Function at 0x1400125f0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
xor edi, edi
mov r14, rcx
mov r12d, edx
mov rsi, r8
mov r15, r9
test r9, r9
je 0x1400126e9
mov rdi, qword [r9]
test rdi, rdi
je 0x1400126e9
mov eax, 1
mov rdi, rax
add rax, 1
cmp qword [r15 + rax*8 - 8], 0
jne 0x14001262d
lea r8, [rdi*8]
lea rax, [r8 + 0xf]
and rax, 0xfffffffffffffff0
call fcn.140015af0
sub rsp, rax
mov rdx, r15
lea r13d, [rdi - 1]
lea rbx, [rsp + 0x50]
mov rcx, rbx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov rdx, rdi
lea r9, [0x140012570]
mov rcx, rbx
mov r8d, 8
call sub.api_ms_win_crt_utility_l1_1_0.dll_qsort
lea rax, [r13*8]
mov r13d, 1
mov qword [rbp - 8], rax
lea rdi, [rax + r15 + 8]
nop word [rax + rax]
mov rcx, qword [r15]
add r15, 8
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea r13d, [r13 + rax + 1]
cmp rdi, r15
jne 0x1400126a0
movsxd rcx, r13d
call fcn.1400136c0
mov rdi, rax
mov rax, qword [rbp - 8]
mov rcx, rdi
lea r13, [rbx + rax + 8]
nop dword [rax]
mov rdx, qword [rbx]
add rbx, 8
call fcn.1400137c0
lea rcx, [rax + 1]
cmp rbx, r13
jne 0x1400126d0
mov byte [rax + 1], 0
mov rcx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov edx, 0x2f
mov rcx, r14
mov rbx, rax
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
test rax, rax
je 0x140012be2
lea r12, [0x14001d2d4]
xor r8d, r8d
lea rcx, [r8 + rbx + 6]
lea r15, str..com
call fcn.1400136c0
mov qword [rbp + 0x60], rsi
mov rsi, r12
mov r13, qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
movzx eax, byte [r12]
mov qword [rbp - 8], rdi
mov rdi, rsi
cmp al, 0x3b
je 0x140012b9f
test al, al
je 0x140012b9f
nop word [rax + rax]
movzx eax, byte [rdi + 1]
add rdi, 1
cmp al, 0x3b
je 0x140012768
test al, al
jne 0x140012758
mov r12, rdi
mov rcx, rbx
mov rdx, rsi
sub r12, rsi
mov r8, r12
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
lea r8, [rbx + r12]
mov rcx, r8
cmp rdi, rsi
je 0x140012790
mov byte [r8], 0x5c
add rcx, 1
mov rdx, r14
mov r12, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
xor eax, eax
cmp byte [rdi], 0x3b
sete al
add rdi, rax
movzx eax, byte [rbx]
test al, al
je 0x1400127c7
nop dword [rax]
cmp al, 0x2f
jne 0x1400127b9
mov byte [r12], 0x5c
movzx eax, byte [r12 + 1]
add r12, 1
test al, al
jne 0x1400127b0
lea rsi, str..com
mov rdx, r15
jmp 0x1400127e9
mov rdx, qword [rsi + 8]
add rsi, 8
test rdx, rdx
je 0x140012b86
mov byte [r12], 0
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov r8d, 3
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call r13
cmp rax, 0xffffffffffffffff
je 0x1400127d8
mov rsi, qword [rbp + 0x60]
mov rdi, qword [rbp - 8]
mov rcx, rax
mov r14, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r14
mov rax, qword [rsi]
test rax, rax
je 0x140012c87
mov qword [rbp - 8], rdi
lea rdx, [rsi + 8]
xor ecx, ecx
mov r13d, 2
movabs r12, 0x500000200
nop dword [rax]
movzx r9d, byte [rax]
lea r11, [rax - 1]
mov r10d, 0xffffffff
xor r15d, r15d
test r9b, r9b
jne 0x14001288b
jmp 0x140012b35
mov r11, r8
mov edi, r10d
add r10d, 1
cmp r9b, 0x22
ja 0x1400128a2
bt r12, r9
jb 0x1400129e0
movzx r9d, byte [r11 + 2]
lea r8, [r11 + 1]
test r9b, r9b
jne 0x140012888
mov r9, r13
sub r9, rax
add r11, r9
test r15d, r15d
jne 0x140012b08
add rcx, r11
mov eax, 1
add rdx, 8
add rcx, rax
mov rax, qword [rdx - 8]
test rax, rax
jne 0x140012868
mov rdi, qword [rbp - 8]
call fcn.1400136c0
mov r10, qword [rsi]
mov rdx, rax
test r10, r10
je 0x140012c9d
add rsi, 8
mov r9, rax
movabs r11, 0x500000200
nop dword [rax + rax]
movzx r8d, byte [r10]
mov ecx, 1
mov eax, r8d
test r8b, r8b
jne 0x140012932
jmp 0x14001293c
add rcx, 1
movzx eax, byte [r10 + rcx - 1]
test al, al
je 0x140012b40
cmp al, 0x22
