Function at 0x1400689d0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
xor edi, edi
mov r14, rcx
mov r12d, edx
mov rsi, r8
mov r15, r9
test r9, r9
je 0x140068ac9
mov rdi, qword [r9]
test rdi, rdi
je 0x140068ac9
mov eax, 1
mov rdi, rax
add rax, 1
cmp qword [r15 + rax*8 - 8], 0
jne 0x140068a0d
lea r8, [rdi*8]
lea rax, [r8 + 0xf]
and rax, 0xfffffffffffffff0
call fcn.14007a830
sub rsp, rax
mov rdx, r15
lea r13d, [rdi - 1]
lea rbx, [rsp + 0x50]
mov rcx, rbx
call sym.memcpy
mov rdx, rdi
lea r9, [sym.env_compare]
mov rcx, rbx
mov r8d, 8
call sym.qsort
lea rax, [r13*8]
mov r13d, 1
mov qword [rbp - 8], rax
lea rdi, [rax + r15 + 8]
nop word [rax + rax]
mov rcx, qword [r15]
add r15, 8
call sym.strlen
lea r13d, [r13 + rax + 1]
cmp rdi, r15
jne 0x140068a80
movsxd rcx, r13d
call sym.xmalloc
mov rdi, rax
mov rax, qword [rbp - 8]
mov rcx, rdi
lea r13, [rbx + rax + 8]
nop dword [rax]
mov rdx, qword [rbx]
add rbx, 8
call sym.stpcpy
lea rcx, [rax + 1]
cmp rbx, r13
jne 0x140068ab0
mov byte [rax + 1], 0
mov rcx, r14
call sym.strlen
mov edx, 0x2f
mov rcx, r14
mov rbx, rax
call sym.strchr
test rax, rax
je 0x140068fc2
lea r12, [0x1400fb9f4]
xor r8d, r8d
lea rcx, [r8 + rbx + 6]
lea r15, str..com
call sym.xmalloc
mov qword [rbp + 0x60], rsi
mov rsi, r12
mov r13, qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
movzx eax, byte [r12]
mov qword [rbp - 8], rdi
mov rdi, rsi
cmp al, 0x3b
je 0x140068f7f
test al, al
je 0x140068f7f
nop word [rax + rax]
movzx eax, byte [rdi + 1]
add rdi, 1
cmp al, 0x3b
je 0x140068b48
test al, al
jne 0x140068b38
mov r12, rdi
mov rcx, rbx
mov rdx, rsi
sub r12, rsi
mov r8, r12
call sym.memcpy
lea r8, [rbx + r12]
mov rcx, r8
cmp rdi, rsi
je 0x140068b70
mov byte [r8], 0x5c
add rcx, 1
mov rdx, r14
mov r12, rbx
call sym.strcpy
xor eax, eax
cmp byte [rdi], 0x3b
sete al
add rdi, rax
movzx eax, byte [rbx]
test al, al
je 0x140068ba7
nop dword [rax]
cmp al, 0x2f
jne 0x140068b99
mov byte [r12], 0x5c
movzx eax, byte [r12 + 1]
add r12, 1
test al, al
jne 0x140068b90
lea rsi, str..com
mov rdx, r15
jmp 0x140068bc9
mov rdx, qword [rsi + 8]
add rsi, 8
test rdx, rdx
je 0x140068f66
mov byte [r12], 0
mov rcx, rbx
call sym.strcat
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov r8d, 3
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call r13
cmp rax, 0xffffffffffffffff
je 0x140068bb8
mov rsi, qword [rbp + 0x60]
mov rdi, qword [rbp - 8]
mov rcx, rax
mov r14, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r14
mov rax, qword [rsi]
test rax, rax
je 0x140069067
mov qword [rbp - 8], rdi
lea rdx, [rsi + 8]
xor ecx, ecx
mov r13d, 2
movabs r12, 0x500000200
nop dword [rax]
movzx r9d, byte [rax]
lea r11, [rax - 1]
mov r10d, 0xffffffff
xor r15d, r15d
test r9b, r9b
jne 0x140068c6b
jmp 0x140068f15
mov r11, r8
mov edi, r10d
add r10d, 1
cmp r9b, 0x22
ja 0x140068c82
bt r12, r9
jb 0x140068dc0
movzx r9d, byte [r11 + 2]
lea r8, [r11 + 1]
test r9b, r9b
jne 0x140068c68
mov r9, r13
sub r9, rax
add r11, r9
test r15d, r15d
jne 0x140068ee8
add rcx, r11
mov eax, 1
add rdx, 8
add rcx, rax
mov rax, qword [rdx - 8]
test rax, rax
jne 0x140068c48
mov rdi, qword [rbp - 8]
call sym.xmalloc
mov r10, qword [rsi]
mov rdx, rax
test r10, r10
je 0x14006907d
add rsi, 8
mov r9, rax
movabs r11, 0x500000200
nop dword [rax + rax]
movzx r8d, byte [r10]
mov ecx, 1
mov eax, r8d
test r8b, r8b
jne 0x140068d12
jmp 0x140068d1c
add rcx, 1
movzx eax, byte [r10 + rcx - 1]
test al, al
je 0x140068f20
cmp al, 0x22
ja 0x140068d00
bt r11, rax
jae 0x140068d00
mov byte [r9], 0x22
movzx r8d, byte [r10]
lea rax, [r9 + 1]
test r8b, r8b
je 0x140069057
mov r13d, 1
lea rcx, [r10 - 1]
mov r12d, 0xffffffff
jmp 0x140068d66
movzx r8d, byte [rcx + 1]
lea rax, [r15 + 1]
add rcx, 1
mov byte [r15], r8b
movzx r8d, byte [rcx + 1]
test r8b, r8b
je 0x140068e18
mov r9d, r12d
mov r15, rax
add r12d, 1
cmp r8b, 0x22
jne 0x140068d48
cmp r9d, 0xffffffff
je 0x140068fb2
lea r15, [rax + r9 + 1]
mov r8, rcx
jmp 0x140068da1
mov byte [rax - 1], 0x5c
sub r8, 1
cmp r15, rax
je 0x140068ec0
cmp byte [r8], 0x5c
mov r9, rax
lea rax, [rax + 1]
je 0x140068d90
mov byte [r9], 0x5c
lea r15, [r9 + 1]
jmp 0x140068d48
mov r15d, 1
cmp r9b, 0x22
jne 0x140068c82
cmp edi, 0xffffffff
je 0x140068fa0
lea r8, [rcx + 1]
mov r9, r11
add rdi, r8
jmp 0x140068df9
sub r9, 1
cmp rdi, r8
je 0x140068ed0
add r8, 1
cmp byte [r9], 0x5c
mov r15, rcx
mov rcx, r8
je 0x140068de8
lea rcx, [r15 + 1]
mov r15d, 1
jmp 0x140068c82
test r13d, r13d
jne 0x140068f30
mov r10, qword [rsi]
add rsi, 8
mov byte [rax], 0x20
lea r9, [rax + 1]
test r10, r10
jne 0x140068ce8
mov rax, qword [rbp + 0x80]
mov byte [r9 - 1], 0
xor r8d, r8d
xor r9d, r9d
mov rcx, rbx
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x78]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], rdi
mov eax, dword [rbp + 0x70]
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400690a5
mov rax, qword [rbp + 0x80]
mov rcx, qword [rax + 8]
call r14
mov rcx, rbx
call sym.free
mov rcx, rdi
call sym.free
mov rax, qword [rbp + 0x80]
mov rax, qword [rax]
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov r9, r15
mov byte [r9], 0x5c
lea r15, [r9 + 1]
jmp 0x140068d48
mov r15, rdi
lea rcx, [r15 + 1]
mov r15d, 1
jmp 0x140068c82
movsxd r9, r10d
mov r10d, r10d
add rax, r9
lea r9, [rcx + r10 + 1]
jmp 0x140068f0d
add rcx, 1
sub rax, 1
cmp rcx, r9
je 0x140068f12
cmp byte [rax], 0x5c
je 0x140068f00
add rcx, r11
mov eax, 3
jmp 0x140068caa
mov rax, r9
xor r13d, r13d
jmp 0x140068d37
movsxd rcx, r12d
mov r12d, r12d
add rcx, r10
lea r9, [rax + r12 + 1]
jmp 0x140068f4d
mov byte [rax - 1], 0x5c
sub rcx, 1
cmp r9, rax
je 0x140068f90
cmp byte [rcx], 0x5c
mov r8, rax
lea rax, [rax + 1]
je 0x140068f40
mov byte [r8], 0x22
lea rax, [r8 + 1]
jmp 0x140068e21
movzx eax, byte [rdi]
test al, al
je 0x140069085
mov rsi, rdi
mov rdi, rsi
cmp al, 0x3b
jne 0x140068b2a
mov rcx, rbx
jmp 0x140068b70
mov r8, r9
mov byte [r8], 0x22
lea rax, [r8 + 1]
jmp 0x140068e21
mov r15, rcx
lea rcx, [r15 + 1]
mov r15d, 1
jmp 0x140068c82
mov r9, rax
mov byte [r9], 0x5c
lea r15, [r9 + 1]
jmp 0x140068d48
mov edx, 0x5c
mov rcx, r14
call sym.strchr
test rax, rax
jne 0x140068aea
and r12d, 1
je 0x140068aea
lea rcx, str.PATH
call sym.getenv
mov r12, rax
test rax, rax
je 0x140068aea
movzx edx, byte [rax]
test dl, dl
je 0x140068af1
mov rcx, rax
xor r8d, r8d
mov rax, rcx
cmp dl, 0x3b
je 0x140069051
nop dword [rax + rax]
movzx edx, byte [rax + 1]
add rax, 1
cmp dl, 0x3b
je 0x140069029
test dl, dl
jne 0x140069018
mov r9, rax
sub r9, rcx
mov rcx, rax
cmp r8, r9
cmovb r8, r9
cmp dl, 0x3b
je 0x140069051
movzx edx, byte [rcx]
test dl, dl
je 0x140068af4
mov rax, rcx
cmp dl, 0x3b
jne 0x140069018
lea rcx, [rax + 1]
jmp 0x14006903e
mov r8, rax
mov byte [r8], 0x22
lea rax, [r8 + 1]
jmp 0x140068e21
xor ecx, ecx
call sym.xmalloc
mov r10, qword [rsi]
mov rdx, rax
test r10, r10
jne 0x140068cd2
mov r9, rax
jmp 0x140068e38
mov rdi, qword [rbp - 8]
mov rcx, rbx
call sym.free
mov rcx, rdi
call sym.free
mov rax, 0xffffffffffffffff
jmp 0x140068eae
mov rcx, rdi
call sym.free
mov rcx, rbx
call sym.free
jmp 0x140069099