Function at 0x14010a630
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x2200]
mov eax, 0x2300
call fcn.140181ce0
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1402a98a8]
xor rax, rsp
mov qword [rbp + 0x21f0], rax
mov r14, r8
mov r15, rdx
mov rdi, rcx
cmp qword [rcx + 0x18], 8
jb 0x14010a67d
mov rdi, qword [rcx]
xor r12d, r12d
mov ebx, r12d
xor sil, sil
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp rcx, 0x104
jbe 0x14010a6a2
mov ecx, 0x103
jmp 0x14010a6a6
test eax, eax
je 0x14010a6d4
movzx eax, word [rdi + rbx*2]
cmp ax, 0x20
jne 0x14010a6b7
test sil, sil
je 0x14010a6d4
jmp 0x14010a6c4
cmp ax, 0x22
jne 0x14010a6c4
test sil, sil
sete sil
mov word [rbp + rbx*2 + 0x190], ax
inc rbx
cmp rbx, rcx
jb 0x14010a6a6
mov word [rbp + rbx*2 + 0x190], r12w
cmp rbx, rcx
jae 0x14010a751
cmp word [rdi + rbx*2], 0x20
jne 0x14010a6f3
inc rbx
cmp rbx, rcx
jb 0x14010a6e2
jmp 0x14010a713
cmp rbx, rcx
jae 0x14010a713
lea rdx, [rbp - 0x80]
nop dword [rax]
movzx eax, word [rdi + rbx*2]
mov word [rdx], ax
inc rbx
lea rdx, [rdx + 2]
cmp rbx, rcx
jbe 0x14010a700
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [rax - 1]
movsxd rdx, ecx
cmp word [rbp + rdx*2 - 0x80], 0x20
jne 0x14010a756
sub eax, 2
movsxd rcx, eax
test eax, eax
jle 0x14010a747
cmp word [rbp + rcx*2 - 0x80], 0x20
jne 0x14010a747
dec eax
dec rcx
test rcx, rcx
jg 0x14010a735
cdqe
mov word [rbp + rax*2 - 0x7e], r12w
jmp 0x14010a756
mov word [rbp - 0x80], r12w
mov r8d, 0x104
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x14010a78e
lea r8, [rbp + 0x190]
mov edx, 0x104
lea rcx, [rbp + 0x3a0]
call fcn.1401a83c0
jmp 0x14010a79d
cmp eax, 0x104
jl 0x14010a79d
mov word [rbp + 0x5a6], r12w
mov r8d, 0x208
lea rdx, [rbp + 0x9d0]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x14010a7cf
lea r8, [rbp - 0x80]
mov edx, 0x208
lea rcx, [rbp + 0x9d0]
call fcn.1401a83c0
jmp 0x14010a7de
cmp eax, 0x208
jl 0x14010a7de
mov word [rbp + 0xdde], r12w
mov r9, r15
mov r8d, 0x104
lea rdx, [rbp + 0x5b0]
lea rcx, [rbp + 0x3a0]
call fcn.14010a2e0
mov r9, r15
mov r8d, 0xa08
lea rdx, [rbp + 0xde0]
lea rcx, [rbp + 0x9d0]
call fcn.14010a2e0
mov r9, r15
mov r8d, 0x104
lea rdx, [rbp + 0x7c0]
mov rcx, r14
call fcn.14010a2e0
mov dword [rsp + 0x28], 5
lea rax, [rbp + 0x7c0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xde0]
lea r8, [rbp + 0x5b0]
lea rdx, str.open
mov rcx, r15
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdi, rax
cmp eax, 0x20
jg 0x14010aae5
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x1401e5030]
movdqu xmmword [rsp + 0x48], xmm1
mov word [rsp + 0x38], r12w
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.140027880
nop
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x14010a8a3
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rsp + 0x38]
call fcn.140006aa0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x14010a8f4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010a8ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010ab0f
call fcn.1401812c4
movdqa xmm0, xmmword [0x1401e5030]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r12w
mov r8d, 0x31
lea rdx, str.An_attempt_was_made_to_execute_the_below_command.
lea rcx, [rsp + 0x38]
call fcn.140006aa0
mov r8d, 0x3b
lea rdx, str._n__________________________________________________________
lea rcx, [rsp + 0x38]
call fcn.140006aa0
mov r8d, 0xa
lea rdx, str._nCommand:
lea rcx, [rsp + 0x38]
call fcn.140006aa0
lea rax, [rbp + 0x5b0]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14010a960
lea rdx, [rbp + 0x5b0]
lea rcx, [rsp + 0x38]
call fcn.140006aa0
mov r8d, InitCommonControls
lea rdx, str._nArguments:
lea rcx, [rsp + 0x38]
call fcn.140006aa0
lea rax, [rbp + 0xde0]
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14010a9a0
mov r8, rbx
lea rdx, [rbp + 0xde0]
lea rcx, [rsp + 0x38]
call fcn.140006aa0
mov r8d, InitCommonControls
lea rdx, str._nError_Code:
lea rcx, [rsp + 0x38]
call fcn.140006aa0
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.14002a210
nop
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x14010a9ef
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rsp + 0x38]
call fcn.140006aa0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x14010aa40
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010aa3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010ab15
call fcn.1401812c4
movdqa xmm0, xmmword [0x1401e5030]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r12w
mov r8d, 0x3b
lea rdx, str._n__________________________________________________________
lea rcx, [rsp + 0x38]
call fcn.140006aa0
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
mov r9d, 0x40
lea r8, str.ShellExecute___ERROR
mov rcx, r15
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x14010aad1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010aacc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010ab09
call fcn.1401812c4
movdqa xmm0, xmmword [0x1401e5030]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], r12w
mov rax, rdi
mov rcx, qword [rbp + 0x21f0]
xor rcx, rsp
call fcn.1401813e0
add rsp, 0x2300
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1401a2d8c
nop
call fcn.1401a2d8c
nop
call fcn.1401a2d8c
int3