Function at 0x10022490
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov r11, rsp
sub rsp, 0x578
mov rax, qword [0x10058650]
mov qword [rsp + 0x540], rax
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov rdi, qword [rsp + 0x5a0]
mov rbp, rdx
mov rdx, rcx
lea rcx, [rsp + 0x50]
mov qword [r11 - 0x28], r12
mov rsi, r9
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
xor r12d, r12d
lea rcx, [rsp + 0x98]
lea r8d, [r12 + 0x60]
xor edx, edx
mov dword [rsp + 0x90], r12d
call sub.msvcrt.dll_memset
xor eax, eax
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
cmp qword [rsi + 0x10], r12
mov rbx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov dword [rsp + 0x90], WSASetLastError
jbe 0x1002255a
mov rcx, qword [rsi + 8]
test rcx, rcx
mov rax, rcx
cmove rax, rbx
test rcx, rcx
cmove rcx, rbx
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xa0], rcx
lea rcx, [rsp + 0x141]
xor edx, edx
mov r8d, 0x3ff
mov word [rsp + 0xd0], 5
mov dword [rsp + 0xcc], 1
mov byte [rsp + 0x140], r12b
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x140]
test rcx, rcx
mov r8d, 0x400
cmove rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov r8, qword [sym.imp.msvcp60.dll_unsigned_long_long_unsigned___int64__const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea rcx, [rsp + 0x50]
mov r8, qword [r8]
xor edx, edx
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_char_const____ptr64____ptr64]
lea r8, [rsp + 0x50]
lea rdx, [0x100482dc]
lea rcx, [rsp + 0x120]
call sub.msvcp60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_char_const____ptr64__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64_
lea r8, [0x100482d8]
lea rcx, [rsp + 0x100]
mov rdx, rax
call sub.msvcp60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__char_const____ptr64_
lea rcx, [rsp + 0x50]
mov rdx, rax
call qword [sym.imp.msvcp60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
lea rcx, [rsp + 0x100]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x120]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
lea rdx, [0x100482e0]
lea rcx, [rsp + 0x50]
call qword [reloc.msvcp60.dll___Y__basic_string_DU__char_traits_D_std__V__allocator_D_2__std__QEAAAEAV01_PEBD_Z]
lea rcx, [rsp + 0x50]
mov rdx, rbp
call qword [reloc.msvcp60.dll___Y__basic_string_DU__char_traits_D_std__V__allocator_D_2__std__QEAAAEAV01_AEBV01__Z]
mov rbx, qword [rsp + 0x58]
lea rdx, [0x100482e8]
lea rcx, [rsp + 0x70]
test rbx, rbx
cmove rbx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call fcn.10027af0
lea rdx, str._comm__create_process_indesk__s_
mov rcx, rax
mov r8, rbx
call fcn.10027bf0
mov rdx, qword [rsp + 0x58]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
test rdx, rdx
cmove rdx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov r12, qword [rsp + 0x550]
mov rsi, qword [rsp + 0x560]
test eax, eax
mov rbp, qword [rsp + 0x568]
jne 0x1002272d
mov rbx, qword [rsp + 0x58]
lea rdx, [0x10048318]
lea rcx, [rsp + 0x70]
test rbx, rbx
cmove rbx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call fcn.10027af0
lea rdx, str._comm__create_process_indesk__s__failed
mov rcx, rax
mov r8, rbx
call fcn.10027bf0
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov eax, 0xffffffff
jmp 0x1002278a
mov rbx, qword [rsp + 0x58]
lea rdx, [0x10048350]
lea rcx, [rsp + 0x70]
test rbx, rbx
cmove rbx, qword [sym.imp.msvcp60.dll_char_const__private:_static_char_const____ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
call fcn.10027af0
lea rdx, str._comm__create_process_indesk__s__successed:_pid_d_0x_08x_
mov rcx, rax
mov rax, qword [rsp + 0x88]
mov r8, rbx
mov r9d, eax
mov dword [rsp + 0x20], eax
call fcn.10027bf0
test rdi, rdi
je 0x1002277d
mov eax, dword [rsp + 0x88]
mov dword [rdi], eax
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcp60.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
xor eax, eax
mov rdi, qword [rsp + 0x558]
mov rbx, qword [rsp + 0x570]
mov rcx, qword [rsp + 0x540]
call fcn.10042170
add rsp, 0x578
ret