Function at 0x100008868
Capabilities:
Accept command line arguments
Create process on windows
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
xor r12d, r12d
lea rcx, [rax - 0xa8]
xor edx, edx
lea r8d, [r12 + 0x68]
mov ebx, r12d
mov r15, r12
mov r14, r12
mov dword [rax + 8], r12d
call sub.msvcrt.dll_memset
xor r11d, r11d
lea rax, [0x100005558]
mov r13d, r12d
mov qword [rsp + 0x68], rax
lea rax, [0x100005568]
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x70], rax
lea rax, [0x100005578]
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x78], rax
lea rax, [0x100005588]
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x80], rax
lea rax, [0x100005598]
mov qword [rsp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea edi, [r12 + 2]
mov rbp, rax
cmp rax, r12
je 0x1000089e9
mov word [rax], r12w
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, 0x400
mov r11, rax
mov rcx, rbp
mov r9d, r12d
sub r11, rbp
lea rax, [rdx + 0x7ffffbfe]
cmp rax, r12
je 0x100008962
movzx r8d, word [r11 + rcx]
cmp r8w, r12w
je 0x100008962
mov word [rcx], r8w
add rcx, rdi
sub rdx, 1
jne 0x10000893e
cmp rdx, r12
jne 0x100008970
sub rcx, rdi
mov r9d, 0x8007007a
cmp r9d, r12d
mov word [rcx], r12w
jl 0x1000089d5
mov rsi, rbp
cmp word [rbp], r12w
je 0x100008998
movzx ecx, word [rsi]
call qword [sym.imp.msvcrt.dll_towlower]
mov word [rsi], ax
add rsi, rdi
cmp word [rsi], r12w
jne 0x100008983
lea rsi, [rsp + 0x68]
mov r12d, 5
mov rcx, qword [rsi]
mov rdx, rbp
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
je 0x1000089b7
inc r13d
add rsi, 8
sub r12, 1
jne 0x1000089a3
cmp r13d, r12d
jle 0x1000089d5
mov r8d, r13d
mov edx, 0x3bc
xor ecx, ecx
call sub.ntdll.dll_WinSqmIncrementDWORD
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x148]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbp, rax
cmp rax, r12
je 0x100008ddd
mov esi, dword [rsp + 0x148]
mov eax, 0x50
xor ecx, ecx
mov word [0x100012ba8], ax
mov ebx, r12d
call fcn.10000c570
cmp dword [0x100012574], r12d
je 0x100008a4e
lea rax, [0x100012b48]
mov dword [0x100012574], r12d
mov qword [0x100012b50], rax
mov qword [0x100012b48], rax
call fcn.10000c6f0
cmp eax, r12d
jl 0x100008aa5
lea r8, [rsp + 0x150]
mov rdx, rbp
mov ecx, esi
call fcn.10000e068
mov r13d, 1
cmp eax, r12d
jl 0x100008aab
mov rcx, qword [rsp + 0x150]
mov edx, r13d
call fcn.10000cbbc
cmp eax, r12d
cmovl ebx, eax
xor ecx, ecx
call fcn.100008190
mov ecx, eax
call fcn.10000cad8
cmp eax, r12d
jl 0x100008aab
cmp eax, r13d
je 0x100008aab
jmp 0x100008aad
mov r13d, 1
mov ebx, eax
cmp ebx, r12d
jl 0x100008dcb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x140]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp eax, r12d
jne 0x100008ad8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x100012324]
mov esi, 0x8007000e
cmp edx, r12d
je 0x100008b3a
mov rsi, qword [0x100012340]
cmp rsi, r12
je 0x100008b35
mov rcx, qword [0x100012b90]
mov ebx, r12d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
cmp rsi, r12
mov esi, 0x8007000e
mov qword [0x100012b90], rax
je 0x100008b24
cmp rax, r12
cmove ebx, esi
cmp ebx, r12d
jl 0x100008dcb
mov edx, dword [0x100012324]
jmp 0x100008b3a
mov esi, 0x8007000e
cmp dword [0x100012554], r12d
mov ecx, dword [0x1000121a4]
mov eax, dword [0x100012b80]
cmovne ecx, r13d
cmp dword [0x1000123b4], r12d
cmovne eax, r13d
mov dword [0x1000121a4], ecx
mov dword [0x100012b80], eax
cmp ecx, r12d
jne 0x100008b90
cmp dword [0x100012224], r12d
je 0x100008b82
mov edi, r13d
mov dword [0x100012b6c], r13d
jmp 0x100008bb1
cmp dword [0x1000122a4], r12d
je 0x100008b98
mov edi, 4
mov dword [0x100012b6c], edi
jmp 0x100008bb1
mov eax, dword [0x100012b6c]
mov ecx, 3
cmp edx, r12d
cmovne eax, ecx
mov edi, eax
mov dword [0x100012b6c], eax
xor edx, edx
sub edi, r13d
je 0x100008bca
cmp edi, r13d
je 0x100008bc1
xor ecx, ecx
jmp 0x100008bd1
lea rcx, [0x1000056a8]
jmp 0x100008bd1
lea rcx, [0x100005698]
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
cmp eax, r12d
mov ebx, eax
jl 0x100008dcb
mov eax, dword [0x100012b6c]
cmp eax, r12d
je 0x100008bf6
cmp eax, 4
jne 0x100008dc6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, 0x800
xor edx, edx
mov rcx, rax
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
cmp rax, r12
je 0x100008c37
mov word [rax], r12w
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
cmp rax, r12
jne 0x100008c3e
mov ebx, esi
jmp 0x100008dcb
mov word [rax], r12w
mov eax, 5
mov edi, 0x80070000
mov word [rsp + 0xd0], ax
mov eax, dword [0x100012b6c]
mov dword [rsp + 0x90], 0x68
mov dword [rsp + 0xcc], r13d
cmp eax, r12d
je 0x100008ccc
cmp eax, 4
jne 0x100008d58
mov esi, 0x400
lea rcx, [0x1000057a0]
mov rdx, r15
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, r12d
ja 0x100008cb2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, edi
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x100008dcb
lea r8, [0x1000057f0]
mov r9, r15
mov rdx, rsi
mov rcx, r14
call fcn.100007e94
jmp 0x100008d51
mov esi, 0x400
lea rcx, [0x1000056b8]
mov rdx, r15
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, r12d
ja 0x100008d03
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, edi
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x100008dcb
lea rcx, [0x100005700]
mov r8d, esi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, r12d
ja 0x100008d35
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, edi
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x100008dcb
cmp dword [rsp + 0x140], r12d
je 0x100008d58
lea r8, [0x100005788]
mov rdx, rsi
mov rcx, r14
call fcn.100007dfc
cmp eax, r12d
mov ebx, eax
jl 0x100008dcb
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov rdx, r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov rcx, r15
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, r12d
jne 0x100008db3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, edi
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x100008dcb
mov rcx, qword [rsp + 0x50]
mov edx, 0x7530
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov ebx, r13d
cmp ebx, r12d
jge 0x100008dd4
mov edx, ebx
xor ecx, ecx
call fcn.100008f34
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x50]
cmp rcx, r12
je 0x100008df8
cmp rcx, 0xffffffffffffffff
je 0x100008df8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x50], r12
mov rcx, qword [rsp + 0x58]
cmp rcx, r12
je 0x100008e13
cmp rcx, 0xffffffffffffffff
je 0x100008e13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x58], r12
cmp r15, r12
je 0x100008e2c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r14, r12
je 0x100008e45
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rbx, qword [rsp + 0x158]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret