Function at 0x140059100
Capabilities:
Create pipe
Create process on windows
Get comspec environment variable
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x128
mov rbx, qword [0x1400f6e30]
mov rax, qword [rbx]
mov qword [rsp + 0x118], rax
xor eax, eax
cmp qword [0x140127108], 0
mov rbp, rcx
mov edi, r8d
jne 0x140058ff8
cmp byte [rdx], 0x72
jne 0x140058e42
movzx eax, byte [rdx + 1]
test al, al
jne 0x140058e30
lea rsi, [0x1400f0330]
mov r12d, 0x4000
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
mov r9d, 0x400
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x140059025
mov rcx, qword [rsp + 0x68]
mov r8d, 1
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x140059010
mov edx, r12d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.msvcrt.dll__open_osfhandle]
mov r12d, eax
test eax, eax
js 0x140059060
mov rdx, rsi
mov ecx, eax
call sub.msvcrt.dll__fdopen
mov rsi, rax
test rax, rax
je 0x140059080
mov rcx, rbp
call sub.msvcrt.dll_strlen
lea ecx, [rax + 8]
mov r13, rax
movsxd rcx, ecx
call sub.msvcrt.dll_malloc
mov r12, rax
test rax, rax
je 0x1400590d3
mov dword [rax], 0x20646d63
lea r8d, [r13 + 1]
lea rcx, [rax + 7]
mov rdx, rbp
mov dword [rax + 3], 0x20632f20
movsxd r8, r8d
call sub.msvcrt.dll_memcpy
test dil, dil
je 0x140058e98
call fcn.140058860
mov r14, rax
test rax, rax
je 0x1400590a7
lea rbp, [0x1400f0336]
lea r15, [rsp + 0x70]
xor r8d, r8d
mov edx, 0x80000000
mov rdi, qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rbp
mov r9, r15
mov dword [rsp + 0x70], 0x18
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x80], 1
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
call rdi
mov r9, r15
xor r8d, r8d
mov edx, 0x40000000
mov r13, rax
mov rcx, rbp
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
call rdi
pxor xmm0, xmm0
lea rcx, str.COMSPEC
mov dword [rsp + 0xb0], 0x68
movups xmmword [rsp + 0xe4], xmm0
mov rdi, rax
movups xmmword [rsp + 0xb4], xmm0
movups xmmword [rsp + 0xc4], xmm0
movups xmmword [rsp + 0xd4], xmm0
movups xmmword [rsp + 0xf0], xmm0
movq xmm0, r13
movhps xmm0, qword [rsp + 0x68]
mov qword [rsp + 0x110], rax
movups xmmword [rsp + 0x100], xmm0
mov dword [rsp + 0xec], 0x100
call sub.msvcrt.dll_getenv
xor r9d, r9d
mov r8, r12
mov rcx, r14
mov rdx, rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x8000000
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov rcx, r12
mov ebp, eax
call fcn.140092f40
mov rcx, rdi
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, r13
call rdi
mov rcx, r14
call rdi
mov rcx, qword [rsp + 0x68]
call rdi
test ebp, ebp
je 0x140059040
mov rcx, qword [rsp + 0x98]
call rdi
mov rax, qword [rsp + 0x90]
mov qword [0x140127108], rsi
mov qword [0x140127100], rax
jmp 0x140058e50
cmp byte [rdx + 2], 0
jne 0x140058e42
cmp al, 0x62
je 0x140058e80
cmp al, 0x74
je 0x140058bc0
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
xor esi, esi
mov rax, qword [rsp + 0x118]
sub rax, qword [rbx]
jne 0x1400590ce
mov rax, rsi
add rsp, 0x128
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, [0x1400f0333]
mov r12d, 0x8000
jmp 0x140058bcd
lea r14, [rsp + 0x70]
lea rbp, [0x1400f0336]
xor r8d, r8d
mov rdi, qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r9, r14
mov rcx, rbp
mov dword [rsp + 0x70], 0x18
mov edx, 0x80000000
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x80], 1
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
call rdi
mov r9, r14
xor r8d, r8d
mov edx, 0x40000000
mov r13, rax
mov rcx, rbp
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
call rdi
pxor xmm0, xmm0
lea rcx, str.COMSPEC
mov dword [rsp + 0xb0], 0x68
movups xmmword [rsp + 0xe4], xmm0
mov rdi, rax
movups xmmword [rsp + 0xb4], xmm0
movups xmmword [rsp + 0xc4], xmm0
movups xmmword [rsp + 0xd4], xmm0
movups xmmword [rsp + 0xf0], xmm0
movq xmm0, r13
movhps xmm0, qword [rsp + 0x68]
mov qword [rsp + 0x110], rax
movups xmmword [rsp + 0x100], xmm0
mov dword [rsp + 0xec], 0x100
call sub.msvcrt.dll_getenv
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, r12
mov ebp, eax
call fcn.140092f40
mov rcx, rdi
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, r13
call rdi
jmp 0x140058dfd
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x11
jmp 0x140058e4e
mov rcx, qword [rsp + 0x60]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x68]
call rsi
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x18
jmp 0x140058e4e
mov rcx, rsi
call sub.msvcrt.dll_fclose
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 2
jmp 0x140058e4e
mov rcx, qword [rsp + 0x60]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x68]
call rsi
jmp 0x140058e4e
mov rsi, qword [sym.imp.msvcrt.dll__errno]
call rsi
mov ecx, r12d
mov edi, dword [rax]
call sub.msvcrt.dll__close
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov dword [rax], edi
jmp 0x140058e4e
mov rdi, qword [sym.imp.msvcrt.dll__errno]
call rdi
mov rcx, rsi
mov ebp, dword [rax]
call sub.msvcrt.dll_fclose
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov dword [rax], ebp
jmp 0x140058e4e
call fcn.140082d70
mov rcx, rsi
call sub.msvcrt.dll_fclose
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0xc
jmp 0x140058e4e
xor r8d, r8d
jmp 0x140058b70