Function at 0x140035280
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xd0
lea rdi, [rsp + 0x40]
mov ecx, 0x24
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xe0]
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x74], 0xffffffff
cmp qword [rsp + 0xf0], 0
je 0x14003543e
cmp qword [rsp + 0x58], 0
jne 0x14003543e
cmp dword [rsp + 0x74], 0xffffffff
jne 0x14003543e
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
mov rax, qword [rsp + 0xf0]
mov r8, qword [rax]
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xe0]
call fcn.140034fc0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x140035332
mov eax, dword [rsp + 0x40]
jmp 0x1400356ee
cmp qword [rsp + 0x58], 0
je 0x140035396
mov rax, qword [rsp + 0x58]
movsx eax, byte [rax]
test eax, eax
je 0x140035396
mov rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x70], rcx
mov rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x80], rcx
mov rax, qword [rsp + 0xe8]
mov byte [rax + 0x3a9], 1
mov r8, qword [rsp + 0x58]
lea rdx, str.Connecting_to_hostname:__s
mov rcx, qword [rsp + 0xe0]
call fcn.14003d050
nop
jmp 0x1400353ca
mov rax, qword [rsp + 0xe8]
mov byte [rax + 0x3a9], 0
lea r8, [0x14010b340]
mov edx, 0xba6
mov rcx, qword [rsp + 0x58]
call fcn.140049210
mov qword [rsp + 0x58], 0
xor eax, eax
test eax, eax
jne 0x1400353a5
cmp dword [rsp + 0x74], 0
jl 0x14003540e
mov rax, qword [rsp + 0xe8]
mov ecx, dword [rsp + 0x74]
mov dword [rax + 0x7d0], ecx
mov rax, qword [rsp + 0xe8]
mov byte [rax + 0x3aa], 1
mov r8d, dword [rsp + 0x74]
lea rdx, str.Connecting_to_port:__d
mov rcx, qword [rsp + 0xe0]
call fcn.14003d050
nop
jmp 0x140035425
mov rax, qword [rsp + 0xe8]
mov byte [rax + 0x3aa], 0
mov dword [rsp + 0x74], 0xffffffff
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax + 8]
mov qword [rsp + 0xf0], rax
jmp 0x1400352c9
mov rax, qword [rsp + 0xe0]
cmp qword [rax + 0xa88], 0
je 0x1400356ea
cmp qword [rsp + 0x58], 0
jne 0x1400356ea
cmp dword [rsp + 0x74], 0xffffffff
jne 0x1400356ea
mov rax, qword [rsp + 0xe8]
mov rax, qword [rax + 0x3c8]
cmp dword [rax + 0x8c], 2
je 0x140035498
lea rcx, [0x14010b3a0]
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x1400356ea
mov rax, qword [rsp + 0xe0]
mov rax, qword [rax + 0xa88]
mov eax, dword [rax + 0x28]
and eax, 8
mov dword [rsp + 0xa4], eax
mov rax, qword [rsp + 0xe8]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x84], 8
mov eax, dword [rsp + 0xa4]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xe8]
mov r9d, dword [rax + 0x7cc]
mov r8, qword [rsp + 0x58]
mov edx, dword [rsp + 0x84]
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rax + 0xa88]
call fcn.140046680
mov byte [rsp + 0x88], al
movzx eax, byte [rsp + 0x88]
test eax, eax
je 0x1400356ea
lea r8, [0x14010b3c0]
mov edx, 0xbe0
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax + 0x10]
call fcn.140049280
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
jne 0x140035568
mov eax, 0x1b
jmp 0x1400356ee
mov rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xa8]
mov qword [rax + 0x70], rcx
mov rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xa8]
mov qword [rax + 0x80], rcx
mov rax, qword [rsp + 0xe8]
mov byte [rax + 0x3a9], 1
mov rax, qword [rsp + 0x98]
movzx eax, word [rax + 0x18]
mov rcx, qword [rsp + 0xe8]
mov dword [rcx + 0x7d0], eax
mov rax, qword [rsp + 0xe8]
mov byte [rax + 0x3aa], 1
mov rax, qword [rsp + 0xe8]
mov byte [rax + 0x3a8], 1
mov rax, qword [rsp + 0x98]
movzx eax, word [rax + 0x18]
mov dword [rsp + 0xb0], eax
mov rcx, qword [rsp + 0x98]
mov ecx, dword [rcx + 0x1c]
call fcn.140045860
mov qword [rsp + 0xb8], rax
mov ecx, dword [rsp + 0x84]
call fcn.140045860
mov ecx, dword [rsp + 0xb0]
mov dword [rsp + 0x38], ecx
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0xe8]
mov ecx, dword [rcx + 0x7cc]
mov dword [rsp + 0x20], ecx
mov r9, qword [rsp + 0x58]
mov r8, rax
lea rdx, str.Alt_svc_connecting_from___s__s:_d_to___s__s:_d
mov rcx, qword [rsp + 0xe0]
call fcn.14003d050
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x1c]
cmp dword [rsp + 0x84], eax
je 0x1400356ea
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x1c]
mov dword [rsp + 0xc0], eax
cmp dword [rsp + 0xc0], 8
je 0x1400356aa
cmp dword [rsp + 0xc0], 0x10
je 0x1400356bb
cmp dword [rsp + 0xc0], 0x20
je 0x1400356cc
jmp 0x1400356ea
mov rax, qword [rsp + 0xe8]
mov byte [rax + 0x7e0], 0xb
jmp 0x1400356ea
mov rax, qword [rsp + 0xe8]
mov byte [rax + 0x7e0], 0x14
jmp 0x1400356ea
mov rax, qword [rsp + 0xe8]
mov byte [rax + 0x7de], 5
mov rax, qword [rsp + 0xe8]
mov byte [rax + 0x7e0], 0x1e
mov eax, dword [rsp + 0x40]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.1400d050c
mov rax, rdi
add rsp, 0xd0
pop rdi
ret