Function at 0x140385920
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push r13
push r14
push r15
push rbp
sub rsp, 0x58
mov r13d, edx
mov rbp, rcx
mov ecx, 0x1001
xor edx, edx
lea r8, [rsp + 0x48]
call fcn.14035a450
test eax, eax
je 0x140385952
add rsp, 0x58
pop rbp
pop r15
pop r14
pop r13
ret
mov r14, qword [rsp + 0x48]
lea rcx, str.FOR_DIAGNOSTIC_LOG_FILE
mov rdx, r14
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
test rax, rax
jbe 0x14038597c
cmp rax, 0x105
jb 0x140385985
test r14, r14
je 0x140385985
mov byte [r14], 0
mov r15, qword [rsp + 0x48]
cmp byte [r15], 0
je 0x1403859d3
cmp r13d, 0xaa
je 0x140385c37
mov rcx, r15
lea rdx, [0x14059ced0]
call fcn.14046fd6c
mov r14, rax
test r14, r14
je 0x1403859ce
mov rcx, r14
lea rdx, [0x140599c00]
mov r8, rbp
call fcn.1403856f0
mov rcx, r14
call fcn.14046fe54
mov r15, qword [rsp + 0x48]
mov rcx, r15
call fcn.14035a530
test eax, eax
jne 0x140385946
lea rcx, str.FOR_DISABLE_DIAGNOSTIC_DISPLAY
call fcn.1403b89a0
test eax, eax
jne 0x140385a6f
cmp dword [0x141a6ae3c], 0
je 0x140385a13
mov rcx, rbp
lea rdx, [0x141940900]
mov r8d, 0x2010
call fcn.14043d3d0
jmp 0x140385a6f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r10, rax
test r10, r10
je 0x140385a38
movsxd r9, dword [r10 + 0x3c]
movzx eax, word [r9 + r10 + 0x18]
cmp eax, 0x20b
je 0x140385ad7
cmp r13d, 0xaa
je 0x140385a7d
mov ecx, 2
call fcn.14046f6f0
mov rcx, rax
lea rdx, [0x140599c00]
mov r8, rbp
call fcn.1403856f0
mov ecx, 2
call fcn.14046f6f0
mov rcx, rax
call fcn.140470484
xor eax, eax
add rsp, 0x58
pop rbp
pop r15
pop r14
pop r13
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r10, rax
mov rdx, rbp
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x140385ab6
mov rax, rdx
add rdx, rcx
call fcn.14042af70
mov r9, rsp
mov rcx, r10
mov rdx, rbp
mov r8d, eax
mov qword [r9 + 0x20], 0
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140385a6f
movzx eax, word [r9 + r10 + 0x5c]
cmp eax, 2
jne 0x140385a38
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140385b53
mov rcx, rax
lea rdx, [0x14059ced4]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140385b53
xor ecx, ecx
mov rdx, rbp
lea r8, [0x141940900]
mov r9d, 0x12010
call rax
test eax, eax
jne 0x140385a6f
cmp r13d, 0xaa
je 0x140385b7d
mov ecx, 2
call fcn.14046f6f0
mov rcx, rax
lea rdx, [0x140599c00]
mov r8, rbp
call fcn.1403856f0
jmp 0x140385a6f
cmp r13d, 0xaa
je 0x140385bda
mov ecx, 2
call fcn.14046f6f0
mov rcx, rax
lea rdx, [0x140599c00]
mov r8, rbp
call fcn.1403856f0
jmp 0x140385a6f
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r10, rax
mov rdx, rbp
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x140385bb6
mov rax, rdx
add rdx, rcx
call fcn.14042af70
mov r9, rsp
mov rcx, r10
mov rdx, rbp
mov r8d, eax
mov qword [r9 + 0x20], 0
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140385a6f
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r10, rax
mov rdx, rbp
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x140385c13
mov rax, rdx
add rdx, rcx
call fcn.14042af70
mov r9, rsp
mov rcx, r10
mov rdx, rbp
mov r8d, eax
mov qword [r9 + 0x20], 0
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140385a6f
mov rax, rsp
mov rcx, r15
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
mov dword [rax + 0x20], 4
mov dword [rax + 0x28], 0x80
mov qword [rax + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp r14, 0xffffffffffffffff
je 0x1403859d3
mov rcx, r14
xor edx, edx
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rdx, rbp
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x140385cb0
mov rax, rdx
add rdx, rcx
call fcn.14042af70
mov r10, rsp
mov rcx, r14
mov rdx, rbp
mov r8d, eax
lea r9, [rsp + 0x44]
mov qword [r10 + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1403859ce