Function at 0x140079fc0
Capabilities:
Check os version
Create process on windows
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
mov rdi, r8
mov rax, rdx
mov r12, rcx
mov rcx, qword [0x140162028]
xor rcx, rsp
mov qword [rsp + 0x160], rcx
xor ebp, ebp
lea rdx, [rsp + 0x60]
mov rcx, rax
xor r8d, r8d
call fcn.14005f2b0
lea rdx, str.LaunchProcess
lea r8, str..._.._base_process_launch_win.cc
lea rbx, [rsp + 0xe0]
mov rcx, rbx
mov r9d, 0xed
call fcn.140063670
lea rcx, [rsp + 0x158]
mov rdx, rbx
call fcn.1400da1d0
mov eax, dword [0x140169d5c]
mov ecx, dword [0x1401653f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14007a799
xorps xmm0, xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0x140], xmm0
movaps xmmword [rsp + 0x130], xmm0
movaps xmmword [rsp + 0x120], xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x150], 0
mov dword [rsp + 0xe8], 0x70
cmp dword [rdi + 0x24], 1
sete r14b
mov rsi, qword [rdi + 0x28]
mov rbx, qword [rdi + 0x30]
cmp rsi, rbx
je 0x14007a1e0
mov rax, rbx
sub rax, rsi
sar rax, 3
cmp rax, 0x1fffffff
jbe 0x14007a13f
mov rcx, r12
xor edx, edx
call fcn.14007a810
mov rcx, qword [rsp + 0x150]
test rcx, rcx
je 0x14007a0f3
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
lea rcx, [rsp + 0xe0]
call fcn.140038e68
lea rcx, [rsp + 0x158]
call fcn.1400da360
cmp byte [rsp + 0x77], 0
js 0x14007a2c8
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400f0560
mov rax, r12
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rbp, qword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea r14, str..._.._base_process_launch_win.cc
lea r15, [0x140132f1f]
lea r13, [rsp + 0xc0]
mov rcx, qword [rsi]
mov edx, 1
mov r8d, 1
call rbp
test eax, eax
je 0x14007a6e1
add rsi, 8
cmp rbx, rsi
jne 0x14007a15c
lea rcx, [rsp + 0xe0]
mov edx, 1
call fcn.1400da4d0
test al, al
je 0x14007a0d6
mov rcx, qword [rsp + 0x150]
test rcx, rcx
je 0x14007a0d6
mov r9, qword [rdi + 0x28]
mov eax, dword [rdi + 0x30]
sub eax, r9d
and eax, 0xfffffff8
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rax
mov r8d, 0x20002
xor edx, edx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x14007a0d6
mov r14b, 1
mov ebp, 0x80000
cmp byte [rdi + 0x21], 0
je 0x14007a1ee
or byte [rsp + 0x124], 0x80
cmp byte [rdi + 0x50], 0
je 0x14007a203
lea rax, [0x1401323a0]
mov qword [rsp + 0xf8], rax
mov eax, dword [rsp + 0x124]
mov ecx, eax
or ecx, 1
mov dword [rsp + 0x124], ecx
mov ecx, dword [rdi + 0x40]
test ecx, ecx
jne 0x14007a747
movzx ecx, byte [rdi + 0x20]
xor ecx, 1
mov word [rsp + 0x128], cx
mov rcx, qword [rdi + 0x60]
test rcx, rcx
je 0x14007a2d7
mov rdx, qword [rdi + 0x68]
or eax, 0x101
mov dword [rsp + 0x124], eax
mov qword [rsp + 0x138], rcx
mov qword [rsp + 0x140], rdx
mov rax, qword [rdi + 0x70]
mov qword [rsp + 0x148], rax
cmp qword [rdi + 0x58], 0
je 0x14007a281
call fcn.14007c490
lea ecx, [rbp + 0x1000000]
cmp eax, 5
cmovl ebp, ecx
mov esi, ebp
or esi, 0x1000000
cmp byte [rdi + 0x78], 0
cmove esi, ebp
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], 0
movzx eax, byte [rdi + 0x1f]
mov rcx, rax
test al, al
jns 0x14007a2b6
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14007a2f4
lea r15, [rdi + 8]
test al, al
jns 0x14007a2f7
mov r15, qword [r15]
jmp 0x14007a2f7
mov rcx, qword [rsp + 0x60]
call fcn.1400ef7cc
jmp 0x14007a118
mov rdx, qword [rdi + 0x68]
test rdx, rdx
jne 0x14007a241
cmp qword [rdi + 0x70], 0
jne 0x14007a241
jmp 0x14007a269
xor r15d, r15d
lea r13, [rsp + 0xe8]
lea rbx, [rsp + 0xa8]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.14005a890
mov rdx, qword [rdi + 0x48]
test rdx, rdx
je 0x14007a497
lea rcx, [rsp + 0x90]
mov qword [rcx], 0
xor r8d, r8d
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x14007a48b
or esi, 0x400
mov rdx, qword [rsp + 0x90]
movzx eax, r14b
cmp byte [rsp + 0xbf], 0
jns 0x14007a364
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rdi + 0x48]
lea rbp, [rsp + 0xc0]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], 0
xor edx, edx
mov r8, rbx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ebx, eax
mov rcx, qword [rsp + 0x90]
call sub.USERENV.dll_DestroyEnvironmentBlock
test ebx, ebx
je 0x14007a48b
xorps xmm0, xmm0
lea rcx, [rsp + 0x90]
movaps xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
lea rdx, [rsp + 0xc0]
call fcn.1400daac0
mov rcx, qword [rdi + 0x58]
test rcx, rcx
je 0x14007a3fc
mov rdx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x14007a651
cmp byte [rdi + 0x79], 0
je 0x14007a417
mov rcx, qword [rsp + 0x90]
call fcn.1400ccdf0
mov ecx, eax
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
cmp byte [rdi], 0
je 0x14007a42f
mov rcx, qword [rsp + 0x90]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [rsp + 0xa0]
mov rcx, qword [0x14016a208]
test rcx, rcx
jne 0x14007a78a
lea rcx, [rsp + 0x90]
call fcn.1400dad20
mov rcx, r12
mov rdx, rax
call fcn.14007a810
lea rcx, [rsp + 0x90]
call fcn.1400dac10
cmp byte [rsp + 0xbf], 0
jns 0x14007a0e0
mov rcx, qword [rsp + 0xa8]
call fcn.1400ef7cc
jmp 0x14007a0e0
mov rcx, r12
xor edx, edx
call fcn.14007a810
jmp 0x14007a46b
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], 0
cmp byte [rdi + 0x98], 0
je 0x14007a5a7
lea r8, [rdi + 0x80]
lea rdx, [0x140136e1a]
lea rcx, [rsp + 0x78]
call fcn.1400da650
cmp byte [rsp + 0xa7], 0
js 0x14007a69c
mov word [rsp + 0x90], 0
mov byte [rsp + 0xa7], 0
lea rbx, [rsp + 0x90]
mov rax, qword [rsp + 0x88]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rsp + 0x78]
movaps xmmword [rbx], xmm0
cmp byte [rbx + 0x17], 0
jns 0x14007a51f
mov rax, qword [rsp + 0x90]
jmp 0x14007a527
lea rax, [rsp + 0x90]
or esi, 0x400
movzx ecx, r14b
cmp byte [rsp + 0xbf], 0
jns 0x14007a545
mov rdx, qword [rsp + 0xa8]
jmp 0x14007a54d
lea rdx, [rsp + 0xa8]
lea rbp, [rsp + 0xc0]
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ecx
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14007a627
cmp byte [rsp + 0xa7], 0
jns 0x14007a3ba
mov rcx, qword [rsp + 0x90]
call fcn.1400ef7cc
jmp 0x14007a3ba
cmp qword [rdi + 0x90], 0
je 0x14007a695
mov rbp, r13
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x14007a627
mov r13, rax
lea r8, [rdi + 0x80]
lea rcx, [rsp + 0x78]
mov rdx, rax
call fcn.1400da650
cmp byte [rsp + 0xa7], 0
js 0x14007a702
mov word [rsp + 0x90], 0
mov byte [rsp + 0xa7], 0
lea rbx, [rsp + 0x90]
mov rax, qword [rsp + 0x88]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rsp + 0x78]
movaps xmmword [rbx], xmm0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov r13, rbp
jmp 0x14007a50f
mov rcx, r12
xor edx, edx
call fcn.14007a810
cmp byte [rsp + 0xa7], 0
jns 0x14007a46b
mov rcx, qword [rsp + 0x90]
call fcn.1400ef7cc
jmp 0x14007a46b
lea rcx, [rsp + 0x90]
call fcn.1400dad20
lea rdi, [rsp + 0x78]
mov rcx, rdi
mov rdx, rax
call fcn.14007a810
mov rcx, rdi
mov edx, 1
mov r8b, 1
call fcn.14007acc0
mov rcx, r12
xor edx, edx
call fcn.14007a810
mov rcx, rdi
call fcn.14007a940
jmp 0x14007a45e
xor eax, eax
jmp 0x14007a52d
mov rax, qword [rsp + 0x90]
mov word [rax], 0
mov qword [rsp + 0x98], 0
cmp byte [rsp + 0xa7], 0
jns 0x14007a4f3
mov rcx, qword [rsp + 0x90]
call fcn.1400ef7cc
mov qword [rsp + 0xa0], 0
jmp 0x14007a4f3
mov rcx, r13
mov rdx, r14
mov r8d, 0x101
mov r9, r15
call fcn.1400da5b0
mov rcx, r13
call fcn.1400da590
jmp 0x14007a174
mov rax, qword [rsp + 0x90]
mov word [rax], 0
mov qword [rsp + 0x98], 0
cmp byte [rsp + 0xa7], 0
jns 0x14007a5fa
mov rcx, qword [rsp + 0x90]
call fcn.1400ef7cc
mov qword [rsp + 0xa0], 0
jmp 0x14007a5fa
add ecx, 0xfffffffe
cmp ecx, 3
ja case.default.0x14007a75d
lea rdx, [0x14007a7d0]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov cx, 1
jmp 0x14007a228
mov cx, 0xa
jmp 0x14007a228
mov cx, 2
jmp 0x14007a228
mov cx, 7
jmp 0x14007a228
xor ecx, ecx
jmp 0x14007a228
lea r8, [rsp + 0x60]
call fcn.1400cb800
jmp 0x14007a446
lea rcx, [0x140169d5c]
call fcn.1400ef8f0
cmp dword [0x140169d5c], 0xffffffff
jne 0x14007a059
lea rcx, [rsp + 0x158]
call fcn.1400da290
lea rcx, [0x140169d5c]
call fcn.1400ef988
jmp 0x14007a059