fcn.140340e60
xor ecx, ecx
mov rdx, r15
mov r8d, 0x1000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rax
test rcx, rcx
je 0x14035ab35
mov rdx, rcx
lea rax, [0x140000000]
shr rdx, 0x1c
mov dword [0x141a57cf8], 0
and rdx, 0xfff
mov qword [r14], rcx
mov qword [rax + rdx*8 + 0x1a4fae0], rcx
xor eax, eax
add rsp, 0xd0
pop rbp
pop r15
pop r14
pop r13
pop r12
ret
mov eax, dword [0x141a57cf4]
test eax, eax
je 0x14035ab25
mov rdx, rbp
mov r8, r15
xor r9d, r9d
call fcn.14035cd90
jmp 0x14035aa66
mov rdx, r15
xor r8d, r8d
call fcn.14035cda0
jmp 0x14035aa66
mov dword [0x141a57cf8], 0
mov qword [r14], 0
jmp 0x14035aa72
mov rcx, r15
call fcn.1403d39b0
jmp 0x14035aa66