ja 0x140012920
bt r11, rax
jae 0x140012920
mov byte [r9], 0x22
movzx r8d, byte [r10]
lea rax, [r9 + 1]
test r8b, r8b
je 0x140012c77
mov r13d, 1
lea rcx, [r10 - 1]
mov r12d, 0xffffffff
jmp 0x140012986
movzx r8d, byte [rcx + 1]
lea rax, [r15 + 1]
add rcx, 1
mov byte [r15], r8b
movzx r8d, byte [rcx + 1]
test r8b, r8b
je 0x140012a38
mov r9d, r12d
mov r15, rax
add r12d, 1
cmp r8b, 0x22
jne 0x140012968
cmp r9d, 0xffffffff
je 0x140012bd2
lea r15, [rax + r9 + 1]
mov r8, rcx
jmp 0x1400129c1
mov byte [rax - 1], 0x5c
sub r8, 1
cmp r15, rax
je 0x140012ae0
cmp byte [r8], 0x5c
mov r9, rax
lea rax, [rax + 1]
je 0x1400129b0
mov byte [r9], 0x5c
lea r15, [r9 + 1]
jmp 0x140012968
mov r15d, 1
cmp r9b, 0x22
jne 0x1400128a2
cmp edi, 0xffffffff
je 0x140012bc0
lea r8, [rcx + 1]
mov r9, r11
add rdi, r8
jmp 0x140012a19
sub r9, 1
cmp rdi, r8
je 0x140012af0
add r8, 1
cmp byte [r9], 0x5c
mov r15, rcx
mov rcx, r8
je 0x140012a08
lea rcx, [r15 + 1]
mov r15d, 1
jmp 0x1400128a2
test r13d, r13d
jne 0x140012b50
mov r10, qword [rsi]
add rsi, 8
mov byte [rax], 0x20
lea r9, [rax + 1]
test r10, r10
jne 0x140012908
mov rax, qword [rbp + 0x80]
mov byte [r9 - 1], 0
xor r8d, r8d
xor r9d, r9d
mov rcx, rbx
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x78]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], rdi
mov eax, dword [rbp + 0x70]
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140012cc5
mov rax, qword [rbp + 0x80]
mov rcx, qword [rax + 8]
call r14
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rax, qword [rbp + 0x80]
mov rax, qword [rax]
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov r9, r15
mov byte [r9], 0x5c
lea r15, [r9 + 1]
jmp 0x140012968
mov r15, rdi
lea rcx, [r15 + 1]
mov r15d, 1
jmp 0x1400128a2
movsxd r9, r10d
mov r10d, r10d
add rax, r9
lea r9, [rcx + r10 + 1]
jmp 0x140012b2d
add rcx, 1
sub rax, 1
cmp rcx, r9
je 0x140012b32
cmp byte [rax], 0x5c
je 0x140012b20
add rcx, r11
mov eax, 3
jmp 0x1400128ca
mov rax, r9
xor r13d, r13d
jmp 0x140012957
movsxd rcx, r12d
mov r12d, r12d
add rcx, r10
lea r9, [rax + r12 + 1]
jmp 0x140012b6d
mov byte [rax - 1], 0x5c
sub rcx, 1
cmp r9, rax
je 0x140012bb0
cmp byte [rcx], 0x5c
mov r8, rax
lea rax, [rax + 1]
je 0x140012b60
mov byte [r8], 0x22
lea rax, [r8 + 1]
jmp 0x140012a41
movzx eax, byte [rdi]
test al, al
je 0x140012ca5
mov rsi, rdi
mov rdi, rsi
cmp al, 0x3b
jne 0x14001274a
mov rcx, rbx
jmp 0x140012790
mov r8, r9
mov byte [r8], 0x22
lea rax, [r8 + 1]
jmp 0x140012a41
mov r15, rcx
lea rcx, [r15 + 1]
mov r15d, 1
jmp 0x1400128a2
mov r9, rax
mov byte [r9], 0x5c
lea r15, [r9 + 1]
jmp 0x140012968
mov edx, 0x5c
mov rcx, r14
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
test rax, rax
jne 0x14001270a
and r12d, 1
je 0x14001270a
lea rcx, str.PATH
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov r12, rax
test rax, rax
je 0x14001270a
movzx edx, byte [rax]
test dl, dl
je 0x140012711
mov rcx, rax
xor r8d, r8d
mov rax, rcx
cmp dl, 0x3b
je 0x140012c71
nop dword [rax + rax]
movzx edx, byte [rax + 1]
add rax, 1
cmp dl, 0x3b
je 0x140012c49
test dl, dl
jne 0x140012c38
mov r9, rax
sub r9, rcx
mov rcx, rax
cmp r8, r9
cmovb r8, r9
cmp dl, 0x3b
je 0x140012c71
movzx edx, byte [rcx]
test dl, dl
je 0x140012714
mov rax, rcx
cmp dl, 0x3b
jne 0x140012c38
lea rcx, [rax + 1]
jmp 0x140012c5e
mov r8, rax
mov byte [r8], 0x22
lea rax, [r8 + 1]
jmp 0x140012a41
xor ecx, ecx
call fcn.1400136c0
mov r10, qword [rsi]
mov rdx, rax
test r10, r10
jne 0x1400128f2
mov r9, rax
jmp 0x140012a58
mov rdi, qword [rbp - 8]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rax, 0xffffffffffffffff
jmp 0x140012ace
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x140012cb9