Function at 0x140007af0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov r13, rcx
xor edi, edi
mov dword [rsp + 0x68], edi
mov rcx, r8
call fcn.140024370
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140008338
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea r15, str.eSBfbm4gHjgeeSAjdXEgHjgeeSBjdmNhXW5wbWVwX2tdcGNxc2pyIB44HnkgcXJfcnNxIB44HiNie3t7ew
mov rdx, r15
lea rcx, [rsp + 0x50]
call fcn.140031e00
lea r14, [rdi - 1]
test al, al
jne 0x140007b9c
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [r15 + rax*2], 0
jne 0x140007b80
mov r8d, eax
mov rdx, r15
lea rcx, [rsp + 0x50]
call fcn.140032190
nop
mov r8d, 0x104
lea rdx, [rbp + 0x30]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
mov r15, qword [rbp + 0x2a0]
cmp eax, 0x103
ja 0x14000827b
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rdi
mov r9, qword [r12]
lea r8, [rbp + 0x30]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
cmp ebx, 0x20
ja 0x140007c74
mov rcx, qword [r15]
mov edx, dword [rcx - 0x10]
test edx, edx
je 0x140007c6f
mov qword [rbp - 0x10], rdi
movdqa xmm0, xmmword [0x1401f49f0]
movdqu xmmword [rbp], xmm0
mov word [rbp - 0x10], di
mov dword [rsp + 0x68], 2
jle 0x140007c52
mov rbx, rdi
test rbx, rbx
js 0x140008343
cmp edi, dword [rcx - 0x10]
jg 0x140008343
movzx edx, word [rcx + rbx]
lea rcx, [rbp - 0x10]
call fcn.14004af90
inc edi
add rbx, 2
mov rcx, qword [r15]
cmp edi, dword [rcx - 0x10]
jl 0x140007c25
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rcx, qword [rbp - 0x10]
call fcn.1400703c0
nop
lea rcx, [rbp - 0x10]
call fcn.140031830
xor r12b, r12b
jmp 0x140007c77
mov r12b, 1
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x14000834e
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp - 0x70], rax
mov rdi, qword [rbp + 0x288]
mov rbx, qword [rdi]
mov rcx, qword [rsp + 0x50]
add rcx, 0xffffffffffffffe8
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 0x78], rax
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x40]
call fcn.14004beb0
nop
movzx r9d, r12b
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rbp - 0x70]
call fcn.140025c80
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140007cf6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, rdi
lea rcx, [0x140223358]
call fcn.140023be0
mov ebx, dword [rax]
mov rdi, qword [r13 + 0x68]
mov r13, qword [rbp - 0x70]
lea rcx, [r13 - 0x18]
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 0x68], rax
mov r8d, ebx
lea rdx, [rbp - 0x68]
mov rcx, rdi
call fcn.14006cf00
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140008359
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rbx, str.Y3ZjYV1ha2I
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140031e00
test al, al
jne 0x140007d8b
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140007d70
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140008364
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rbx, str.dWxiXWxfa2M7I3EkcXJfcmM7I3VxJGN2Y2FdYW1iYzsjYiRha2I7I3Vx
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140031e00
test al, al
jne 0x140007de1
mov rax, r14
inc rax
cmp word [rbx + rax*2], 0
jne 0x140007dc6
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x14000836f
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rbx, str.cXNhYWNxcQ
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140031e00
test al, al
jne 0x140007e3b
mov rax, r14
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140007e20
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x14000837a
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rbx, str.Y3BwbXA
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140031e00
test al, al
jne 0x140007e91
mov rax, r14
inc rax
cmp word [rbx + rax*2], 0
jne 0x140007e76
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140008385
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp - 0x80], rax
lea rbx, str.bnBtYnNhcg
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.140031e00
test al, al
jne 0x140007eea
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140007ed0
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140008390
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov rdx, rsi
lea rcx, [rbp + 0x10]
call fcn.140032510
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140033170
nop
mov rsi, qword [rax]
mov rcx, qword [rsp + 0x40]
test r12b, r12b
cmovne rcx, qword [rsp + 0x48]
sub rcx, 0x18
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x30]
call fcn.14004beb0
nop
mov rbx, qword [rax]
mov rdi, qword [rbp + 0x288]
mov rdi, qword [rdi]
mov r12, qword [rsp + 0x70]
lea rcx, [r12 - 0x18]
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x38]
call fcn.14004beb0
nop
mov qword [rsp + 0x28], rsi
mov ecx, dword [rsp + 0x30]
mov dword [rsp + 0x20], ecx
mov r9, rbx
mov r8, rdi
mov rdx, qword [rax]
lea rcx, [rsp + 0x58]
call fcn.140025c80
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140007fc5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140007fe4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140008002
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x14000839b
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rbx, [0x1401e3cf8]
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140031e00
test al, al
jne 0x14000805b
mov rax, r14
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140008040
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x14000832d
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140031e00
test al, al
jne 0x1400080ab
mov rax, r14
nop
inc rax
cmp word [rbx + rax*2], 0
jne 0x140008090
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140032190
nop
mov rsi, qword [rsp + 0x78]
lea rcx, [rsi - 0x18]
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 0x50], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x18]
call fcn.14004beb0
mov rbx, rax
mov rdi, qword [rbp - 0x80]
lea rcx, [rdi - 0x18]
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x20]
call fcn.14004beb0
nop
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x58]
mov rdx, rbx
mov rcx, rax
call fcn.140061650
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140008133
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140008152
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140008172
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140008192
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400081b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, r14d
lock xadd dword [rdi - 8], eax
sub eax, 1
jg 0x1400081ce
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400081ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000820e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, r14d
lock xadd dword [r12 - 8], eax
sub eax, 1
jg 0x14000822e
mov rcx, qword [r12 - 0x18]
mov rax, qword [rcx]
lea rdx, [r12 - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, r14d
lock xadd dword [rsi - 8], eax
sub eax, 1
jg 0x14000824a
mov rcx, qword [rsi - 0x18]
mov rax, qword [rcx]
lea rdx, [rsi - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, r14d
lock xadd dword [r13 - 8], eax
sub eax, 1
jg 0x140008266
mov rcx, qword [r13 - 0x18]
mov rax, qword [rcx]
lea rdx, [r13 - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r12, qword [rbp + 0x298]
mov rbx, qword [rbp + 0x288]
mov rsi, qword [rbp + 0x290]
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000829b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400082b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400082d7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400082f6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r15]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140008312
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x380]
add rsp, 0x340
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80070057
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
int3