Function at 0x180032780
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x18024bd40]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor ebx, ebx
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], rbx
mov qword [rbp + 7], rbx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bl
jne 0x1800327d7
mov rdx, rax
lea rcx, [rbp - 0x11]
call fcn.180015780
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r14, qword [rbp - 1]
sub rax, r14
mov qword [rbp - 0x39], rax
cmp rax, 6
jb 0x1800330cb
lea r13, [rbp - 0x11]
mov r15, qword [rbp - 0x11]
cmp qword [rbp + 7], 0xf
cmova r13, r15
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x21], xmm1
lea r12, [r14 + 6]
mov esi, 0xf
mov ebx, esi
lea rdi, [rbp - 0x31]
movabs rax, 0x8000000000000000
lea edx, [rsi + 7]
cmp r12, rbx
jbe 0x1800328b9
mov rbx, r12
or rbx, rsi
cmp rbx, rcx
jbe 0x180032881
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.1801904b0
test rax, rax
je 0x18003297f
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800328b5
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1800328a4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800330a7
jmp 0x180032862
test rcx, rcx
je 0x1800328b3
call fcn.1801904b0
mov rdi, rax
jmp 0x1800328b5
xor edi, edi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], rbx
mov r8, r14
mov rdx, r13
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [str.Stand]
mov dword [rdi + r14], eax
movzx eax, word [0x1801a38ac]
mov word [rdi + r14 + 4], ax
mov byte [rdi + r12], 0
mov rdi, qword [rbp - 0x21]
lea rbx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0xf
cmova rbx, qword [rbp - 0x31]
call fcn.18018fb68
mov qword [rbp - 0x49], rbx
mov qword [rbp - 0x41], rdi
lea r8, [rbp - 0x49]
mov edx, eax
lea rcx, [rbp + 0xf]
call fcn.18002e240
nop
mov dword [rbp - 0x49], 0
lea rax, [0x180244ca0]
mov qword [rbp - 0x41], rax
lea rdx, [rbp - 0x49]
lea rcx, [rbp + 0xf]
call fcn.180031800
cmp dword [rbp - 0x49], 0
jne 0x1800330d1
lea rcx, [rbp + 0xf]
call fcn.18002b2f0
nop
mov rdx, qword [rbp - 0x19]
cmp rdx, 0xf
jbe 0x18003298b
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032986
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032986
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1801904ec
cmp qword [rbp - 0x39], 0x12
jb 0x1800330e6
lea r13, [rbp - 0x11]
cmp qword [rbp + 7], 0xf
cmova r13, r15
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x21], xmm1
lea r12, [r14 + 0x12]
mov rbx, rsi
lea rdi, [rbp - 0x31]
cmp r12, rbx
jbe 0x180032a4a
mov rbx, r12
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x180032a0c
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1801904b0
test rax, rax
je 0x180032aca
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180032a46
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180032a35
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800330ad
jmp 0x1800329ed
test rcx, rcx
je 0x180032a44
call fcn.1801904b0
mov rdi, rax
jmp 0x180032a46
xor edi, edi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], rbx
mov r8, r14
mov rdx, r13
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.StandHotkeys.txt]
movups xmmword [rdi + r14], xmm0
movzx eax, word [0x1801a38c0]
mov word [rdi + r14 + 0x10], ax
mov byte [rdi + r12], 0
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0xf
cmova rdx, qword [rbp - 0x31]
lea rcx, str.https:__thot.oo.xx_content_cdn_eXPjRNNivBeH.txt
call fcn.180033160
mov rdx, qword [rbp - 0x19]
cmp rdx, 0xf
jbe 0x180032ad6
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032ad1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032ad1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1801904ec
lea r13, [rbp - 0x11]
cmp qword [rbp + 7], 0xf
cmova r13, r15
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x21], xmm1
lea r12, [r14 + 0x10]
mov rbx, rsi
lea rdi, [rbp - 0x31]
cmp r12, rbx
jbe 0x180032b8a
mov rbx, r12
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x180032b4c
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1801904b0
test rax, rax
je 0x180032bfd
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180032b86
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180032b75
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800330b3
jmp 0x180032b2d
test rcx, rcx
je 0x180032b84
call fcn.1801904b0
mov rdi, rax
jmp 0x180032b86
xor edi, edi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], rbx
mov r8, r14
mov rdx, r13
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.StandStand.dll]
movups xmmword [rdi + r14], xmm0
mov byte [rdi + r12], 0
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0xf
cmova rdx, qword [rbp - 0x31]
lea rcx, str.https:__thot.1l.xx_content_cdn_VVIsTlXYdjZl.dll
call fcn.180033160
mov rdx, qword [rbp - 0x19]
cmp rdx, 0xf
jbe 0x180032c09
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032c04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032c04
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1801904ec
lea rax, [rbp - 0x11]
cmp qword [rbp + 7], 0xf
cmova rax, r15
mov qword [rbp - 0x49], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x21], xmm1
lea r13, [r14 + 0xf]
mov rbx, rsi
lea rdi, [rbp - 0x31]
cmp r13, rbx
jbe 0x180032cc9
mov rbx, r13
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x180032c87
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1801904b0
test rax, rax
je 0x180032daa
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rax, qword [rbp - 0x49]
jmp 0x180032cc5
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180032cb0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800330b9
jmp 0x180032c64
test rcx, rcx
je 0x180032cc3
call fcn.1801904b0
mov rdi, rax
mov rax, qword [rbp - 0x49]
jmp 0x180032cc5
xor edi, edi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x19], rbx
mov r8, r14
mov rdx, rax
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.StandProfiles]
movsd qword [rdi + r14], xmm0
mov eax, dword [0x1801a3948]
mov dword [rdi + r14 + 8], eax
movzx eax, word [0x1801a394c]
mov word [rdi + r14 + 0xc], ax
movzx eax, byte [0x1801a394e]
mov byte [rdi + r14 + 0xe], al
mov byte [rdi + r13], 0
mov rdi, qword [rbp - 0x21]
lea rbx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0xf
cmova rbx, qword [rbp - 0x31]
call fcn.18018fb68
mov qword [rbp - 0x49], rbx
mov qword [rbp - 0x41], rdi
lea r8, [rbp - 0x49]
mov edx, eax
lea rcx, [rbp + 0xf]
call fcn.18002e240
nop
mov dword [rbp - 0x49], 0
lea rax, [0x180244ca0]
mov qword [rbp - 0x41], rax
lea rdx, [rbp - 0x49]
lea rcx, [rbp + 0xf]
call fcn.180031800
cmp dword [rbp - 0x49], 0
jne 0x1800330ec
lea rcx, [rbp + 0xf]
call fcn.18002b2f0
nop
mov rdx, qword [rbp - 0x19]
cmp rdx, 0xf
jbe 0x180032db6
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032db1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032db1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1801904ec
cmp qword [rbp - 0x39], 0x18
jb 0x1800330a1
lea rax, [rbp - 0x11]
cmp qword [rbp + 7], 0xf
cmova rax, r15
mov qword [rbp - 0x39], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x21], xmm1
lea r13, [r14 + 0x18]
mov rbx, rsi
lea rdi, [rbp - 0x31]
cmp r13, rbx
jbe 0x180032e81
mov rbx, r13
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x180032e3f
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1801904b0
test rax, rax
je 0x180032f03
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rax, qword [rbp - 0x39]
jmp 0x180032e7d
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180032e68
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800330bf
jmp 0x180032e1c
test rcx, rcx
je 0x180032e7b
call fcn.1801904b0
mov rdi, rax
mov rax, qword [rbp - 0x39]
jmp 0x180032e7d
xor edi, edi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x19], rbx
mov r8, r14
mov rdx, rax
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.StandProfilesMain.txt]
movups xmmword [rdi + r14], xmm0
movsd xmm0, qword [0x1801a3960]
movsd qword [rdi + r14 + 0x10], xmm0
mov byte [rdi + r13], 0
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0xf
cmova rdx, qword [rbp - 0x31]
lea rcx, str.https:__thot.1l.xx_content_cdn_rtxDPdmlRZll.txt
call fcn.180033160
mov rdx, qword [rbp - 0x19]
cmp rdx, 0xf
jbe 0x180032f0f
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180032f0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180032f0a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1801904ec
lea rdi, [rbp - 0x11]
mov r13, qword [rbp + 7]
cmp r13, 0xf
cmova rdi, r15
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x21], xmm1
lea rbx, [rbp - 0x31]
cmp r12, 0xf
jbe 0x180032fc0
mov rsi, r12
or rsi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
jbe 0x180032f82
mov rsi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1801904b0
test rax, rax
je 0x18003302d
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x180032fbc
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x180032fab
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800330c5
jmp 0x180032f63
test rcx, rcx
je 0x180032fba
call fcn.1801904b0
mov rbx, rax
jmp 0x180032fbc
xor ebx, ebx
mov qword [rbp - 0x31], rbx
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], rsi
mov r8, r14
mov rdx, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.StandStand.dll]
movups xmmword [rbx + r14], xmm0
mov byte [rbx + r12], 0
lea rcx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0xf
cmova rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdx, qword [rbp - 0x19]
cmp rdx, 0xf
jbe 0x18003303a
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180033034
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180033034
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1801904ec
nop
cmp r13, 0xf
jbe 0x180033074
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x18003306c
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003306c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.1801904ec
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1801909d0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18002fbf0
nop
call fcn.18002f720
int3
call fcn.18002f720
int3
call fcn.18002f720
int3
call fcn.18002f720
int3
call fcn.18002f720
int3
call fcn.18002f720
int3
call fcn.18002fbf0
nop
lea r8, [rbp + 0xf]
lea rdx, [rbp - 0x49]
lea rcx, str.create_directories
call fcn.18002f790
nop
call fcn.18002fbf0
nop
lea r8, [rbp + 0xf]
lea rdx, [rbp - 0x49]
lea rcx, str.create_directories
call fcn.18002f790
int3