Function at 0x1400198d0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x1400b1008]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, rdx
movaps xmmword [rsp + 0x2b0], xmm6
mov rbx, rcx
xor edx, edx
lea rcx, [rbp + 0x30]
mov r8d, 0x170
call fcn.140068930
xor esi, esi
mov dword [rbp + 0x50], 1
mov r13, 0xffffffffffffffff
mov dword [rbp + 0x60], esi
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xb0], r13
mov qword [rbp + 0x88], rbx
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0x188], rsi
mov qword [rbp + 0x190], rsi
mov qword [rbp + 0x198], rsi
cmp dword [rbp + 0x70], esi
jne 0x1400199f5
cmp dword [rbp + 0xb8], 1
je 0x14001999e
lea rcx, [rbp + 0x30]
call fcn.14000f100
test al, al
jne 0x14001999e
mov rax, qword [rbp + 0x38]
neg rax
sbb edx, edx
add edx, 3
cmp dword [rbp + 0x70], esi
jne 0x1400199f5
mov rax, qword [rbp + 0x30]
mov dword [rbp + 0x70], edx
test rax, rax
je 0x1400199cc
lea rcx, [rbp + 0x30]
call rax
jmp 0x1400199c8
lea rcx, [rbp + 0x30]
call fcn.14000f000
test al, al
jne 0x1400199be
cmp dword [rbp + 0x70], esi
jne 0x1400199f5
mov rax, qword [rbp + 0x38]
neg rax
sbb edx, edx
add edx, 3
jmp 0x14001998a
mov dword [rbp + 0xb8], 2
mov rax, qword [rbp + 0x30]
cmp dword [rbp + 0x70], esi
jne 0x1400199f5
cmp dword [rbp + 0xb8], 2
je 0x140019a61
mov dword [rbp + 0x70], 8
test rax, rax
je 0x1400199f5
mov edx, 8
lea rcx, [rbp + 0x30]
call rax
lea rax, [rbp + 0x50]
lea rbx, [rbp + 0x30]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
movaps xmm6, xmmword [rsp + 0x30]
mov edx, 2
movdqa xmmword [rsp + 0x30], xmm6
lea rcx, [rsp + 0x30]
call fcn.14000f2f0
test rax, rax
jne 0x140019a48
cmp dword [rbx + 0x40], esi
jne 0x140019a44
mov rax, qword [rbx]
mov dword [rbx + 0x40], 9
test rax, rax
je 0x140019a44
mov edx, 9
mov rcx, rbx
call rax
lea rax, [rbp + 0x50]
cmp dword [rbx + 0x40], esi
jne 0x140019aa0
cmp dword [rax], 7
jne 0x140019a87
mov rdi, qword [rbx + 0x58]
add rdi, qword [rax + 8]
mov qword [rsp + 0x48], rdi
jmp 0x140019aa5
mov rax, qword [rbp + 0x180]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x38], rax
movaps xmm6, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x30], xmm6
mov rbx, qword [rsp + 0x38]
jmp 0x140019a0c
mov dword [rbx + 0x40], 5
mov rax, qword [rbx]
test rax, rax
je 0x140019aa0
mov edx, 5
mov rcx, rbx
call rax
mov qword [rsp + 0x48], rsi
mov edx, 2
movdqa xmmword [rsp + 0x30], xmm6
lea rcx, [rsp + 0x30]
call fcn.14000f2f0
test rax, rax
jne 0x140019ae1
cmp dword [rbx + 0x40], esi
jne 0x140019add
mov rax, qword [rbx]
mov dword [rbx + 0x40], 9
test rax, rax
je 0x140019add
mov edx, 9
mov rcx, rbx
call rax
lea rax, [rbx + 0x20]
mov qword [rsp + 0x2f0], r12
cmp dword [rbx + 0x40], esi
jne 0x140019b12
cmp dword [rax], 7
jne 0x140019af9
mov r12d, dword [rax + 4]
jmp 0x140019b15
mov dword [rbx + 0x40], 5
mov rax, qword [rbx]
test rax, rax
je 0x140019b12
mov edx, 5
mov rcx, rbx
call rax
mov r12, rsi
mov edx, 3
mov qword [rsp + 0x40], r12
