Function at 0x140108bb0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x2200]
mov eax, 0x2300
call fcn.140180000
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rbp + 0x21f0], rax
mov r14, r8
mov r15, rdx
mov rdi, rcx
cmp qword [rcx + 0x18], 8
jb 0x140108bfd
mov rdi, qword [rcx]
xor r12d, r12d
mov ebx, r12d
xor sil, sil
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp rcx, 0x104
jbe 0x140108c22
mov ecx, 0x103
jmp 0x140108c26
test eax, eax
je 0x140108c54
movzx eax, word [rdi + rbx*2]
cmp ax, 0x20
jne 0x140108c37
test sil, sil
je 0x140108c54
jmp 0x140108c44
cmp ax, 0x22
jne 0x140108c44
test sil, sil
sete sil
mov word [rbp + rbx*2 + 0x190], ax
inc rbx
cmp rbx, rcx
jb 0x140108c26
mov word [rbp + rbx*2 + 0x190], r12w
cmp rbx, rcx
jae 0x140108cd1
cmp word [rdi + rbx*2], 0x20
jne 0x140108c73
inc rbx
cmp rbx, rcx
jb 0x140108c62
jmp 0x140108c93
cmp rbx, rcx
jae 0x140108c93
lea rdx, [rbp - 0x80]
nop dword [rax]
movzx eax, word [rdi + rbx*2]
mov word [rdx], ax
inc rbx
lea rdx, [rdx + 2]
cmp rbx, rcx
jbe 0x140108c80
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [rax - 1]
movsxd rdx, ecx
cmp word [rbp + rdx*2 - 0x80], 0x20
jne 0x140108cd6
sub eax, 2
movsxd rcx, eax
test eax, eax
jle 0x140108cc7
cmp word [rbp + rcx*2 - 0x80], 0x20
jne 0x140108cc7
dec eax
dec rcx
test rcx, rcx
jg 0x140108cb5
cdqe
mov word [rbp + rax*2 - 0x7e], r12w
jmp 0x140108cd6
mov word [rbp - 0x80], r12w
mov r8d, 0x104
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x140108d0e
lea r8, [rbp + 0x190]
mov edx, 0x104
lea rcx, [rbp + 0x3a0]
call fcn.1401a66e0
jmp 0x140108d1d
cmp eax, 0x104
jl 0x140108d1d
mov word [rbp + 0x5a6], r12w
mov r8d, 0x208
lea rdx, [rbp + 0x9d0]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x140108d4f
lea r8, [rbp - 0x80]
mov edx, 0x208
lea rcx, [rbp + 0x9d0]
call fcn.1401a66e0
jmp 0x140108d5e
cmp eax, 0x208
jl 0x140108d5e
mov word [rbp + 0xdde], r12w
mov r9, r15
mov r8d, 0x104
lea rdx, [rbp + 0x5b0]
lea rcx, [rbp + 0x3a0]
call fcn.140108860
mov r9, r15
mov r8d, 0xa08
lea rdx, [rbp + 0xde0]
lea rcx, [rbp + 0x9d0]
call fcn.140108860
mov r9, r15
mov r8d, 0x104
lea rdx, [rbp + 0x7c0]
mov rcx, r14
call fcn.140108860
mov dword [rsp + 0x28], 5
lea rax, [rbp + 0x7c0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xde0]
lea r8, [rbp + 0x5b0]
lea rdx, str.open
mov rcx, r15
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdi, rax
cmp eax, 0x20
jg 0x140109065
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x1401e3030]
movdqu xmmword [rsp + 0x48], xmm1
mov word [rsp + 0x38], r12w
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.140027820
nop
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x140108e23
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rsp + 0x38]
call fcn.140006a90
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140108e74
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140108e6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010908f
call fcn.14017f5e4
movdqa xmm0, xmmword [0x1401e3030]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r12w
mov r8d, 0x31
lea rdx, str.An_attempt_was_made_to_execute_the_below_command.
lea rcx, [rsp + 0x38]
call fcn.140006a90
mov r8d, 0x3b
lea rdx, str._n__________________________________________________________
lea rcx, [rsp + 0x38]
call fcn.140006a90
mov r8d, 0xa
lea rdx, str._nCommand:
lea rcx, [rsp + 0x38]
call fcn.140006a90
lea rax, [rbp + 0x5b0]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140108ee0
lea rdx, [rbp + 0x5b0]
lea rcx, [rsp + 0x38]
call fcn.140006a90
mov r8d, InitCommonControls
lea rdx, str._nArguments:
lea rcx, [rsp + 0x38]
call fcn.140006a90
lea rax, [rbp + 0xde0]
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140108f20
mov r8, rbx
lea rdx, [rbp + 0xde0]
lea rcx, [rsp + 0x38]
call fcn.140006a90
mov r8d, InitCommonControls
lea rdx, str._nError_Code:
lea rcx, [rsp + 0x38]
call fcn.140006a90
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.14002a1b0
nop
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x140108f6f
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rsp + 0x38]
call fcn.140006a90
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140108fc0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140108fbb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140109095
call fcn.14017f5e4
movdqa xmm0, xmmword [0x1401e3030]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r12w
mov r8d, 0x3b
lea rdx, str._n__________________________________________________________
lea rcx, [rsp + 0x38]
call fcn.140006a90
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
mov r9d, 0x40
lea r8, str.ShellExecute___ERROR
mov rcx, r15
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140109051
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010904c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140109089
call fcn.14017f5e4
movdqa xmm0, xmmword [0x1401e3030]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], r12w
mov rax, rdi
mov rcx, qword [rbp + 0x21f0]
xor rcx, rsp
call fcn.14017f700
add rsp, 0x2300
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1401a10ac
nop
call fcn.1401a10ac
nop
call fcn.1401a10ac
int3