Function at 0x14001ea34
Capabilities:
Create directory
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov r15, rcx
xor esi, esi
mov qword [rax - 0x58], rsi
mov qword [rax - 0x60], rsi
lea r14, [rax - 0x58]
cmp rcx, rsi
cmovne r14, rcx
lea rbp, [rax - 0x60]
cmp rdx, rsi
cmovne rbp, rdx
cmp rdx, rsi
jne 0x14001eab1
cmp rcx, rsi
jne 0x14001eaa4
lea rcx, [rax - 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x50]
call fcn.14005b520
xor eax, eax
jmp 0x14001ed31
mov rdx, qword [r14]
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov r12d, esi
cmp qword [rbp], rsi
je 0x14001eac7
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r12d, eax
mov edx, 0x26c
mov rcx, r14
call fcn.1400635c0
mov edx, 0x2d0
mov rcx, rbp
call fcn.1400635c0
mov edi, 0x5c
cmp r12d, esi
jg 0x14001eb3b
mov ebx, 0x208
mov r8d, ebx
mov rdx, qword [rbp]
lea rcx, [0x140146790]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r12d, eax
cmp eax, esi
jg 0x14001eb22
mov r8d, ebx
mov rdx, qword [rbp]
lea rcx, [0x140146780]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r12d, eax
movsxd rcx, r12d
mov rax, qword [rbp]
mov word [rax + rcx*2], di
inc r12d
movsxd rcx, r12d
mov rax, qword [rbp]
mov word [rax + rcx*2], si
lea eax, [r12 + 1]
movsxd r8, eax
add r8, r8
mov rdx, qword [rbp]
mov rcx, qword [r14]
call fcn.14010cd30
mov r13, rsi
mov dword [rsp + 0xb0], 0xc7
cmp r15, rsi
je 0x14001ec3e
movsxd rcx, r12d
mov rax, qword [r14]
lea rdi, [rax + rcx*2]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call fcn.14005d820
add ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
lea rax, [0x140146770]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
mov r8, qword [rsp + 0xc8]
lea rdx, str.pecmd__s._lu._lu_s_
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, esi
jne 0x14001ebe2
mov edx, 5
lea rcx, [0x14019c170]
call fcn.14002bb1c
sub dword [rsp + 0xb0], 1
jns 0x14001eb60
jmp 0x14001ecef
mov r15d, 1
cmp qword [rsp + 0xb8], rsi
jne 0x14001ec02
lea rcx, [rsp + 0x48]
call fcn.14005b520
nop
jmp 0x14001ed24
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
lea r12d, [rbx + 1]
movsxd r8, r12d
add r8, r8
mov rdx, qword [r14]
mov rcx, qword [rbp]
call fcn.14010cd30
mov rax, qword [rbp]
mov ecx, 0x5c
mov word [rax + rbx*2], cx
movsxd rcx, r12d
mov rax, qword [rbp]
mov word [rax + rcx*2], si
jmp 0x14001ec41
mov r15d, r13d
mov edi, esi
movsxd r12, r12d
mov rax, qword [rbp]
lea rbx, [rax + r12*2]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r8, qword [rsp + 0xc8]
lea rdx, str.pecmd__s._lu._lu_s
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 0x80
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8d, 0x40000000
mov rdx, qword [rbp]
lea rcx, [rsp + 0xb8]
call fcn.14001c898
mov r13, rax
cmp rax, rsi
jne 0x14001ecea
mov edx, 5
lea rcx, [0x14019c170]
call fcn.14002bb1c
inc edi
cmp edi, 0xc8
jl 0x14001ec46
mov rcx, qword [rbp]
mov word [rcx], si
cmp r15d, esi
jne 0x14001ecf5
mov rax, qword [r14]
mov word [rax], si
mov rax, qword [rsp + 0xc0]
cmp rax, rsi
je 0x14001ed07
mov qword [rax], r13
jmp 0x14001ed16
cmp r13, rsi
je 0x14001ed16
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x48]
call fcn.14005b520
nop
mov rsi, r13
lea rcx, [rsp + 0x50]
call fcn.14005b520
mov rax, rsi
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret