Function at 0x1400032b0
Capabilities:
Create directory
Create thread
Query environment variable
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_FreeConsole]
call fcn.140008e40
test eax, eax
jne 0x1400032f1
call fcn.1400024b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.140001bd0
mov rdx, qword [0x14002fbd8]
mov r8d, 0x12c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.140009120
mov qword [0x14002fbc8], rax
call fcn.140009160
mov dword [0x14002fbb0], eax
call fcn.140009610
test eax, eax
je 0x14000333c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.1400097d0
test eax, eax
je 0x140003356
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.1400098d0
mov ebx, eax
call fcn.140009990
cmp dword [0x7ffe0260], 0x4e20
mov edi, eax
jb 0x140003382
call fcn.140001b30
test al, al
jne 0x140003382
mov r12d, 1
jmp 0x140003385
xor r12d, r12d
mov edx, edi
mov ecx, ebx
call fcn.140009a10
test eax, eax
jne 0x1400033a8
call fcn.1400024b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.140003670
mov rcx, rax
call fcn.140008e90
test eax, eax
jne 0x1400033cf
call fcn.1400024b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdx, qword [0x14002fbd8]
mov r8d, 0x12c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.140003db0
mov rcx, qword [0x14002fbc0]
mov edx, 0x1f4
mov r13, rax
call fcn.140008e80
mov rdx, qword [0x14002fbc0]
mov r8d, 0x12c
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x14000342d
call fcn.1400024b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002fbc0]
call fcn.1400090c0
test eax, eax
jne 0x140003466
mov rcx, qword [0x14002fbc0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x140003466
call fcn.1400024b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.140004460
mov rcx, qword [0x14002fbc0]
mov rdx, rax
call fcn.140009180
mov rcx, rax
mov rdi, rax
call fcn.1400090c0
test eax, eax
jne 0x1400034ae
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1400034ae
call fcn.1400024b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.140004710
mov rdx, rax
mov rcx, rdi
call fcn.140009180
mov rcx, rax
mov rbx, rax
call fcn.1400090c0
test eax, eax
jne 0x1400034f2
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1400034f2
call fcn.1400024b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.140004a20
mov rdx, rax
mov rcx, rbx
call fcn.140009180
mov rcx, rax
mov r15, rax
call fcn.1400090f0
test eax, eax
jne 0x14000353f
mov r8, r15
lea rcx, [0x14001d750]
mov edx, 0xd7c0
call fcn.140001d00
test eax, eax
jne 0x14000353f
call fcn.1400024b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.140004df0
mov rdx, rax
mov rcx, rbx
call fcn.140009180
mov rcx, rax
mov r14, rax
call fcn.1400090f0
test eax, eax
jne 0x140003589
mov r8, r14
lea rcx, [0x14001d740]
xor edx, edx
call fcn.140001d00
test eax, eax
jne 0x140003589
call fcn.1400024b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.140004e30
mov rdx, rax
mov rcx, rbx
call fcn.140009180
mov rsi, rax
call fcn.140004e80
mov rdx, rax
mov rcx, rbx
call fcn.140009180
mov rbp, rax
test r12d, r12d
je 0x1400035d1
mov rcx, rsi
call fcn.1400090f0
test eax, eax
jne 0x1400035f1
mov r8, rsi
lea rcx, [0x14002b590]
mov edx, 0x650
jmp 0x1400035ec
mov rcx, rbp
call fcn.1400090f0
test eax, eax
jne 0x1400035f1
mov r8, rbp
lea rcx, [0x14002af30]
mov edx, 0x660
call fcn.140001d00
mov rcx, r13
call fcn.140008e50
mov rcx, rdi
call fcn.140008e50
mov rcx, rbx
call fcn.140008e50
mov rcx, r14
call fcn.140008e50
mov rcx, rsi
call fcn.140008e50
mov rcx, rbp
call fcn.140008e50
call fcn.140001ca0
call fcn.140008ff0
xor eax, eax
lea r8, [0x140002480]
mov qword [rsp + 0x28], rax
mov r9, r15
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.1400024b0
mov rcx, qword [0x14002fbc0]
call fcn.140008e50
mov rcx, qword [0x14002fbd8]
call fcn.140008e50
call fcn.140002430
int3