Function at 0x1400172a0
Capabilities:
Query environment variable
Resume thread
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x720
mov rsi, r9
mov rdi, r8
mov ebx, edx
mov r14d, ecx
mov qword [rsp + 0x58], 0
lea rcx, str.WINDIR
lea rdx, [rsp + 0xf0]
mov r8d, 0x104
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebp, eax
lea eax, [rbx - 0x1001]
cmp eax, 0xffffefff
ja 0x1400172f9
mov ecx, 0x57
call sub.KERNEL32.dll_SetLastError
jmp 0x140017572
lea rcx, [rsp + 0x58]
mov edx, r14d
mov r8d, ebx
mov r9, rdi
call fcn.140016fa0
xor edi, edi
test eax, eax
je 0x140017574
add ebp, 0xfffffefc
cmp ebp, 0xfffffefd
jb 0x140017574
xor eax, eax
nop word [rax + rax]
cmp word [rsp + rax*2 + 0xf0], 0
je 0x140017378
cmp word [rsp + rax*2 + 0xf2], 0
je 0x14001737f
cmp word [rsp + rax*2 + 0xf4], 0
je 0x140017386
cmp word [rsp + rax*2 + 0xf6], 0
je 0x14001738d
cmp word [rsp + rax*2 + 0xf8], 0
je 0x140017394
add rax, 5
cmp rax, 0x104
jne 0x140017330
jmp 0x140017572
mov ecx, 0x104
jmp 0x140017399
mov ecx, 0x103
jmp 0x140017399
mov ecx, 0x102
jmp 0x140017399
mov ecx, 0x101
jmp 0x140017399
mov ecx, 0x100
sub rcx, rax
mov eax, 0x104
sub rax, rcx
mov word [rsp + rax*2 + 0xf0], 0x5c
cmp rcx, 1
jne 0x1400173c3
lea rax, [rsp + rax*2]
add rax, 0xf2
jmp 0x14001756c
lea rax, [rsp + rax*2]
add rax, 0xf0
mov word [rax + 2], 0x73
cmp rcx, 2
jne 0x1400173e2
add rax, 4
jmp 0x14001756c
mov word [rax + 4], 0x79
cmp rcx, 3
jne 0x1400173f7
add rax, 6
jmp 0x14001756c
mov word [rax + 6], 0x73
cmp rcx, 4
jne 0x14001740c
add rax, 8
jmp 0x14001756c
mov word [rax + 8], 0x77
cmp rcx, 5
jne 0x140017421
add rax, 0xa
jmp 0x14001756c
mov word [rax + 0xa], 0x6f
cmp rcx, 6
jne 0x140017436
add rax, 0xc
jmp 0x14001756c
mov word [rax + 0xc], 0x77
cmp rcx, 7
jne 0x14001744b
add rax, 0xe
jmp 0x14001756c
mov word [rax + 0xe], 0x36
cmp rcx, 8
jne 0x140017460
add rax, 0x10
jmp 0x14001756c
mov word [rax + 0x10], 0x34
cmp rcx, 9
jne 0x140017475
add rax, 0x12
jmp 0x14001756c
mov word [rax + 0x12], 0x5c
cmp rcx, 0xa
jne 0x14001748a
add rax, 0x14
jmp 0x14001756c
mov word [rax + 0x14], 0x72
cmp rcx, 0xb
jne 0x14001749f
add rax, 0x16
jmp 0x14001756c
mov word [rax + 0x16], 0x75
cmp rcx, 0xc
jne 0x1400174b4
add rax, 0x18
jmp 0x14001756c
mov word [rax + 0x18], 0x6e
cmp rcx, 0xd
jne 0x1400174c9
add rax, 0x1a
jmp 0x14001756c
mov word [rax + 0x1a], 0x64
cmp rcx, 0xe
jne 0x1400174de
add rax, 0x1c
jmp 0x14001756c
mov word [rax + 0x1c], 0x6c
cmp rcx, 0xf
jne 0x1400174f0
add rax, 0x1e
jmp 0x14001756c
mov word [rax + 0x1e], 0x6c
cmp rcx, 0x10
jne 0x140017502
add rax, 0x20
jmp 0x14001756c
mov word [rax + 0x20], 0x33
cmp rcx, 0x11
jne 0x140017514
add rax, 0x22
jmp 0x14001756c
mov word [rax + 0x22], 0x32
cmp rcx, 0x12
jne 0x140017526
add rax, 0x24
jmp 0x14001756c
mov word [rax + 0x24], 0x2e
cmp rcx, 0x13
jne 0x140017538
add rax, 0x26
jmp 0x14001756c
mov word [rax + 0x26], 0x65
cmp rcx, 0x14
jne 0x14001754a
add rax, 0x28
jmp 0x14001756c
mov word [rax + 0x28], pe_nt_image_headers64
cmp rcx, 0x15
jne 0x14001755c
add rax, 0x2a
jmp 0x14001756c
mov word [rax + 0x2a], 0x65
add rax, 0x2c
cmp rcx, 0x16
jne 0x140017593
mov word [rax - 2], 0
xor edi, edi
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140017583
call fcn.140032198
mov eax, edi
add rsp, 0x720
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov word [rax], 0
mov r8, qword [rsp + 0x58]
add r8, 0xc
lea rax, [rsp + 0x300]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x104
xor edi, edi
xor ecx, ecx
xor edx, edx
mov r9d, 0xffffffff
call sub.KERNEL32.dll_MultiByteToWideChar
add eax, 0xfffffefc
cmp eax, 0xfffffefd
jb 0x140017574
lea r8, str.rundll32.exe___s__1
lea rcx, [rsp + 0x510]
lea r9, [rsp + 0x300]
mov edx, 0x104
call fcn.140017c80
test eax, eax
js 0x140017574
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], 0
mov dword [rsp + 0x80], 0x68
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor edi, edi
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x510]
xor r8d, r8d
xor r9d, r9d
call rsi
test eax, eax
je 0x140017574
mov r8, qword [rsp + 0x58]
mov r9d, dword [r8]
mov rcx, qword [rsp + 0x60]
lea rdx, [0x140035c78]
call fcn.1400164f0
test eax, eax
je 0x140017713
mov rcx, qword [rsp + 0x68]
call sub.KERNEL32.dll_ResumeThread
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov dword [rsp + 0x54], 0x1f4
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x54]
call sub.KERNEL32.dll_GetExitCodeProcess
mov rcx, qword [rsp + 0x60]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x68]
call sub.KERNEL32.dll_CloseHandle
xor edi, edi
cmp dword [rsp + 0x54], 0
sete dil
jmp 0x140017574
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call sub.KERNEL32.dll_TerminateProcess
mov rcx, qword [rsp + 0x60]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x68]
call sub.KERNEL32.dll_CloseHandle
jmp 0x140017574