Function at 0x18003cb00
Capabilities:
Query environment variable
Set console window title

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov rax, qword [0x1801bc5d0]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rdi, rcx
mov qword [rsp + 0x50], rcx
xor r12d, r12d
mov byte [rcx], r12b
mov qword [rcx + 8], r12
lea rsi, [rcx + 0x10]
lea edx, [r12 + 1]
mov rcx, rsi
call fcn.180038c80
nop
lea rbx, [rdi + 0x118]
lea rcx, str.appdata
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rcx, rax
mov qword [rsp + 0x40], rax
mov r14, 0xffffffffffffffff
mov rax, r14
inc rax
cmp byte [rcx + rax], 0
jne 0x18003cb76
mov qword [rsp + 0x48], rax
call fcn.18013830c
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
lea r8, [rsp + 0x60]
mov edx, eax
mov rcx, rbx
call fcn.18002c7f0
nop
lea r15, [rdi + 0x138]
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], r12
mov qword [r15 + 0x18], 7
mov word [r15], r12w
lea rcx, [rdi + 0x158]
mov edx, 1
call fcn.180038c80
nop
mov edx, 1
lea rcx, [rdi + 0x260]
call fcn.180038c80
nop
lea rcx, [rdi + 0x368]
call fcn.180127850
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_AttachConsole]
mov ecx, eax
test eax, eax
setne al
mov byte [rdi], al
test ecx, ecx
jne 0x18003cc14
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rdi + 8], rax
test rax, rax
je 0x18003cc81
lea rcx, str.Witch
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
lea rcx, [rsi + 8]
mov r9d, 0x40
lea r8d, [r9 - 0x36]
lea rdx, str.CONOUT_
call fcn.180028990
mov rcx, qword [rsi]
movsxd rcx, dword [rcx + 4]
xor r8d, r8d
add rcx, rsi
test rax, rax
je 0x18003cc76
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
jmp 0x18003cc81
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rcx, rbx
call fcn.180038dd0
mov rdx, rbx
lea rcx, [rsp + 0xd0]
call fcn.1800319e0
nop
lea rax, str.Backup
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 6
call fcn.18013830c
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rsp + 0x90]
call fcn.18002c7f0
nop
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0xd0]
call fcn.1800396a0
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 8
jb 0x18003cd36
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003cd30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003cd30
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180138eb0
nop
mov rcx, rbx
call fcn.180038ee0
test al, al
jne 0x18003cd62
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18003cd4f
mov rcx, qword [rbx]
call fcn.18013856c
shr rax, 0x20
test eax, eax
jne 0x18003cfa2
jmp 0x18003cdd3
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.180038f50
movsd xmm0, qword [rax]
movsd qword [rsp + 0x20], xmm0
mov edx, dword [rax + 8]
mov ecx, dword [rsp + 0x20]
test edx, edx
je 0x18003cd92
lea eax, [rcx - 1]
test eax, 0xfffffff7
jne 0x18003cfb3
cmp ecx, 3
je 0x18003cdd3
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18003cda4
mov rcx, qword [rbx]
call fcn.180138a18
shr rax, 0x20
test eax, eax
jne 0x18003cfc2
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18003cdc2
mov rcx, qword [rbx]
call fcn.18013856c
shr rax, 0x20
test eax, eax
jne 0x18003cfd3
mov rdx, rbx
mov rcx, r15
call fcn.1800392a0
lea rax, str.Witch.log
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 9
call fcn.18013830c
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x80], xmm0
lea r8, [rsp + 0x80]
mov edx, eax
lea rcx, [rsp + 0xb0]
call fcn.18002c7f0
nop
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call fcn.1800396a0
nop
mov rdx, qword [rsp + 0xc8]
cmp rdx, 8
jb 0x18003ce7a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003ce75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003ce75
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180138eb0
mov rdx, rbx
lea rcx, [rdi + 0x158]
call fcn.180039910
mov rdx, r15
lea rcx, [rdi + 0x260]
call fcn.180039910
mov rbx, qword [rdi + 0x368]
mov ecx, 0x10
call fcn.180138ee4
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rcx, rax
call fcn.18003c770
nop
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.18003a650
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x18003cf0b
mov rdx, qword [rcx + 8]
test rdx, rdx
je 0x18003cf01
lock xadd dword [rdx + 0xc], r14d
cmp r14d, 1
jne 0x18003cefc
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 8]
mov rcx, qword [rsp + 0x30]
mov edx, 0x10
call fcn.180138eb0
mov rcx, qword [rdi + 0x368]
call fcn.1801209d0
nop
jmp 0x18003cf1f
mov qword [0x1801cfac0], rdi
mov rdx, qword [rsp + 0xe8]
cmp rdx, 8
jb 0x18003cf72
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003cf6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003cf6c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180138eb0
nop
mov rax, rdi
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.180138e90
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r8, rbx
mov edx, eax
lea rcx, str.create_directory
call fcn.180031c60
mov r8, rbx
lea rcx, str.status
call fcn.180031c60
mov r8, rbx
mov edx, eax
lea rcx, str.remove
call fcn.180031c60
mov r8, rbx
mov edx, eax
lea rcx, str.create_directory
call fcn.180031c60
int3