Function at 0x140001000
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov r8, 0x728
xor rdx, rdx
movabs rcx, 0x1401493ec
call sub.msvcrt.dll_memset
xor rcx, rcx
call sub.KERNEL32.dll_GetModuleHandleW
mov qword [0x1401493f4], rax
xor r8, r8
mov rdx, 0x1000
xor rcx, rcx
call sub.KERNEL32.dll_HeapCreate
mov qword [0x1401493ec], rax
movabs rax, 0x1400e61e8
mov qword [0x140149454], rax
call fcn.140012760
call fcn.14002d6c0
call fcn.14002c6d8
call fcn.14002c0e0
call fcn.14002a3a0
call fcn.1400275d4
call fcn.140026aa0
call fcn.140026310
call fcn.140025384
call fcn.140024b1c
call fcn.1400245fc
call fcn.140024290
call fcn.1400206e8
call fcn.14001fcb4
call fcn.14001e530
call fcn.14001d41c
call fcn.14001bca4
call fcn.1400189a4
call fcn.14001666c
call fcn.140015598
call fcn.140015374
call fcn.140013b28
call fcn.140012b9c
call fcn.1400128d4
movabs rdx, str.v2.5
lea rcx, [0x1401494cc]
call fcn.14002d730
movabs rdx, 0x1400e1028
lea rcx, [0x140149474]
call fcn.14002d730
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
movabs rcx, str.KMS_Cleaner_x64
sub rsp, 0x28
call fcn.14002d870
add rsp, 0x28
mov rcx, qword [0x1401494cc]
sub rsp, 0x28
call fcn.14002d870
add rsp, 0x28
lea rcx, [0x140149474]
pop rdx
call fcn.14002d8e0
movabs rdx, str.Panic___
lea rcx, [0x14014945c]
call fcn.14002d730
movabs rdx, 0x1400e4d0c
lea rcx, [0x14014949c]
call fcn.14002d730
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140012be4
add rsp, 0x28
lea rcx, [0x140149414]
pop rdx
call fcn.14002d8e0
mov dword [0x14014961c], 0
mov dword [0x140149620], 0
lea rax, [0x140149620]
mov rax, rax
push rax
lea rax, [0x14014961c]
mov rax, rax
push rax
mov rax, qword [0x140149414]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call sub.imagehlp.dll_MapFileAndCheckSumW
movsxd r15, dword [0x14014961c]
cmp r15d, dword [0x140149620]
je 0x14000121a
push reloc.WS2_32.dll_recv
push qword [0x14014949c]
push qword [0x14014945c]
pop rcx
pop rdx
pop r8
call fcn.140012918
jmp 0x140001f25
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14002d820
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14000376c
add rsp, 0x28
lea rcx, [0x140149464]
pop rdx
call fcn.14002d8e0
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14002d820
add rsp, 0x20
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x20
call fcn.14002d820
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14000376c
add rsp, 0x30
push rax
call fcn.14002d9f0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001d608
add rsp, 0x28
lea rcx, [0x140149444]
pop rdx
call fcn.14002d8e0
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
movabs rax, str.tool
push rax
push rcx
sub rsp, 0x20
call fcn.14002d820
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
push qword [0x140149444]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a740
add rsp, 0x20
push rax
call fcn.14002d9f0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a7d0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14001151c
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jne 0x140001380
push qword [0x140149444]
movabs rcx, 0x1400e1028
pop rdx
call fcn.14002da20
or rax, rax
jne 0x140001380
mov rax, 1
jmp 0x140001383
xor rax, rax
and rax, rax
je 0x14000138d
jmp 0x140001f25
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
movabs rax, str.tool
push rax
push rcx
sub rsp, 0x20
call fcn.14002d820
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
push qword [0x140149444]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a740
add rsp, 0x20
push rax
call fcn.14002d9f0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a7d0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14001151c
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jle 0x140001437
push qword [0x140149464]
pop rcx
call fcn.14001d714
mov r15, rax
cmp r15, 0x1c9c380
jge 0x140001437
mov rax, 1
jmp 0x14000143a
xor rax, rax
and rax, rax
je 0x140001444
jmp 0x140001f25
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a960
add rsp, 0x28
lea rcx, [0x14014960c]
pop rdx
call fcn.14002d8e0
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a960
add rsp, 0x28
lea rcx, [0x140149614]
pop rdx
call fcn.14002d8e0
push 0xc8
mov rax, qword [0x14014960c]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITECTURE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov rax, qword [0x140149614]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITEW6432
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x64
mov rax, qword [0x1401495dc]
mov rax, rax
push rax
movabs rax, str.SYSTEMDRIVE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push qword [0x14014960c]
movabs rcx, str.AMD64
pop rdx
call fcn.14002da20
or rax, rax
jne 0x140001572
push qword [0x140149614]
movabs rcx, str.AMD64
pop rdx
call fcn.14002da20
or rax, rax
jne 0x140001572
jmp 0x14000157b
mov rax, 1
jmp 0x14000157e
xor rax, rax
and rax, rax
je 0x14000159b
movabs rdx, 0x1400e376a
lea rcx, [0x1401495f4]
call fcn.14002d730
jmp 0x1400015b1
movabs rdx, 0x1400e4242
lea rcx, [0x1401495f4]
call fcn.14002d730
call fcn.140010402
and rax, rax
je 0x140001603
mov rcx, qword [0x140149474]
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002d870
add rsp, 0x28
movabs rcx, str.__Run_As_SYSTEM_
sub rsp, 0x28
call fcn.14002d870
add rsp, 0x28
lea rcx, [0x140149474]
pop rdx
call fcn.14002d8e0
mov rcx, qword [0x140149474]
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002d870
add rsp, 0x28
call fcn.14002da80
lea rcx, [0x14014943c]
pop rdx
call fcn.14002d8e0
push 9
movabs rax, str.Microsoft_Sans_Serif
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.14002c74c
movabs rdx, 0x1400e5cfe
lea rcx, [0x1401494c4]
call fcn.14002d730
movabs rdx, 0x1400e1028
lea rcx, [0x14014948c]
call fcn.14002d730
movabs rdx, 0x1400e1028
lea rcx, [0x14014946c]
call fcn.14002d730
movabs rdx, 0x1400e1028
lea rcx, [0x1401494dc]
call fcn.14002d730
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a960
add rsp, 0x28
lea rcx, [0x1401494bc]
pop rdx
call fcn.14002d8e0
push 0x3e8
mov rax, qword [0x1401494bc]
mov rax, rax
push rax
movabs rax, str.WINDIR
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a960
add rsp, 0x28
lea rcx, [0x14014941c]
pop rdx
call fcn.14002d8e0
push 0x3e8
mov rax, qword [0x14014941c]
mov rax, rax
push rax
movabs rax, str.WINDIR
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a960
add rsp, 0x28
lea rcx, [0x140149494]
pop rdx
call fcn.14002d8e0
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a960
add rsp, 0x28
lea rcx, [0x1401494d4]
pop rdx
call fcn.14002d8e0
push 0xc8
mov rax, qword [0x140149494]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITECTURE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov rax, qword [0x1401494d4]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITEW6432
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a960
add rsp, 0x28
lea rcx, [0x14014944c]
pop rdx
call fcn.14002d8e0
push 0x3e8
mov rax, qword [0x14014944c]
mov rax, rax
push rax
movabs rax, str.LOCALAPPDATA
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
push 0x64
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14002a960
add rsp, 0x28
lea rcx, [0x140149404]
pop rdx
call fcn.14002d8e0
push 0x64
mov rax, qword [0x140149404]
mov rax, rax
push rax
movabs rax, str.SYSTEMDRIVE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x1401494bc]
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002d870
add rsp, 0x28
movabs rcx, str.Temp
sub rsp, 0x28
call fcn.14002d870
add rsp, 0x28
push rax
call fcn.14002d9f0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.14001d714
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14001151c
add rsp, 0x28
pop rax
mov r15, rax
cmp r15, 0xfffffffffffffffe
jne 0x1400019f1
mov rcx, qword [0x1401494bc]
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002d870
add rsp, 0x28
movabs rcx, str.Temp
sub rsp, 0x28
call fcn.14002d870
add rsp, 0x28
lea rcx, [0x14014946c]
pop rdx
call fcn.14002d8e0
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x1401494bc]
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002d870
add rsp, 0x28
movabs rcx, str.Sysnativecmd.exe
sub rsp, 0x28
call fcn.14002d870
add rsp, 0x28
push rax
call fcn.14002d9f0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.14001d714
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14001151c
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jle 0x140001abe
mov rcx, qword [0x1401494bc]
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002d870
add rsp, 0x28
movabs rcx, str.Sysnative
sub rsp, 0x28
call fcn.14002d870
add rsp, 0x28
lea rcx, [0x1401494bc]
pop rdx
call fcn.14002d8e0
jmp 0x140001b06
mov rcx, qword [0x1401494bc]
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002d870
add rsp, 0x28
movabs rcx, str.System32
sub rsp, 0x28
call fcn.14002d870
add rsp, 0x28
lea rcx, [0x1401494bc]
pop rdx
call fcn.14002d8e0
push 0x100
push 0
pop rcx
pop rdx
call fcn.1400102a2
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14002d820
add rsp, 0x20
pop rcx
push rax
movabs rax, 0x1400e1374
push rax
movabs rax, str.BuildLab
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.140008314
add rsp, 0x28
lea rcx, [0x14014947c]
pop rdx
call fcn.14002d8e0
movabs rax, 0x1400e1374
push rax
push qword [0x14014947c]
pop rcx
pop rdx
call fcn.14002a7d0
mov qword [0x1401494ac], rax
mov r15, qword [0x1401494ac]
cmp r15, 1
jge 0x140001ba4
jmp 0x140001c01
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
mov r15, qword [0x1401494ac]
dec r15
mov rax, r15
push rax
push 1
push qword [0x14014947c]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.14002aa00
add rsp, 0x28
lea rcx, [0x14014947c]
pop rdx
call fcn.14002d8e0
push qword [0x14014947c]
pop rcx
call fcn.14002aac0
mov qword [0x14014940c], rax
mov r15, qword [0x14014940c]
cmp r15, 0x2580
jl 0x140001c3f
movabs rdx, 0x1400e5cfe
lea rcx, [0x1401494c4]
call fcn.14002d730
jmp 0x140001d5a
mov r15, qword [0x14014940c]
cmp r15, 0x23f0
jl 0x140001c68
mov r15, qword [0x14014940c]
cmp r15, 0x2454
jge 0x140001c68
mov rax, 1
jmp 0x140001c6b
xor rax, rax
and rax, rax
je 0x140001c8b
movabs rdx, 0x1400e145c
lea rcx, [0x1401494c4]
call fcn.14002d730
jmp 0x140001d5a
mov r15, qword [0x14014940c]
cmp r15, 0x1db0
jl 0x140001cb4
mov r15, qword [0x14014940c]
cmp r15, 0x1e14
jge 0x140001cb4
mov rax, 1
jmp 0x140001cb7
xor rax, rax
and rax, rax
je 0x140001cd7
movabs rdx, 0x1400e1458
lea rcx, [0x1401494c4]
call fcn.14002d730
jmp 0x140001d5a
mov r15, qword [0x14014940c]
cmp r15, 0xa28
jl 0x140001d00
mov r15, qword [0x14014940c]
cmp r15, 0xbb8
jge 0x140001d00
mov rax, 1
jmp 0x140001d03
xor rax, rax
and rax, rax
je 0x140001d44
movabs rdx, 0x1400e3772
lea rcx, [0x1401494c4]
call fcn.14002d730
push 1
push qword [0x14014942c]
pop rcx
pop rdx
call fcn.140018a78
push 1
push qword [0x140149434]
pop rcx
pop rdx
call fcn.140018a78
jmp 0x140001d5a
movabs rdx, 0x1400e5cfe
lea rcx, [0x1401494c4]
call fcn.14002d730
push qword [0x140149494]
movabs rcx, str.AMD64
pop rdx
call fcn.14002da20
or rax, rax
jne 0x140001d92
push qword [0x1401494d4]
movabs rcx, str.AMD64
pop rdx
call fcn.14002da20
or rax, rax
jne 0x140001d92
jmp 0x140001d9b
mov rax, 1
jmp 0x140001d9e
xor rax, rax
and rax, rax
je 0x140001dbb
movabs rdx, str.x64WDV
lea rcx, [0x14014948c]
call fcn.14002d730
jmp 0x140001dd1
movabs rdx, str.x86WDV
lea rcx, [0x14014948c]
call fcn.14002d730
push 0xee
push 0x1b0
push 0
push 0
pop rcx
pop rdx
pop r8
pop r9
call fcn.140001fa0
call fcn.140005d18
push rcx
sub rsp, 0x28
call fcn.14002d820
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 0
push rcx
sub rsp, 0x20
call fcn.14002d820
add rsp, 0x20
pop rcx
push rax
movabs rcx, 0x1400e42b2
sub rsp, 0x20
call fcn.14002d870
add rsp, 0x20
mov rcx, qword [0x140149474]
sub rsp, 0x20
call fcn.14002d870
add rsp, 0x20
movabs rcx, 0x1400e21ca
sub rsp, 0x20
call fcn.14002d870
add rsp, 0x20
push rax
call fcn.14002d9f0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140005efc
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14001151c
add rsp, 0x28
pop rax
call fcn.14001bd6c
and rax, rax
je 0x140001e99
jmp 0x140001e8d
call fcn.14001bd6c
mov qword [0x140149484], rax
cmp qword [0x140149484], 0
je 0x140001f04
call fcn.14001fe74
mov rax, rax
push rax
mov r15, qword [0x1401494a4]
cmp r15, qword [rsp]
jne 0x140001edf
sub rsp, 8
push qword [0x140149484]
pop rcx
sub rsp, 0x20
call fcn.140005c5a
add rsp, 0x28
jmp 0x140001f01
mov qword [0x140149484], 0
sub rsp, 8
push 5
pop rcx
sub rsp, 0x20
call fcn.14001b8b0
add rsp, 0x28
pop rax
jmp 0x140001f0f
push 5
pop rcx
call fcn.14001b8b0
mov r15, qword [0x140149484]
cmp r15, 0x333c
jne 0x140001e99
jmp 0x140001f25
call 0x140001f47
call fcn.14002d700
mov rcx, qword [0x1401493ec]
call sub.KERNEL32.dll_HeapDestroy
mov rcx, qword [0x1401493fc]
call sub.KERNEL32.dll_ExitProcess
sub rsp, 0x28
call fcn.140013b0c
call fcn.140015368
call fcn.140015558
call fcn.140016660
call fcn.140018940
call fcn.14001bc74
call fcn.14001d418
call fcn.14001d890
call fcn.14001e520
call fcn.14001fc88
call fcn.140024b10
call fcn.14002630c
call fcn.14002a3d0
call fcn.14002c8d8
call fcn.14002c958
call fcn.14002c0d0
add rsp, 0x28
ret