Function at 0x180001330
Capabilities:
Create thread
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x240
test edx, edx
je 0x18000143a
sub edx, 1
je 0x180001362
cmp edx, 2
je 0x18000143a
mov eax, 1
jmp 0x1800015c4
mov qword [0x180008878], rcx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp dword [0x18000824c], 0
jne 0x180001430
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov r8d, 0x104
lea rcx, [0x180008670]
mov rdx, rax
call qword [sym.imp.SHLWAPI.dll_StrCpyNW]
mov r8d, 0x104
lea rdx, [0x180008880]
lea rcx, str.KOMMANDER_SHARE_NAME
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r8d, 0x104
lea rdx, [0x180008250]
lea rcx, str.KOMMANDER_EVENT_NAME
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r8d, 0x104
lea rdx, [0x180008460]
lea rcx, str.KOMMANDER_HOOKID_NAME
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test ebx, ebx
je 0x180001430
test edi, edi
je 0x180001430
xor esi, esi
lea r8, [0x180001300]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180008458], rax
mov eax, 1
jmp 0x1800015c4
cmp dword [0x18000824c], 0
mov ebx, 1
je 0x1800015a4
cmp byte [0x180008248], 0
je 0x1800015a4
lea rcx, [0x180008220]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x18000baa0]
xor esi, esi
mov byte [0x180008248], 0
test rcx, rcx
je 0x1800014a8
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x18000baa0]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [0x18000baa0]
test rcx, rcx
je 0x1800014a1
mov rax, qword [rcx]
mov edx, ebx
call qword [rax]
mov qword [0x18000baa0], rsi
mov rcx, qword [0x18000dab0]
test rcx, rcx
je 0x1800014e1
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x18000dab0]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [0x18000dab0]
test rcx, rcx
je 0x1800014da
mov rax, qword [rcx]
mov edx, ebx
call qword [rax]
mov qword [0x18000dab0], rsi
mov rdi, rsi
xor eax, eax
lock cmpxchg dword [0x180008668], ebx
je 0x180001511
cmp rdi, 0x20
jae 0x1800014fa
xor ecx, ecx
jmp 0x1800014fc
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rdi
xor eax, eax
lock cmpxchg dword [0x180008668], ebx
jne 0x1800014f0
cmp qword [0x180008a88], rsi
je 0x180001591
xor ecx, ecx
call fcn.180004de0
test eax, eax
jne 0x180001591
mov rcx, qword [0x18000dad0]
mov qword [0x18000dad0], rsi
test rcx, rcx
je 0x180001559
nop dword [rax + rax]
mov rdi, qword [rcx]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rdi
test rdi, rdi
jne 0x180001540
mov r8, qword [0x18000dac0]
xor edx, edx
mov rcx, qword [0x180008a88]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x180008a88]
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
mov qword [0x180008a88], rsi
mov qword [0x18000dac0], rsi
mov qword [0x18000dac8], rsi
xchg dword [0x180008668], esi
lea rcx, [0x180008220]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp qword [0x180008458], 0
je 0x1800015c2
nop
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x180008458], 0
jne 0x1800015b0
mov eax, ebx
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret