Function at 0x140016ae0
Capabilities:
Query environment variable
Resume thread
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x308
mov rbx, r9
mov rsi, r8
mov r14d, edx
mov r15d, ecx
mov qword [rsp + 0x58], 0
lea rcx, [0x140036d56]
lea rdi, [rsp + 0xf0]
mov rdx, rdi
mov r8d, 0x104
call sub.KERNEL32.dll_GetEnvironmentVariableA
mov ebp, eax
lea eax, [r14 - 0x1001]
cmp eax, 0xffffefff
ja 0x140016b42
mov ecx, 0x57
call sub.KERNEL32.dll_SetLastError
xor esi, esi
jmp 0x140016f74
lea rcx, [rsp + 0x58]
mov edx, r15d
mov r8d, r14d
mov r9, rsi
call fcn.140016fa0
xor esi, esi
test eax, eax
je 0x140016f74
add ebp, 0xfffffefc
cmp ebp, 0xfffffefd
jb 0x140016f74
mov rcx, 0xfffffffffffffefc
mov eax, 0x100
nop dword [rax]
cmp byte [rsp + rcx + 0x1f4], 0
je 0x140016bc1
cmp byte [rsp + rcx + 0x1f5], 0
je 0x140016bd9
cmp byte [rsp + rcx + 0x1f6], 0
je 0x140016bef
cmp byte [rsp + rcx + 0x1f7], 0
je 0x140016c13
cmp byte [rsp + rcx + 0x1f8], 0
je 0x140016bf3
add rax, 0xfffffffffffffffb
add rcx, 5
jne 0x140016b80
jmp 0x140016f74
neg rcx
mov rax, rcx
sub rdi, rax
mov byte [rdi + 0x104], 0x5c
cmp rax, 1
je 0x140016c03
jmp 0x140016c26
add rax, 3
sub rdi, rax
mov byte [rdi + 0x104], 0x5c
cmp rax, 1
je 0x140016c03
jmp 0x140016c26
add rax, 2
sub rdi, rax
mov byte [rdi + 0x104], 0x5c
cmp rax, 1
jne 0x140016c26
add rdi, 0x105
mov byte [rdi - 1], 0
jmp 0x140016f74
inc rax
sub rdi, rax
mov byte [rdi + 0x104], 0x5c
cmp rax, 1
je 0x140016c03
add rdi, 0x104
mov byte [rdi + 1], 0x73
cmp rax, 2
jne 0x140016c44
add rdi, 2
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi + 2], 0x79
cmp rax, 3
jne 0x140016c5b
add rdi, 3
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi + 3], 0x73
cmp rax, 4
jne 0x140016c72
add rdi, 4
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi + 4], 0x77
cmp rax, 5
jne 0x140016c89
add rdi, 5
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi + 5], 0x6f
cmp rax, 6
jne 0x140016ca0
add rdi, 6
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi + 6], 0x77
cmp rax, 7
jne 0x140016cb7
add rdi, 7
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi + 7], 0x36
cmp rax, 8
jne 0x140016cce
add rdi, 8
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi + 8], 0x34
cmp rax, 9
jne 0x140016ce5
add rdi, 9
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi + 9], 0x5c
cmp rax, 0xa
jne 0x140016cfc
add rdi, 0xa
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi + 0xa], 0x72
cmp rax, 0xb
jne 0x140016d13
add rdi, 0xb
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi + 0xb], 0x75
cmp rax, 0xc
jne 0x140016d2a
add rdi, 0xc
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi + 0xc], 0x6e
cmp rax, 0xd
jne 0x140016d41
add rdi, 0xd
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi + 0xd], 0x64
cmp rax, 0xe
jne 0x140016d58
add rdi, 0xe
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi + 0xe], 0x6c
cmp rax, 0xf
jne 0x140016d6f
add rdi, 0xf
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi + 0xf], 0x6c
cmp rax, 0x10
jne 0x140016d86
add rdi, 0x10
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi + 0x10], 0x33
cmp rax, 0x11
jne 0x140016d9d
add rdi, 0x11
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi + 0x11], 0x32
cmp rax, 0x12
jne 0x140016db4
add rdi, 0x12
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi + 0x12], 0x2e
cmp rax, 0x13
jne 0x140016dcb
add rdi, 0x13
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi + 0x13], 0x65
cmp rax, 0x14
jne 0x140016de2
add rdi, 0x14
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi + 0x14], pe_nt_image_headers64
cmp rax, 0x15
jne 0x140016df9
add rdi, 0x15
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi + 0x15], 0x65
add rdi, 0x16
cmp rax, 0x16
jne 0x140016e10
mov byte [rdi - 1], 0
jmp 0x140016f74
mov byte [rdi], 0
mov r9, qword [rsp + 0x58]
add r9, 0xc
lea r8, [0x140037ae7]
lea rcx, [rsp + 0x200]
mov edx, 0x104
call fcn.140017be0
test eax, eax
js 0x140016f74
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], 0
mov dword [rsp + 0x80], 0x68
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor esi, esi
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x200]
xor r8d, r8d
xor r9d, r9d
call rbx
test eax, eax
je 0x140016f74
mov r8, qword [rsp + 0x58]
mov r9d, dword [r8]
mov rcx, qword [rsp + 0x60]
lea rdx, [0x140034c78]
call fcn.1400164f0
test eax, eax
je 0x140016f51
mov rcx, qword [rsp + 0x68]
call sub.KERNEL32.dll_ResumeThread
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov dword [rsp + 0x54], 0x1f4
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x54]
call sub.KERNEL32.dll_GetExitCodeProcess
mov rcx, qword [rsp + 0x60]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x68]
call sub.KERNEL32.dll_CloseHandle
xor esi, esi
cmp dword [rsp + 0x54], 0
sete sil
jmp 0x140016f74
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call sub.KERNEL32.dll_TerminateProcess
mov rcx, qword [rsp + 0x60]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x68]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140016f83
call fcn.140031ab8
mov eax, esi
add rsp, 0x308
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret