Function at 0x1400ea0a0
Capabilities:
Create process on windows
Query environment variable
Resume thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
movaps xmmword [rsp + 0x250], xmm6
mov r12, r8
mov r15, rdx
mov r14, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x248], rax
cmp byte [r8 + 0x21], 0
jne 0x1400ea6e9
movabs rbx, 0xaaaaaaaaaaaaaaaa
mov al, byte [0x140341290]
xor esi, esi
test al, 0x19
mov byte [rsp + 0x67], al
je 0x1400ea632
lea rdi, [rsp + 0x120]
mov rcx, rdi
call fcn.14007a620
call sub.KERNEL32.dll_GetCurrentThreadId
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rdi, [0x140341290]
lea r8, str.LaunchProcess
mov cl, 0x58
mov rdx, rdi
mov qword [rsp + 0x80], r8
xor r9d, r9d
call fcn.1401b9550
mov qword [rsp + 0x78], rax
lea r13, [rsp + 0x1b0]
mov qword [r13 + 0x10], rbx
movaps xmm6, xmmword [0x140301d60]
movaps xmmword [r13], xmm6
lea rdx, str.LaunchProcess
lea r8, str....._baseprocesslaunch_win.cc
lea rbp, [rsp + 0x120]
mov rcx, rbp
mov r9d, 0x125
call fcn.14004f270
lea r8, [0x140354540]
mov rcx, r13
mov rdx, rbp
call fcn.140145280
xorps xmm0, xmm0
movaps xmmword [rsp + 0x230], xmm0
mov dword [rsp + 0x19c], 0
mov qword [rbp + 0x70], rbx
movaps xmmword [rbp + 0x60], xmm6
movaps xmmword [rbp + 0x50], xmm6
movaps xmmword [rbp + 0x40], xmm6
movaps xmmword [rbp + 0x30], xmm6
movaps xmmword [rbp + 0x20], xmm6
movaps xmmword [rbp + 0x10], xmm6
movaps xmmword [rbp], xmm6
lea rcx, [rsp + 0x120]
call fcn.1400eabc0
cmp byte [r12 + 0x7a], 0
je 0x1400ea205
call fcn.14008daa0
xor esi, esi
cmp eax, 0x10
setge sil
movzx eax, byte [r12 + 0x7b]
add esi, eax
mov rcx, qword [r12 + 0x28]
xor r8d, r8d
cmp rcx, qword [r12 + 0x30]
setne r8b
add r8d, esi
movzx edx, byte [r12 + 0x7c]
add edx, r8d
je 0x1400ea74d
lea rcx, [rsp + 0x120]
call fcn.1400eadd0
test al, al
je 0x1400ea77c
mov al, byte [r12 + 0x7b]
mov ebx, 0x80000
mov dword [rsp + 0x11c], 2
test al, al
jne 0x1400ea754
cmp byte [r12 + 0x7a], 0
je 0x1400ea2a1
call fcn.14008daa0
cmp eax, 0x10
jl 0x1400ea2a1
lea r8, [rsp + 0x230]
or byte [r8 + 0xb], 0x20
lea rcx, [rsp + 0x120]
mov edx, 0x20007
mov r9d, 0x10
call fcn.1400eab50
test al, al
je 0x1400ea77c
mov qword [rsp + 0x68], rdi
cmp byte [r12 + 0x7c], 0
jne 0x1400ea78f
mov rsi, qword [r12 + 0x28]
mov rdi, qword [r12 + 0x30]
cmp rsi, rdi
mov qword [rsp + 0x70], r14
je 0x1400ea7c3
mov rax, rdi
sub rax, rsi
mov ecx, 0xfffffff8
cmp rax, rcx
ja 0x1400ea68d
mov r14, qword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea r13, str....._baseprocesslaunch_win.cc
lea rbp, [rsp + 0x110]
mov rcx, qword [rsi]
mov edx, 1
mov r8d, 1
call r14
test eax, eax
je 0x1400ea66f
add rsi, 8
cmp rsi, rdi
jne 0x1400ea2f4
mov r8, qword [r12 + 0x28]
mov r9, qword [r12 + 0x30]
cmp r9, r8
je 0x1400ea7d2
sub r9d, r8d
and r9d, 0xfffffff8
lea rcx, [rsp + 0x120]
mov edx, 0x20002
call fcn.1400eab50
mov dil, 1
test al, al
je 0x1400ea68d
cmp byte [r12 + 0x22], 0
jne 0x1400ea7fe
cmp byte [r12 + 0x50], 0
jne 0x1400ea80b
mov eax, dword [rsp + 0x164]
mov ecx, eax
or ecx, 1
mov dword [rsp + 0x164], ecx
mov edx, dword [r12 + 0x40]
test edx, edx
jne 0x1400ea81f
movzx ecx, byte [r12 + 0x20]
xor ecx, 1
mov word [rsp + 0x168], cx
mov rcx, qword [r12 + 0x60]
mov rdx, qword [r12 + 0x68]
mov r8, qword [r12 + 0x70]
test rcx, rcx
jne 0x1400ea646
test rdx, rdx
jne 0x1400ea646
test r8, r8
jne 0x1400ea646
cmp qword [r12 + 0x58], 0
jne 0x1400ea848
mov esi, ebx
or esi, 0x1000000
cmp byte [r12 + 0x78], 0
cmove esi, ebx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x100], 0
movzx eax, byte [r12 + 0x1f]
test al, al
jns 0x1400ea40a
mov rax, qword [r12 + 0x10]
mov rbx, qword [r12 + 8]
jmp 0x1400ea412
lea rbx, [r12 + 8]
and eax, 0x7f
test rax, rax
cmove rbx, rax
movabs rbp, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xe0], rbp
movaps xmmword [rsp + 0xd0], xmm6
cmp byte [r15 + 0x17], 0
jns 0x1400ea860
mov rdx, qword [r15]
mov r8, qword [r15 + 8]
lea rcx, [rsp + 0xd0]
call fcn.14004da58
cmp byte [r12 + 0x7d], 0
jne 0x1400ea87d
xor r13d, r13d
lea r14, [rsp + 0x128]
mov rdx, qword [r12 + 0x48]
test rdx, rdx
jne 0x1400ea896
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1d0], xmm0
mov qword [rsp + 0x1e0], 0
mov al, byte [r12 + 0x98]
test al, al
jne 0x1400ea6aa
cmp qword [r12 + 0x90], 0
jne 0x1400ea6aa
xor eax, eax
movzx ecx, dil
cmp byte [rsp + 0xe7], 0
jns 0x1400ea4c7
mov rdx, qword [rsp + 0xd0]
jmp 0x1400ea4cf
lea rdx, [rsp + 0xd0]
lea r8, [rsp + 0xf0]
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ecx
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400eaa49
cmp byte [rsp + 0x1e7], 0
js 0x1400ea8e2
mov r14, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
lea rcx, [rsp + 0xb0]
mov qword [rcx + 0x10], rbp
movaps xmmword [rcx], xmm6
lea rdx, [rsp + 0xf0]
call fcn.1400eab90
test r13, r13
je 0x1400ea54e
cmp byte [r12 + 0x7d], 0
jne 0x1400eaa7f
mov rcx, qword [r12 + 0x58]
test rcx, rcx
jne 0x1400ea8f4
cmp byte [r12 + 0x79], 0
jne 0x1400ea955
cmp byte [r12], 0
jne 0x1400ea96f
mov edx, dword [rsp + 0xc0]
mov rcx, qword [0x140352ad8]
test rcx, rcx
jne 0x1400ea9eb
lea rcx, [rsp + 0xb0]
call fcn.1400eac00
mov rcx, r14
mov rdx, rax
call fcn.14008dc10
mov bl, byte [rsp + 0x67]
lea rcx, [rsp + 0xb0]
call fcn.1400eac70
cmp byte [rsp + 0xe7], 0
jns 0x1400ea5ca
mov rcx, qword [rsp + 0xd0]
call fcn.14016eccc
lea rcx, [rsp + 0x120]
call fcn.1400eac30
lea rcx, [rsp + 0x1b0]
call fcn.140073380
test bl, 0x19
je 0x1400ea603
cmp byte [rdi], 0
je 0x1400ea603
mov rcx, rdi
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x78]
call fcn.1401b32b0
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.140171860
mov rax, r14
movaps xmm6, xmmword [rsp + 0x250]
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbx
xor edi, edi
jmp 0x1400ea15e
or eax, 0x101
mov dword [rsp + 0x164], eax
mov qword [rsp + 0x178], rcx
mov qword [rsp + 0x180], rdx
mov qword [rsp + 0x188], r8
jmp 0x1400ea3c0
mov rcx, rbp
mov rdx, r13
mov r8d, 0x180
call fcn.140226570
mov rcx, rbp
call fcn.1402265a0
jmp 0x1400ea30d
mov r14, qword [rsp + 0x70]
mov rcx, r14
xor edx, edx
call fcn.14008dc10
mov bl, byte [rsp + 0x67]
mov rdi, qword [rsp + 0x68]
jmp 0x1400ea5ca
test al, al
je 0x1400eaa0b
lea r8, [r12 + 0x80]
lea rdx, [0x14030a4d6]
lea rcx, [rsp + 0x1d0]
call fcn.140226620
cmp byte [rsp + 0x1e7], 0
jns 0x1400ea9f8
mov rax, qword [rsp + 0x1d0]
jmp 0x1400eaa00
mov bl, byte [r12]
mov dil, byte [r12 + 0x20]
movzx eax, byte [r15 + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [r15]
cmovns rax, r15
lea rdx, [rsp + 0x1a0]
mov qword [rdx], rax
cmovs rcx, qword [r15 + 8]
mov qword [rdx + 8], rcx
mov rsi, r14
lea r14, [rsp + 0x120]
mov rcx, r14
call fcn.140127620
mov rcx, rsi
mov rdx, r14
mov r8d, edi
mov r9d, ebx
call fcn.1402112d0
mov rcx, r14
mov r14, rsi
call fcn.1400c4d70
jmp 0x1400ea603
xor ebx, ebx
jmp 0x1400ea24f
lea rcx, [rsp + 0x120]
lea r8, [rsp + 0x11c]
mov edx, 0x20012
mov r9d, 4
call fcn.1400eab50
test al, al
jne 0x1400ea262
mov rcx, r14
xor edx, edx
call fcn.14008dc10
mov bl, byte [rsp + 0x67]
jmp 0x1400ea5ca
lea r8, [rsp + 0x19c]
mov dword [r8], 1
lea rcx, [rsp + 0x120]
mov edx, 0x2001c
mov r9d, 4
call fcn.1400eab50
test al, al
jne 0x1400ea2b2
jmp 0x1400ea692
cmp dword [r12 + 0x24], 1
sete dil
jmp 0x1400ea34d
lea rax, str.vector___index_out_of_bounds
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude_vector
lea r9, str.__n___size__
mov r8d, 0x591
call fcn.1401c469a
or byte [rsp + 0x164], 0x80
jmp 0x1400ea359
lea rax, [0x1403026a2]
mov qword [rsp + 0x138], rax
jmp 0x1400ea365
mov cx, 0xa
add edx, 0xfffffffe
cmp edx, 3
ja case.default.0x1400ea83d
lea rcx, [0x1400eab3c]
movsxd rdx, dword [rcx + rdx*4]
add rdx, rcx
jmp rdx
mov cx, 1
jmp case.default.0x1400ea83d
call fcn.14008daa0
lea ecx, [rbx + 0x1000000]
cmp eax, 5
cmovge ecx, ebx
mov ebx, ecx
jmp 0x1400ea3cc
mov rax, qword [r15 + 0x10]
mov qword [rsp + 0xe0], rax
movups xmm0, xmmword [r15]
movaps xmmword [rsp + 0xd0], xmm0
jmp 0x1400ea452
call fcn.1402265c0
test rax, rax
je 0x1400eaaa7
mov r13, rax
or esi, 4
jmp 0x1400ea461
lea rcx, [rsp + 0x1d0]
mov qword [rcx], 0
xor r8d, r8d
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x1400eab0e
or esi, 0x400
mov rdx, qword [rsp + 0x1d0]
movzx eax, dil
cmp byte [rsp + 0xe7], 0
jns 0x1400eaab2
mov r8, qword [rsp + 0xd0]
jmp 0x1400eaaba
mov rcx, qword [rsp + 0x1d0]
call fcn.14016eccc
jmp 0x1400ea517
mov rdx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x1400ea55c
lea r15, [rsp + 0x1d0]
movaps xmmword [r15], xmm6
lea rcx, [rsp + 0xb0]
call fcn.1400eac00
mov rcx, r15
mov rdx, rax
call fcn.14008dc10
mov rcx, r15
mov edx, 1
mov r8b, 1
call fcn.14003b6b0
mov rcx, r14
xor edx, edx
call fcn.14008dc10
mov rcx, r15
call fcn.140067b30
jmp 0x1400ea5a2
mov rcx, qword [rsp + 0xb0]
call fcn.14012f7e0
mov ecx, eax
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
jmp 0x1400ea568
lea r12, [rsp + 0x1d0]
mov qword [r12 + 0x50], rbp
movaps xmmword [r12 + 0x40], xmm6
movaps xmmword [r12 + 0x30], xmm6
movaps xmmword [r12 + 0x20], xmm6
movaps xmmword [r12 + 0x10], xmm6
movaps xmmword [r12], xmm6
lea rdx, str.LaunchProcess
lea r8, str....._baseprocesslaunch_win.cc
lea r13, [rsp + 0x90]
mov rcx, r13
mov r9d, 0x21f
call fcn.14004f270
mov rcx, r12
mov rdx, r13
xor r8d, r8d
call fcn.1400cd290
mov rcx, qword [rsp + 0xb0]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r12
call fcn.1400cd300
jmp 0x1400ea573
mov r8, r15
call fcn.140208a70
jmp 0x1400ea58a
lea rax, [rsp + 0x1d0]
or esi, 0x400
jmp 0x1400ea4af
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x1400eaa49
mov rdx, rax
lea r8, [r12 + 0x80]
lea rcx, [rsp + 0x1d0]
mov qword [rsp + 0x88], rax
call fcn.140226620
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400ea6ce
mov rcx, qword [rsp + 0x70]
xor edx, edx
call fcn.14008dc10
cmp byte [rsp + 0x1e7], 0
jns 0x1400eaa6c
mov rcx, qword [rsp + 0x1d0]
call fcn.14016eccc
mov r14, qword [rsp + 0x70]
mov bl, byte [rsp + 0x67]
mov rdi, qword [rsp + 0x68]
jmp 0x1400ea5b3
mov ecx, dword [rsp + 0xc0]
mov edx, 4
mov rax, r13
call qword [case.0x140211850.0]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1400ea54e
or esi, 0x8000
jmp 0x1400ea45e
lea r8, [rsp + 0xd0]
mov rcx, qword [r12 + 0x48]
lea r9, [rsp + 0xf0]
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], 0
xor edx, edx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
mov rcx, qword [rsp + 0x1d0]
call sub.USERENV.dll_DestroyEnvironmentBlock
test esi, esi
jne 0x1400ea517
mov r14, qword [rsp + 0x70]
mov rcx, r14
xor edx, edx
call fcn.14008dc10
jmp 0x1400eaa71
mov cx, 2
jmp case.default.0x1400ea83d
mov cx, 7
jmp case.default.0x1400ea83d
xor ecx, ecx
jmp case.default.0x1400ea83d