Function at 0x14014fca0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
lea rbp, [rsp - 0x640]
sub rsp, 0x740
mov rax, qword [0x14043c0c0]
xor rax, rsp
mov qword [rbp + 0x630], rax
mov r8d, 0x104
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14014ff30
mov r8d, 0x104
lea rdx, [rbp]
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x14014ff30
movabs rax, 0xd3c463b16808704
mov qword [rsp + 0x750], rbx
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x420]
mov rax, qword [rsp + 0x20]
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x30], rax
movabs rbx, 0xd6f467616cf8747
movabs rax, 0x2a79e5f4c0fd53fc
mov qword [rsp + 0x758], rdi
mov qword [rsp + 0x20], rax
movabs rdi, 0x2a79e5b7c0b853ac
mov rax, qword [rsp + 0x20]
mov r8d, 0x104
mov qword [rbp - 0x28], rax
mov qword [rsp + 0x20], rbx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rdi
mov rax, qword [rsp + 0x20]
movdqa xmm0, xmmword [rbp - 0x30]
mov qword [rsp + 0x38], rax
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14014ff20
movabs rax, 0xd0b465616ac8768
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x210]
mov rax, qword [rsp + 0x20]
mov qword [rbp - 0x20], rax
movabs rax, 0x2a79e597c0d453c9
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x20], rbx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rdi
mov rax, qword [rsp + 0x20]
movdqa xmm0, xmmword [rbp - 0x20]
mov qword [rsp + 0x48], rax
xorps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rbp]
lea rcx, [rbp + 0x210]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
movabs rax, 0xd01465616f18767
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x210]
mov rax, qword [rsp + 0x20]
mov qword [rbp - 0x10], rax
movabs rax, 0x2a79e5b7c0d453d9
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp - 8], rax
mov qword [rsp + 0x20], rbx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], rdi
mov rax, qword [rsp + 0x20]
movdqa xmm0, xmmword [rbp - 0x10]
mov qword [rsp + 0x58], rax
xorps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x10], xmm0
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor ecx, ecx
mov dword [rsp + 0x60], reloc.WS2_32.dll_WSASetLastError
lea rax, str.Open
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0x420]
mov qword [rsp + 0x78], rax
lea rax, [rbp + 0x210]
mov qword [rbp - 0x78], rcx
mov dword [rbp - 0x70], ecx
lea rcx, [rsp + 0x60]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x64], 0x40
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14014ff20
mov rcx, qword [rbp - 0x38]
mov edx, 0x40
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x100
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor r9d, r9d
lea r8, [rbp]
lea edx, [r9 + 5]
lea ecx, [rdx - 1]
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov rbx, qword [rsp + 0x750]
mov rdi, qword [rsp + 0x758]
mov rcx, qword [rbp + 0x630]
xor rcx, rsp
call fcn.140154c90
add rsp, 0x740
pop rbp
ret