lea rcx, [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm6
call fcn.14000f2f0
test rax, rax
jne 0x140019b56
cmp dword [rbx + 0x40], esi
jne 0x140019b52
mov rax, qword [rbx]
mov dword [rbx + 0x40], 9
test rax, rax
je 0x140019b52
mov edx, 9
mov rcx, rbx
call rax
lea rax, [rbx + 0x20]
cmp dword [rbx + 0x40], esi
jne 0x140019b88
cmp dword [rax], 7
jne 0x140019b6f
mov rdi, qword [rax + 8]
add rdi, qword [rbx + 0x58]
mov qword [rsp + 0x30], rdi
jmp 0x140019b8d
mov dword [rbx + 0x40], 5
mov rax, qword [rbx]
test rax, rax
je 0x140019b88
mov edx, 5
mov rcx, rbx
call rax
mov qword [rsp + 0x30], rsi
mov edx, 3
movdqa xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x50]
call fcn.14000f2f0
test rax, rax
jne 0x140019bc9
cmp dword [rbx + 0x40], esi
jne 0x140019bc5
mov rax, qword [rbx]
mov dword [rbx + 0x40], 9
test rax, rax
je 0x140019bc5
mov edx, 9
mov rcx, rbx
call rax
lea rax, [rbx + 0x20]
mov qword [rsp + 0x2f8], r14
cmp dword [rbx + 0x40], esi
jne 0x140019bfa
cmp dword [rax], 7
jne 0x140019be1
mov r14d, dword [rax + 4]
jmp 0x140019bfd
mov dword [rbx + 0x40], 5
mov rax, qword [rbx]
test rax, rax
je 0x140019bfa
mov edx, 5
mov rcx, rbx
call rax
mov r14, rsi
mov edx, 4
mov qword [rsp + 0x50], r14
lea rcx, [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm6
call fcn.14000f2f0
test rax, rax
jne 0x140019c3e
cmp dword [rbx + 0x40], esi
jne 0x140019c3a
mov rax, qword [rbx]
mov dword [rbx + 0x40], 9
test rax, rax
je 0x140019c3a
mov edx, 9
mov rcx, rbx
call rax
lea rax, [rbx + 0x20]
mov qword [rsp + 0x300], r15
cmp dword [rbx + 0x40], esi
jne 0x140019c73
cmp dword [rax], 7
jne 0x140019c5a
mov r15, qword [rax + 8]
add r15, qword [rbx + 0x58]
jmp 0x140019c76
mov dword [rbx + 0x40], 5
mov rax, qword [rbx]
test rax, rax
je 0x140019c73
mov edx, 5
mov rcx, rbx
call rax
mov r15, rsi
mov edx, 4
movdqa xmmword [rsp + 0x60], xmm6
lea rcx, [rsp + 0x60]
call fcn.14000f2f0
test rax, rax
jne 0x140019cb2
cmp dword [rbx + 0x40], esi
jne 0x140019cae
mov rax, qword [rbx]
mov dword [rbx + 0x40], 9
test rax, rax
je 0x140019cae
mov edx, 9
mov rcx, rbx
call rax
lea rax, [rbx + 0x20]
cmp dword [rbx + 0x40], esi
jne 0x140019cda
cmp dword [rax], 7
jne 0x140019cc1
mov edi, dword [rax + 4]
jmp 0x140019cdd
mov dword [rbx + 0x40], 5
mov rax, qword [rbx]
test rax, rax
je 0x140019cda
mov edx, 5
mov rcx, rbx
call rax
mov rdi, rsi
mov edx, 5
movdqa xmmword [rsp + 0x60], xmm6
lea rcx, [rsp + 0x60]
call fcn.14000f2f0
movaps xmm6, xmmword [rsp + 0x2b0]
test rax, rax
jne 0x140019d21
cmp dword [rbx + 0x40], esi
jne 0x140019d1d
mov rax, qword [rbx]
mov dword [rbx + 0x40], 9
test rax, rax
je 0x140019d1d
mov edx, 9
mov rcx, rbx
call rax
lea rax, [rbx + 0x20]
cmp dword [rbx + 0x40], esi
jne 0x140019d4e
cmp dword [rax], 2
jne 0x140019d35
movzx eax, byte [rax + 8]
mov byte [rsp + 0x20], al
jmp 0x140019d53
mov dword [rbx + 0x40], 5
mov rax, qword [rbx]
test rax, rax
je 0x140019d4e
mov edx, 5
mov rcx, rbx
call rax
mov byte [rsp + 0x20], sil
cmp byte [rbp + 0xf8], sil
je 0x140019d76
mov rcx, qword [rbp + 0xe8]
call fcn.14006ac0c
mov qword [rbp + 0xe8], rsi
mov byte [rbp + 0xf8], sil
mov rcx, qword [rbp + 0x198]
test rcx, rcx
je 0x140019d92
mov rbx, qword [rcx]
call fcn.14006ac0c
mov rcx, rbx
test rbx, rbx
jne 0x140019d82
mov rcx, qword [rbp + 0x78]
mov qword [rbp + 0x198], rsi
test rcx, rcx
je 0x140019da7
call fcn.14006ac0c
mov rax, qword [rbp + 0x40]
test rax, rax
je 0x140019db6
lea rcx, [rbp + 0x30]
call rax
mov qword [rbp + 0x40], rsi
cmp dword [rbp + 0x70], esi
jne 0x140019fa8
mov rcx, r12
mov edx, 1
add rcx, 1
cmovb rcx, r13
call fcn.14006bdc8
mov r12, rax
test rax, rax
je 0x140019fa8
mov rcx, r14
mov edx, 1
add rcx, 1
cmovb rcx, r13
call fcn.14006bdc8
mov r13, rax
test rax, rax
je 0x140019fa0
mov rax, 0xffffffffffffffff
mov rcx, rdi
add rcx, 1
cmovb rcx, rax
lea edx, [rax + 2]
call fcn.14006bdc8
mov r14, rax
test rax, rax
je 0x140019f98
mov r8, qword [rsp + 0x40]
mov rcx, r12
mov rdx, qword [rsp + 0x48]
call fcn.140068bd0
mov r8, qword [rsp + 0x50]
mov rcx, r13
mov rdx, qword [rsp + 0x30]
call fcn.140068bd0
mov r8, rdi
mov rdx, r15
mov rcx, r14
call fcn.140068bd0
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ebx, eax
mov dword [rsp + 0x40], ebx
test eax, eax
je 0x140019f90
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov r15d, eax
test eax, eax
je 0x140019f90
mov ecx, ebx
call fcn.14006bdc0
mov rbx, rax
test rax, rax
je 0x140019f90
mov ecx, r15d
call fcn.14006bdc0
mov rdi, rax
test rax, rax
je 0x140019f88
mov r8d, dword [rsp + 0x40]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x140019f80
mov r8d, r15d
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x140019f80
xorps xmm0, xmm0
mov qword [rsp + 0x7c], rsi
lea rcx, [rsp + 0x70]
movdqa xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x7c], rsi
mov qword [rbp - 0x74], rsi
mov dword [rbp - 0x6c], esi
mov qword [rbp - 0x68], 3
mov qword [rbp - 0x58], rsi
mov qword [rsp + 0x70], r12
mov dword [rsp + 0x78], 1
mov qword [rbp - 0x60], rbx
call fcn.1400140c0
cmp byte [rbp - 0x44], sil
je 0x140019f80
cmp dword [rbp - 0x48], 0xc8
jne 0x140019f80
cmp byte [rsp + 0x20], sil
lea rcx, [rbp - 0x40]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x18], rsi
sete sil
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x40], WSAStartup
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x28], rbx
movups xmmword [rbp - 0x10], xmm0
mov dword [rbp - 0x10], esi
movups xmmword [rbp], xmm0
mov qword [rbp - 0x20], rdi
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, rdi
call fcn.14006ac0c
mov rcx, rbx
call fcn.14006ac0c
mov rcx, r14
call fcn.14006ac0c
mov rcx, r13
call fcn.14006ac0c
mov rcx, r12
call fcn.14006ac0c
mov r15, qword [rsp + 0x300]
mov r14, qword [rsp + 0x2f8]
mov r12, qword [rsp + 0x2f0]
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14001a6d0
add rsp, 0x2c0
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret