Function at 0x14001f02c
Capabilities:
Check if file exists
Create process on windows
Query environment variable
Terminate process

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x260
mov qword [r11 - 0xf8], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x140065010]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r12, r8
mov r15, rdx
mov r13, rcx
xor edx, edx
lea r8d, [rdx + 0x20]
lea rcx, [r11 - 0x188]
call fcn.1400280e0
xor esi, esi
cmp qword [r15], rsi
je 0x14001f662
lea rdx, [rsp + 0x100]
mov rcx, qword [r15]
call fcn.140025ef8
test al, al
je 0x14001f117
mov rbx, qword [rsp + 0x118]
mov rdx, rbx
lea rcx, str..VSINSTR
call fcn.140025e6c
test al, al
jne 0x14001f0dd
mov rdx, rbx
lea rcx, str..vscov
call fcn.140025e6c
test al, al
jne 0x14001f0dd
mov rdx, rbx
lea rcx, str..vscovmp
call fcn.140025e6c
test al, al
mov bl, sil
je 0x14001f0df
mov bl, 1
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test bl, bl
je 0x14001f117
mov eax, 0xe123058c
jmp 0x14001f667
cmp qword [r15], rsi
je 0x14001f662
mov rbx, qword [r15 + 8]
test rbx, rbx
je 0x14001f662
mov edi, 0x68
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0x1a0]
call fcn.1400280e0
mov dword [rsp + 0x1a0], edi
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rbx + rdx*2], si
jne 0x14001f14f
cmp rdx, 0x7fffffff
jb 0x14001f16b
mov eax, 0x80070057
jmp 0x14001f667
inc rdx
lea rcx, [rsp + 0x78]
call fcn.14000301c
nop
mov rdx, qword [rsp + 0x80]
sub rdx, qword [rsp + 0x78]
sar rdx, 1
mov r8, qword [r15 + 8]
mov rcx, qword [rsp + 0x78]
call fcn.140001278
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rbx, rax
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140012650
nop
test rbx, rbx
je 0x14001f1bf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea rdi, [0x140053cbc]
mov r8, rdi
lea rdx, [0x140053cc0]
lea rcx, [rsp + 0x90]
call fcn.1400129c4
lea r8, [0x140053c50]
lea rdx, str.COR_PROFILER
lea rcx, [rsp + 0x90]
call fcn.1400129c4
mov r8, qword [r15 + 0x20]
test r8, r8
je 0x14001f215
lea rdx, str.COR_PROF_TARGETCLRVERSION
lea rcx, [rsp + 0x90]
call fcn.1400129c4
call fcn.140001424
mov rcx, rax
test rax, rax
jne 0x14001f22d
mov ecx, 0x80004005
call fcn.140003cb0
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x58]
mov rcx, r13
call fcn.140020370
mov rbx, qword [rsp + 0x58]
mov r8, rbx
lea rdx, str.COR_PROFILER_PATH
lea rcx, [rsp + 0x90]
call fcn.1400129c4
mov r8, rdi
lea rdx, str.CORECLR_ENABLE_PROFILING
lea rcx, [rsp + 0x90]
call fcn.1400129c4
lea r8, [0x140053c50]
lea rdx, str.CORECLR_PROFILER
lea rcx, [rsp + 0x90]
call fcn.1400129c4
cmp dword [r13 + 0x48], 2
ja 0x14001f2f3
mov dword [rsp + 0x210], 0x30
xor edx, edx
lea r8d, [rdx + 0x3c]
lea rcx, [rsp + 0x214]
call fcn.1400280e0
mov r9d, 0xa
lea r8d, [r9 + 0x16]
lea rdx, [rsp + 0x210]
mov ecx, dword [r13 + 0x48]
call fcn.1400390d0
lea r8, [rsp + 0x210]
lea rdx, str.COR_GC_PROFILING
lea rcx, [rsp + 0x90]
call fcn.1400129c4
lea rdx, str.COR_LINE_PROFILING
lea rcx, [rsp + 0x90]
cmp dword [r13 + 0x50], esi
mov r8, rdi
jne 0x14001f312
lea r8, [0x140053de4]
call fcn.1400129c4
mov rdx, qword [r15 + 0x18]
lea rcx, [rsp + 0x120]
call fcn.140012650
nop
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x90]
call fcn.140012a68
call fcn.140021614
mov eax, dword [r15 + 0x28]
neg eax
sbb edi, edi
and edi, 0x10
add edi, 0x4000400
lea rcx, [rsp + 0x90]
call fcn.140012bd4
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x1a0]
mov qword [rsp + 0x40], rcx
mov rcx, qword [r15 + 0x10]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14001f51f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x14001f4d0
cmp eax, 3
jbe 0x14001f481
cmp eax, 0xbd
jbe 0x14001f4d0
cmp eax, 0xc1
jbe 0x14001f432
cmp eax, 0x2e4
jne 0x14001f4d0
mov edi, 0x800702e4
lea rcx, [rsp + 0x140]
call fcn.140013154
nop
lea rcx, [rsp + 0x120]
call fcn.140003350
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001f41f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rsp + 0xb0]
call fcn.140013154
nop
jmp 0x14001f5cc
lea rcx, [rsp + 0x140]
call fcn.140013154
nop
lea rcx, [rsp + 0x120]
call fcn.140003350
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001f469
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rsp + 0xb0]
call fcn.140013154
nop
mov edi, 0xe123058b
jmp 0x14001f5cc
lea rcx, [rsp + 0x140]
call fcn.140013154
nop
lea rcx, [rsp + 0x120]
call fcn.140003350
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001f4b8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rsp + 0xb0]
call fcn.140013154
nop
mov edi, 0xe123058a
jmp 0x14001f5cc
lea rcx, [rsp + 0x140]
call fcn.140013154
nop
lea rcx, [rsp + 0x120]
call fcn.140003350
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001f507
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rsp + 0xb0]
call fcn.140013154
nop
mov edi, 0x80004005
jmp 0x14001f5cc
mov dword [0x140067d48], 1
test r12, r12
je 0x14001f536
mov eax, dword [rsp + 0x70]
mov dword [r12], eax
mov r9, qword [r15]
xor r8d, r8d
mov edx, dword [rsp + 0x70]
mov rcx, r13
call fcn.14001e918
mov dword [rsp + 0x50], eax
jmp 0x14001f555
cmp dword [rsp + 0x50], esi
jge 0x14001f5e8
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x140]
call fcn.140013154
nop
lea rcx, [rsp + 0x120]
call fcn.140003350
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001f5ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rsp + 0xb0]
call fcn.140013154
nop
mov edi, dword [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.140003350
nop
lea rcx, [rsp + 0x78]
call fcn.140003350
mov eax, edi
jmp 0x14001f667
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x140]
call fcn.140013154
nop
lea rcx, [rsp + 0x120]
call fcn.140003350
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001f636
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rsp + 0xb0]
call fcn.140013154
nop
lea rcx, [rsp + 0x90]
call fcn.140003350
nop
lea rcx, [rsp + 0x78]
call fcn.140003350
mov eax, dword [rsp + 0x50]
jmp 0x14001f667
mov eax, 0x80004005
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140026390
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x260
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret