Function at 0x140001000
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov r8, 0x718
xor rdx, rdx
movabs rcx, 0x1401482bc
call sub.msvcrt.dll_memset
xor rcx, rcx
call sub.KERNEL32.dll_GetModuleHandleW
mov qword [0x1401482c4], rax
xor r8, r8
mov rdx, 0x1000
xor rcx, rcx
call sub.KERNEL32.dll_HeapCreate
mov qword [0x1401482bc], rax
movabs rax, 0x1400e50b0
mov qword [0x14014831c], rax
call fcn.140011760
call fcn.14002c590
call fcn.14002b5c8
call fcn.14002afd0
call fcn.1400292d0
call fcn.140026504
call fcn.1400259d0
call fcn.140025240
call fcn.1400242b4
call fcn.140023a4c
call fcn.14002352c
call fcn.1400231c0
call fcn.14001f618
call fcn.14001ebe4
call fcn.14001d460
call fcn.14001c34c
call fcn.14001abd4
call fcn.1400178d4
call fcn.14001559c
call fcn.1400144c8
call fcn.1400142a4
call fcn.140012a58
call fcn.140011b9c
call fcn.1400118d4
movabs rdx, str.v2.5.1
lea rcx, [0x14014838c]
call fcn.14002c600
movabs rdx, 0x1400e0028
lea rcx, [0x140148334]
call fcn.14002c600
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
movabs rcx, str.KMS_Cleaner_x64
sub rsp, 0x28
call fcn.14002c740
add rsp, 0x28
mov rcx, qword [0x14014838c]
sub rsp, 0x28
call fcn.14002c740
add rsp, 0x28
lea rcx, [0x140148334]
pop rdx
call fcn.14002c7b0
movabs rdx, str.Panic___
lea rcx, [0x140148324]
call fcn.14002c600
movabs rdx, 0x1400e3c54
lea rcx, [0x14014835c]
call fcn.14002c600
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140011be4
add rsp, 0x28
lea rcx, [0x1401482e4]
pop rdx
call fcn.14002c7b0
mov dword [0x1401484dc], 0
mov dword [0x1401484e0], 0
lea rax, [0x1401484e0]
mov rax, rax
push rax
lea rax, [0x1401484dc]
mov rax, rax
push rax
mov rax, qword [0x1401482e4]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call sub.imagehlp.dll_MapFileAndCheckSumW
movsxd r15, dword [0x1401484dc]
cmp r15d, dword [0x1401484e0]
je 0x14000121a
push reloc.WS2_32.dll_recv
push qword [0x14014835c]
push qword [0x140148324]
pop rcx
pop rdx
pop r8
call fcn.140011918
jmp 0x140001cfb
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140029670
add rsp, 0x28
lea rcx, [0x1401484cc]
pop rdx
call fcn.14002c7b0
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140029670
add rsp, 0x28
lea rcx, [0x1401484d4]
pop rdx
call fcn.14002c7b0
push 0xc8
mov rax, qword [0x1401484cc]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITECTURE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov rax, qword [0x1401484d4]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITEW6432
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0x64
mov rax, qword [0x14014849c]
mov rax, rax
push rax
movabs rax, str.SYSTEMDRIVE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push qword [0x1401484cc]
movabs rcx, str.AMD64
pop rdx
call fcn.14002c890
or rax, rax
jne 0x140001348
push qword [0x1401484d4]
movabs rcx, str.AMD64
pop rdx
call fcn.14002c890
or rax, rax
jne 0x140001348
jmp 0x140001351
mov rax, 1
jmp 0x140001354
xor rax, rax
and rax, rax
je 0x140001371
movabs rdx, 0x1400e26c2
lea rcx, [0x1401484b4]
call fcn.14002c600
jmp 0x140001387
movabs rdx, 0x1400e319a
lea rcx, [0x1401484b4]
call fcn.14002c600
call fcn.14000f6a5
and rax, rax
je 0x1400013d9
mov rcx, qword [0x140148334]
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002c740
add rsp, 0x28
movabs rcx, str.__Run_As_SYSTEM_
sub rsp, 0x28
call fcn.14002c740
add rsp, 0x28
lea rcx, [0x140148334]
pop rdx
call fcn.14002c7b0
mov rcx, qword [0x140148334]
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002c740
add rsp, 0x28
call fcn.14002c8f0
lea rcx, [0x14014830c]
pop rdx
call fcn.14002c7b0
push 9
movabs rax, str.Microsoft_Sans_Serif
push rax
push 0
pop rcx
pop rdx
pop r8
call fcn.14002b63c
movabs rdx, 0x1400e4be6
lea rcx, [0x140148384]
call fcn.14002c600
movabs rdx, 0x1400e0028
lea rcx, [0x14014834c]
call fcn.14002c600
movabs rdx, 0x1400e0028
lea rcx, [0x14014832c]
call fcn.14002c600
movabs rdx, 0x1400e0028
lea rcx, [0x14014839c]
call fcn.14002c600
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140029670
add rsp, 0x28
lea rcx, [0x14014837c]
pop rdx
call fcn.14002c7b0
push 0x3e8
mov rax, qword [0x14014837c]
mov rax, rax
push rax
movabs rax, str.WINDIR
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140029670
add rsp, 0x28
lea rcx, [0x1401482ec]
pop rdx
call fcn.14002c7b0
push 0x3e8
mov rax, qword [0x1401482ec]
mov rax, rax
push rax
movabs rax, str.WINDIR
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140029670
add rsp, 0x28
lea rcx, [0x140148354]
pop rdx
call fcn.14002c7b0
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140029670
add rsp, 0x28
lea rcx, [0x140148394]
pop rdx
call fcn.14002c7b0
push 0xc8
mov rax, qword [0x140148354]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITECTURE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov rax, qword [0x140148394]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITEW6432
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
push 0x3e8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140029670
add rsp, 0x28
lea rcx, [0x140148314]
pop rdx
call fcn.14002c7b0
push 0x3e8
mov rax, qword [0x140148314]
mov rax, rax
push rax
movabs rax, str.LOCALAPPDATA
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
push 0x64
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140029670
add rsp, 0x28
lea rcx, [0x1401482d4]
pop rdx
call fcn.14002c7b0
push 0x64
mov rax, qword [0x1401482d4]
mov rax, rax
push rax
movabs rax, str.SYSTEMDRIVE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x14014837c]
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002c740
add rsp, 0x28
movabs rcx, str.Temp
sub rsp, 0x28
call fcn.14002c740
add rsp, 0x28
push rax
call fcn.14002c950
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.14001c538
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400107c0
add rsp, 0x28
pop rax
mov r15, rax
cmp r15, 0xfffffffffffffffe
jne 0x1400017c7
mov rcx, qword [0x14014837c]
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002c740
add rsp, 0x28
movabs rcx, str.Temp
sub rsp, 0x28
call fcn.14002c740
add rsp, 0x28
lea rcx, [0x14014832c]
pop rdx
call fcn.14002c7b0
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [0x14014837c]
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002c740
add rsp, 0x28
movabs rcx, str.Sysnativecmd.exe
sub rsp, 0x28
call fcn.14002c740
add rsp, 0x28
push rax
call fcn.14002c950
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.14001c538
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400107c0
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jle 0x140001894
mov rcx, qword [0x14014837c]
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002c740
add rsp, 0x28
movabs rcx, str.Sysnative
sub rsp, 0x28
call fcn.14002c740
add rsp, 0x28
lea rcx, [0x14014837c]
pop rdx
call fcn.14002c7b0
jmp 0x1400018dc
mov rcx, qword [0x14014837c]
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14002c740
add rsp, 0x28
movabs rcx, str.System32
sub rsp, 0x28
call fcn.14002c740
add rsp, 0x28
lea rcx, [0x14014837c]
pop rdx
call fcn.14002c7b0
push 0x100
push 0
pop rcx
pop rdx
call fcn.14000f545
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14002c6f0
add rsp, 0x20
pop rcx
push rax
movabs rax, 0x1400e0374
push rax
movabs rax, str.BuildLab
push rax
movabs rax, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersion
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.1400075b7
add rsp, 0x28
lea rcx, [0x14014833c]
pop rdx
call fcn.14002c7b0
movabs rax, 0x1400e0374
push rax
push qword [0x14014833c]
pop rcx
pop rdx
call fcn.1400296d0
mov qword [0x14014836c], rax
mov r15, qword [0x14014836c]
cmp r15, 1
jge 0x14000197a
jmp 0x1400019d7
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
mov r15, qword [0x14014836c]
dec r15
mov rax, r15
push rax
push 1
push qword [0x14014833c]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140029860
add rsp, 0x28
lea rcx, [0x14014833c]
pop rdx
call fcn.14002c7b0
push qword [0x14014833c]
pop rcx
call fcn.140029920
mov qword [0x1401482dc], rax
mov r15, qword [0x1401482dc]
cmp r15, 0x2580
jl 0x140001a15
movabs rdx, 0x1400e4be6
lea rcx, [0x140148384]
call fcn.14002c600
jmp 0x140001b30
mov r15, qword [0x1401482dc]
cmp r15, 0x23f0
jl 0x140001a3e
mov r15, qword [0x1401482dc]
cmp r15, 0x2454
jge 0x140001a3e
mov rax, 1
jmp 0x140001a41
xor rax, rax
and rax, rax
je 0x140001a61
movabs rdx, 0x1400e045c
lea rcx, [0x140148384]
call fcn.14002c600
jmp 0x140001b30
mov r15, qword [0x1401482dc]
cmp r15, 0x1db0
jl 0x140001a8a
mov r15, qword [0x1401482dc]
cmp r15, 0x1e14
jge 0x140001a8a
mov rax, 1
jmp 0x140001a8d
xor rax, rax
and rax, rax
je 0x140001aad
movabs rdx, 0x1400e0458
lea rcx, [0x140148384]
call fcn.14002c600
jmp 0x140001b30
mov r15, qword [0x1401482dc]
cmp r15, 0xa28
jl 0x140001ad6
mov r15, qword [0x1401482dc]
cmp r15, 0xbb8
jge 0x140001ad6
mov rax, 1
jmp 0x140001ad9
xor rax, rax
and rax, rax
je 0x140001b1a
movabs rdx, 0x1400e26ca
lea rcx, [0x140148384]
call fcn.14002c600
push 1
push qword [0x1401482fc]
pop rcx
pop rdx
call fcn.1400179a8
push 1
push qword [0x140148304]
pop rcx
pop rdx
call fcn.1400179a8
jmp 0x140001b30
movabs rdx, 0x1400e4be6
lea rcx, [0x140148384]
call fcn.14002c600
push qword [0x140148354]
movabs rcx, str.AMD64
pop rdx
call fcn.14002c890
or rax, rax
jne 0x140001b68
push qword [0x140148394]
movabs rcx, str.AMD64
pop rdx
call fcn.14002c890
or rax, rax
jne 0x140001b68
jmp 0x140001b71
mov rax, 1
jmp 0x140001b74
xor rax, rax
and rax, rax
je 0x140001b91
movabs rdx, str.x64WDV
lea rcx, [0x14014834c]
call fcn.14002c600
jmp 0x140001ba7
movabs rdx, str.x86WDV
lea rcx, [0x14014834c]
call fcn.14002c600
push 0xee
push 0x1b0
push 0
push 0
pop rcx
pop rdx
pop r8
pop r9
call fcn.140001d76
call fcn.140004fbb
push rcx
sub rsp, 0x28
call fcn.14002c6f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 0
push rcx
sub rsp, 0x20
call fcn.14002c6f0
add rsp, 0x20
pop rcx
push rax
movabs rcx, 0x1400e3204
sub rsp, 0x20
call fcn.14002c740
add rsp, 0x20
mov rcx, qword [0x140148334]
sub rsp, 0x20
call fcn.14002c740
add rsp, 0x20
movabs rcx, 0x1400e11a4
sub rsp, 0x20
call fcn.14002c740
add rsp, 0x20
push rax
call fcn.14002c950
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14000519f
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400107c0
add rsp, 0x28
pop rax
call fcn.14001ac9c
and rax, rax
je 0x140001c6f
jmp 0x140001c63
call fcn.14001ac9c
mov qword [0x140148344], rax
cmp qword [0x140148344], 0
je 0x140001cda
call fcn.14001eda4
mov rax, rax
push rax
mov r15, qword [0x140148364]
cmp r15, qword [rsp]
jne 0x140001cb5
sub rsp, 8
push qword [0x140148344]
pop rcx
sub rsp, 0x20
call fcn.140004efd
add rsp, 0x28
jmp 0x140001cd7
mov qword [0x140148344], 0
sub rsp, 8
push 5
pop rcx
sub rsp, 0x20
call fcn.14001a7e0
add rsp, 0x28
pop rax
jmp 0x140001ce5
push 5
pop rcx
call fcn.14001a7e0
mov r15, qword [0x140148344]
cmp r15, 0x333c
jne 0x140001c6f
jmp 0x140001cfb
call 0x140001d1d
call fcn.14002c5d0
mov rcx, qword [0x1401482bc]
call sub.KERNEL32.dll_HeapDestroy
mov rcx, qword [0x1401482cc]
call sub.KERNEL32.dll_ExitProcess
sub rsp, 0x28
call fcn.140012a3c
call fcn.140014298
call fcn.140014488
call fcn.140015590
call fcn.140017870
call fcn.14001aba4
call fcn.14001c348
call fcn.14001c6b4
call fcn.14001d450
call fcn.14001ebb8
call fcn.140023a40
call fcn.14002523c
call fcn.140029300
call fcn.14002b7c8
call fcn.14002b848
call fcn.14002afc0
add rsp, 0x28
ret