Function at 0x1400030e0
Capabilities:
Create directory
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
lea rax, [0x14012ec70]
xor edi, edi
mov qword [rbp - 0x60], rax
movzx r12d, cx
lea rax, [0x14012ec74]
movzx r15d, di
mov qword [rbp - 0x58], rax
mov rbx, 0xffffffffffffffff
lea rax, [0x14012ec78]
mov qword [rbp - 0x50], rax
lea rax, [0x14012ec7c]
mov qword [rbp - 0x48], rax
lea rax, [0x14012ec80]
mov qword [rbp - 0x40], rax
lea rax, [0x14012ec84]
mov qword [rbp - 0x38], rax
lea rax, [0x14012ec88]
mov qword [rbp - 0x30], rax
lea rax, [0x14012ec8c]
mov qword [rbp - 0x28], rax
lea rax, [0x14012ec90]
mov qword [rbp - 0x20], rax
lea rax, [0x14012ec94]
mov qword [rbp - 0x18], rax
lea rax, [0x14012ec98]
mov qword [rbp - 0x10], rax
lea rax, [0x14012ec9c]
mov qword [rbp - 8], rax
lea rax, [0x14012eca0]
mov qword [rbp], rax
lea rax, [0x14012eca4]
mov qword [rbp + 8], rax
lea rax, [0x14012eca8]
mov qword [rbp + 0x10], rax
lea rax, [0x14012ecac]
mov qword [rbp + 0x18], rax
lea rax, [0x14012ecb0]
mov qword [rbp + 0x20], rax
lea rax, [0x14012ecb4]
mov qword [rbp + 0x28], rax
lea rax, [0x14012ecb8]
mov qword [rbp + 0x30], rax
lea rax, [0x14012ecbc]
mov qword [rbp + 0x38], rax
lea rax, [0x14012ecc0]
mov qword [rbp + 0x40], rax
lea rax, str.00000419
mov qword [rsp + 0x40], rax
lea rax, str.0000082C
mov qword [rsp + 0x48], rax
lea rax, str.0000043F
mov qword [rsp + 0x50], rax
lea rax, str.00000423
mov qword [rsp + 0x58], rax
lea rax, str.0002042B
mov qword [rsp + 0x60], rax
lea rax, str.00000440
mov qword [rsp + 0x68], rax
lea rax, str.00010418
mov qword [rsp + 0x70], rax
lea rax, str.00000428
mov qword [rsp + 0x78], rax
lea rax, str.0000041F
mov qword [rbp - 0x80], rax
lea rax, str.00000442
mov qword [rbp - 0x78], rax
lea rax, str.00000843
mov qword [rbp - 0x70], rax
lea rax, str.qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890_
inc rbx
cmp byte [rax + rbx], dil
jne 0x140003284
mov esi, edi
lea r14, [rsp + 0x40]
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [r14]
lea rcx, [0x140165a40]
call sub.VCRUNTIME140.dll_strstr
test rax, rax
lea ecx, [r15 + 1]
lea r14, [r14 + 8]
cmove cx, r15w
inc esi
movzx r15d, cx
cmp esi, 0xb
jb 0x1400032a0
mov esi, edi
lea r14, [rbp - 0x60]
lea r13, [0x140165a90]
nop word [rax + rax]
mov rdx, qword [r14]
mov rcx, r13
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x1400032fd
inc esi
add r14, 8
cmp esi, 0x15
jb 0x1400032e0
jmp 0x140003301
inc r15w
cmp r15w, 2
jge 0x140003384
xor ecx, ecx
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
mov rcx, rax
call sub.api_ms_win_crt_utility_l1_1_0.dll_srand
lea rax, str.AppDataLocalTemp
mov qword [rsp + 0x20], rax
lea rax, str.AppDataRoaming
mov qword [rsp + 0x28], rax
lea rax, str.AppDataLocal
mov qword [rsp + 0x30], rax
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
mov r15d, eax
mov eax, 0x55555556
imul r15d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
sub r15d, ecx
mov ecx, reloc.WS2_32.dll_select
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rsi, rax
test rax, rax
je 0x140003384
mov ecx, 0x64
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r14, rax
test rax, rax
jne 0x1400033a7
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
xor eax, eax
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r13, str.qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890_
nop
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
cdqe
xor edx, edx
div rbx
movsxd rax, edx
movzx eax, byte [rax + r13]
mov byte [rsi + rdi], al
inc rdi
cmp rdi, 0x11
jl 0x1400033b0
lea rcx, str.USERPROFILE
mov byte [rsi + 0x11], 0
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov rdx, r14
lea r13, [0x140165a90]
sub rdx, rax
nop dword [rax]
movzx ecx, byte [rax]
mov byte [rdx + rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x1400033f0
movsxd r8, r15d
lea rcx, [r14 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140003405
mov r8, qword [rsp + r8*8 + 0x20]
xor edx, edx
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140003420
mov ecx, 0x80
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rbx, rax
test rax, rax
je 0x140003504
mov rdx, rax
mov rcx, r14
sub rdx, r14
nop
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140003450
lea rcx, [rbx - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140003462
movzx eax, word [0x14012edc4]
mov word [rcx], ax
lea rcx, [rbx - 1]
test r12w, r12w
jne 0x1400034a2
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140003480
xor edx, edx
nop dword [rax]
movzx eax, byte [rdx + r13]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140003490
jmp 0x1400034c9
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400034a2
mov eax, dword [str.UNKNW_]
mov dword [rcx], eax
movzx eax, word [0x14012edcc]
mov word [rcx + 4], ax
movzx eax, byte [0x14012edce]
mov byte [rcx + 6], al
lea rcx, [rbx - 1]
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400034d0
xor edx, edx
nop dword [rax]
movzx eax, byte [rsi + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400034e0
mov rcx, rbx
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir
cmp eax, 0xffffffff
jne 0x140003514
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, r14
jmp 0x14000337f
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, r14
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rax, rbx
jmp 0x140003386