Function at 0x140001000
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov r8, 0x6f0
xor rdx, rdx
movabs rcx, 0x1401156b0
call sub.msvcrt.dll_memset
xor rcx, rcx
call sub.KERNEL32.DLL_GetModuleHandleW
mov qword [0x1401156b8], rax
xor r8, r8
mov rdx, 0x1000
xor rcx, rcx
call sub.KERNEL32.DLL_HeapCreate
mov qword [0x1401156b0], rax
movabs rax, 0x1400d5970
mov qword [0x140115708], rax
call fcn.14002a6e0
call fcn.140029a18
call fcn.140029420
call fcn.140027720
call fcn.140024954
call fcn.140023e20
call fcn.140023408
call fcn.140021ae4
call fcn.14002127c
call fcn.140020dac
call fcn.140020a40
call fcn.14001ce90
call fcn.14001c574
call fcn.14001adf0
call fcn.140019ce8
call fcn.140018650
call fcn.1400156c4
call fcn.14001332c
call fcn.140012430
call fcn.140012100
call fcn.1400109e0
call fcn.14000fb64
call fcn.14000f89c
movabs rdx, str.v2.3
lea rcx, [0x140115778]
call fcn.14002a770
movabs rdx, 0x1400d1028
lea rcx, [0x140115720]
call fcn.14002a770
push qword [0x140117620]
movabs rcx, str.KMS_Cleaner_x64
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
mov rcx, qword [0x140115778]
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
lea rcx, [0x140115720]
pop rdx
call fcn.14002a8d0
call fcn.14000df3d
and rax, rax
je 0x14000117b
mov rcx, qword [0x140115720]
push qword [0x140117620]
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
movabs rcx, str.__Run_As_SYSTEM_
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
lea rcx, [0x140115720]
pop rdx
call fcn.14002a8d0
mov rcx, qword [0x140115720]
push qword [0x140117620]
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
add qword [0x140117620], 2
lea rcx, [0x1401156f8]
pop rdx
call fcn.14002a8d0
push 9
movabs rax, str.Microsoft_Sans_Serif
mov rdx, rax
movabs rcx, 0
pop r8
call fcn.140029a8c
movabs rdx, 0x1400d55ca
lea rcx, [0x140115770]
call fcn.14002a770
movabs rdx, 0x1400d1028
lea rcx, [0x140115738]
call fcn.14002a770
movabs rdx, 0x1400d1028
lea rcx, [0x140115718]
call fcn.14002a770
movabs rdx, 0x1400d1028
lea rcx, [0x140115788]
call fcn.14002a770
mov rax, qword [0x140117620]
push rax
sub rsp, 8
push rax
movabs rcx, 0x3e8
pop rdx
sub rsp, 0x20
call fcn.140027ac0
add rsp, 0x28
lea rcx, [0x140115768]
pop rdx
call fcn.14002a8d0
push 0x3e8
mov rax, qword [0x140115768]
push rax
movabs rax, str.WINDIR
mov rcx, rax
pop rdx
pop r8
call sub.KERNEL32.DLL_GetEnvironmentVariableW
mov rax, qword [0x140117620]
push rax
sub rsp, 8
push rax
movabs rcx, 0x3e8
pop rdx
sub rsp, 0x20
call fcn.140027ac0
add rsp, 0x28
lea rcx, [0x1401156d8]
pop rdx
call fcn.14002a8d0
push 0x3e8
mov rax, qword [0x1401156d8]
push rax
movabs rax, str.WINDIR
mov rcx, rax
pop rdx
pop r8
call sub.KERNEL32.DLL_GetEnvironmentVariableW
mov rax, qword [0x140117620]
push rax
sub rsp, 8
push rax
movabs rcx, 0xc8
pop rdx
sub rsp, 0x20
call fcn.140027ac0
add rsp, 0x28
lea rcx, [0x140115740]
pop rdx
call fcn.14002a8d0
mov rax, qword [0x140117620]
push rax
sub rsp, 8
push rax
movabs rcx, 0xc8
pop rdx
sub rsp, 0x20
call fcn.140027ac0
add rsp, 0x28
lea rcx, [0x140115780]
pop rdx
call fcn.14002a8d0
push 0xc8
mov rax, qword [0x140115740]
push rax
movabs rax, str.PROCESSOR_ARCHITECTURE
mov rcx, rax
pop rdx
pop r8
call sub.KERNEL32.DLL_GetEnvironmentVariableW
push 0xc8
mov rax, qword [0x140115780]
push rax
movabs rax, str.PROCESSOR_ARCHITEW6432
mov rcx, rax
pop rdx
pop r8
call sub.KERNEL32.DLL_GetEnvironmentVariableW
mov rax, qword [0x140117620]
push rax
sub rsp, 8
push rax
movabs rcx, 0x3e8
pop rdx
sub rsp, 0x20
call fcn.140027ac0
add rsp, 0x28
lea rcx, [0x140115700]
pop rdx
call fcn.14002a8d0
push 0x3e8
mov rax, qword [0x140115700]
push rax
movabs rax, str.LOCALAPPDATA
mov rcx, rax
pop rdx
pop r8
call sub.KERNEL32.DLL_GetEnvironmentVariableW
mov rax, qword [0x140117620]
push rax
sub rsp, 8
push rax
movabs rcx, 0x64
pop rdx
sub rsp, 0x20
call fcn.140027ac0
add rsp, 0x28
lea rcx, [0x1401156c8]
pop rdx
call fcn.14002a8d0
push 0x64
mov rax, qword [0x1401156c8]
push rax
movabs rax, str.SYSTEMDRIVE
mov rcx, rax
pop rdx
pop r8
call sub.KERNEL32.DLL_GetEnvironmentVariableW
push qword [0x140117620]
sub rsp, 8
mov rcx, qword [0x140115768]
push qword [0x140117620]
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
movabs rcx, 0x1400d109c
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
mov rdx, qword [0x140117630]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140019ed4
add rsp, 0x28
pop qword [0x140117620]
mov r15, rax
cmp r15, 0xfffffffffffffffe
jne 0x1400014be
mov rcx, qword [0x140115768]
push qword [0x140117620]
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
movabs rcx, 0x1400d109c
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
lea rcx, [0x140115718]
pop rdx
call fcn.14002a8d0
push qword [0x140117620]
sub rsp, 8
mov rcx, qword [0x140115768]
push qword [0x140117620]
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
movabs rcx, str.Sysnativecmd.exe
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
mov rdx, qword [0x140117630]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140019ed4
add rsp, 0x28
pop qword [0x140117620]
mov r15, rax
and r15, r15
jle 0x140001560
mov rcx, qword [0x140115768]
push qword [0x140117620]
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
movabs rcx, str.Sysnative
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
lea rcx, [0x140115768]
pop rdx
call fcn.14002a8d0
jmp 0x14000159e
mov rcx, qword [0x140115768]
push qword [0x140117620]
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
movabs rcx, str.System32
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
lea rcx, [0x140115768]
pop rdx
call fcn.14002a8d0
push qword [0x140117620]
sub rsp, 8
push qword [0x140115718]
mov rdx, qword [0x140117620]
push rdx
push rdx
pop rcx
sub rsp, 0x20
call fcn.14000fbac
add rsp, 0x20
mov rdx, qword [0x140117630]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140027b20
add rsp, 0x28
pop qword [0x140117620]
mov r15, rax
and r15, r15
jne 0x1400019b0
push qword [0x140117620]
sub rsp, 8
mov rcx, qword [0x140115718]
push qword [0x140117620]
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
movabs rcx, 0x1400d1700
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
mov rdx, qword [0x140117620]
push rdx
push rdx
mov rdx, qword [0x140117620]
push rdx
push rdx
pop rcx
sub rsp, 0x20
call fcn.14000fbac
add rsp, 0x20
mov rdx, qword [0x140117630]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001a050
add rsp, 0x20
pop rax
add qword [0x140117620], 2
mov rdx, qword [0x140117620]
push rdx
push rdx
pop rcx
sub rsp, 0x20
call fcn.14000fbac
add rsp, 0x20
mov rdx, qword [0x140117630]
add qword [rsp], rdx
mov rdx, qword [0x140117630]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001a15c
add rsp, 0x28
pop qword [0x140117620]
push qword [0x140117620]
sub rsp, 8
mov rcx, qword [0x140115718]
push qword [0x140117620]
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
movabs rcx, 0x1400d1700
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
mov rdx, qword [0x140117620]
push rdx
push rdx
mov rdx, qword [0x140117620]
push rdx
push rdx
pop rcx
sub rsp, 0x20
call fcn.14000fbac
add rsp, 0x20
mov rdx, qword [0x140117630]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001a050
add rsp, 0x20
pop rax
mov rdx, qword [0x140117630]
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.14000fc9c
add rsp, 0x28
pop qword [0x140117620]
movabs rcx, 0x1f4
call fcn.140018270
push qword [0x140117620]
movabs rcx, 0x1400d12c4
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
mov rcx, qword [0x140115718]
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
movabs rcx, 0x1400d1700
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
mov rdx, qword [0x140117620]
push rdx
push rdx
mov rdx, qword [0x140117620]
push rdx
push rdx
pop rcx
sub rsp, 0x20
call fcn.14000fbac
add rsp, 0x20
mov rdx, qword [0x140117630]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001a050
add rsp, 0x20
pop rax
movabs rcx, 0x1400d12c4
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
lea rcx, [0x140115710]
pop rdx
call fcn.14002a8d0
mov rax, qword [0x140117620]
push rax
sub rsp, 8
push rax
pop rcx
sub rsp, 0x20
call fcn.14001a180
add rsp, 0x28
movabs rcx, str.SelfDelete.bat
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
lea rcx, [0x140115790]
pop rdx
call fcn.14002a8d0
mov rdx, qword [0x140115790]
movabs rcx, 0xffffffffffffffff
call fcn.14001b070
mov qword [0x140115758], rax
movabs rax, str.:debut
mov rdx, rax
mov rcx, qword [0x140115758]
call fcn.14001b3a0
movabs rax, str.timeout__t_3
mov rdx, rax
mov rcx, qword [0x140115758]
call fcn.14001b3a0
mov rax, qword [0x140117620]
push rax
sub rsp, 8
push rax
movabs rcx, str.del
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
mov rcx, qword [0x140115710]
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
add qword [0x140117620], 2
push qword [0x140115758]
mov rdx, qword [0x140117630]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001b3a0
add rsp, 0x28
pop qword [0x140117620]
mov rax, qword [0x140117620]
push rax
sub rsp, 8
push rax
movabs rcx, str.If_exist
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
mov rcx, qword [0x140115710]
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
movabs rcx, str._Goto_debut
sub rsp, 0x28
call fcn.14002a860
add rsp, 0x28
add qword [0x140117620], 2
push qword [0x140115758]
mov rdx, qword [0x140117630]
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001b3a0
add rsp, 0x28
pop qword [0x140117620]
movabs rax, str.del__0
mov rdx, rax
mov rcx, qword [0x140115758]
call fcn.14001b3a0
mov rcx, qword [0x140115758]
call fcn.14001ad00
movabs rdx, 2
mov rcx, qword [0x140115790]
call fcn.14000d91f
jmp 0x140001da9
movabs rdx, 0x100
movabs rcx, 0
call fcn.14000dde2
mov rdx, qword [0x140117620]
push rdx
push rdx
movabs rax, 0x1400d1340
push rax
movabs rax, str.BuildLab
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, rax
pop rdx
pop r8
sub rsp, 0x20
call fcn.140006997
add rsp, 0x28
lea rcx, [0x140115728]
pop rdx
call fcn.14002a8d0
movabs rax, 0x1400d1340
mov rdx, rax
mov rcx, qword [0x140115728]
call fcn.140027b20
mov qword [0x140115750], rax
mov r15, qword [0x140115750]
cmp r15, 1
jge 0x140001a41
jmp 0x140001a8b
mov rax, qword [0x140117620]
push rax
sub rsp, 8
push rax
mov r15, qword [0x140115750]
dec r15
mov rax, r15
mov r8, rax
movabs rdx, 1
mov rcx, qword [0x140115728]
pop r9
sub rsp, 0x20
call fcn.140027cb0
add rsp, 0x28
lea rcx, [0x140115728]
pop rdx
call fcn.14002a8d0
mov rcx, qword [0x140115728]
call fcn.140027d70
mov qword [0x1401156d0], rax
mov r15, qword [0x1401156d0]
cmp r15, 0x2580
jl 0x140001ac9
movabs rdx, 0x1400d55ca
lea rcx, [0x140115770]
call fcn.14002a770
jmp 0x140001bec
mov r15, qword [0x1401156d0]
cmp r15, 0x23f0
jl 0x140001af2
mov r15, qword [0x1401156d0]
cmp r15, 0x2454
jge 0x140001af2
mov rax, 1
jmp 0x140001af5
xor rax, rax
and rax, rax
je 0x140001b15
movabs rdx, 0x1400d1428
lea rcx, [0x140115770]
call fcn.14002a770
jmp 0x140001bec
mov r15, qword [0x1401156d0]
cmp r15, 0x1db0
jl 0x140001b3e
mov r15, qword [0x1401156d0]
cmp r15, 0x1e14
jge 0x140001b3e
mov rax, 1
jmp 0x140001b41
xor rax, rax
and rax, rax
je 0x140001b61
movabs rdx, 0x1400d1424
lea rcx, [0x140115770]
call fcn.14002a770
jmp 0x140001bec
mov r15, qword [0x1401156d0]
cmp r15, 0xa28
jl 0x140001b8a
mov r15, qword [0x1401156d0]
cmp r15, 0xbb8
jge 0x140001b8a
mov rax, 1
jmp 0x140001b8d
xor rax, rax
and rax, rax
je 0x140001bd6
movabs rdx, 0x1400d338a
lea rcx, [0x140115770]
call fcn.14002a770
movabs rdx, 1
mov rcx, qword [0x1401156e8]
call fcn.140015798
movabs rdx, 1
mov rcx, qword [0x1401156f0]
call fcn.140015798
jmp 0x140001bec
movabs rdx, 0x1400d55ca
lea rcx, [0x140115770]
call fcn.14002a770
push qword [0x140115740]
movabs rcx, str.AMD64
pop rdx
call fcn.14002a9a0
or rax, rax
jne 0x140001c24
push qword [0x140115780]
movabs rcx, str.AMD64
pop rdx
call fcn.14002a9a0
or rax, rax
jne 0x140001c24
jmp 0x140001c2d
mov rax, 1
jmp 0x140001c30
xor rax, rax
and rax, rax
je 0x140001c4d
movabs rdx, str.x64WDV
lea rcx, [0x140115738]
call fcn.14002a770
jmp 0x140001c63
movabs rdx, str.x86WDV
lea rcx, [0x140115738]
call fcn.14002a770
movabs r9, 0xee
movabs r8, 0x1b0
movabs rdx, 0
movabs rcx, 0
call fcn.140001e24
call fcn.140004669
push qword [0x140117620]
sub rsp, 8
push 0
push qword [0x140117620]
movabs rcx, 0x1400d3e82
sub rsp, 0x20
call fcn.14002a860
add rsp, 0x20
mov rcx, qword [0x140115720]
sub rsp, 0x20
call fcn.14002a860
add rsp, 0x20
movabs rcx, 0x1400d1fce
sub rsp, 0x20
call fcn.14002a860
add rsp, 0x20
mov rdx, qword [0x140117630]
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000482a
add rsp, 0x28
pop qword [0x140117620]
call fcn.140018718
and rax, rax
je 0x140001d18
jmp 0x140001d0c
call fcn.140018718
mov qword [0x140115730], rax
cmp qword [0x140115730], 0
je 0x140001d84
call fcn.14001c734
push rax
mov r15, qword [0x140115748]
cmp r15, qword [rsp]
jne 0x140001d5b
sub rsp, 8
mov rcx, qword [0x140115730]
sub rsp, 0x20
call fcn.1400045b3
add rsp, 0x28
jmp 0x140001d81
mov qword [0x140115730], 0
sub rsp, 8
movabs rcx, 5
sub rsp, 0x20
call fcn.140018270
add rsp, 0x28
pop rax
jmp 0x140001d93
movabs rcx, 5
call fcn.140018270
mov r15, qword [0x140115730]
cmp r15, 0x333c
jne 0x140001d18
jmp 0x140001da9
call 0x140001dcb
call fcn.14002a740
mov rcx, qword [0x1401156b0]
call sub.KERNEL32.DLL_HeapDestroy
mov rcx, qword [0x1401156c0]
call sub.KERNEL32.DLL_ExitProcess
sub rsp, 0x28
call fcn.1400109c4
call fcn.1400120f4
call fcn.1400122e4
call fcn.140013320
call fcn.140015660
call fcn.140018620
call fcn.140019ccc
call fcn.14001a228
call fcn.14001ade0
call fcn.14001c548
call fcn.140021270
call fcn.1400233f8
call fcn.140027750
call fcn.140029c18
call fcn.140029c44
call fcn.140029410
add rsp, 0x28
ret