Function at 0x140099d10
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Get common file path
Query environment variable

Disassembly:
push rbp
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 8]
sub rsp, 0x108
mov r14, rdx
mov r15, rcx
xor edx, edx
mov eax, 0xa
mov qword [rbp + 0x58], rdx
mov rdi, r8
mov qword [rsp + 0x50], rdx
mov r13d, edx
mov qword [r14 + 8], rcx
mov r12d, edx
mov dword [r14 + 0x10], eax
lea rcx, [r14 + 0x20]
mov dword [r14 + 0x58], 8
lea rax, [r15 + 0x10]
mov qword [rcx], rax
mov rax, qword [r15 + 0x18]
mov qword [r14 + 0x28], rax
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x50], rdx
mov qword [rax], rcx
lea rax, [r14 + 0xe0]
mov qword [r15 + 0x18], rcx
mov qword [r14 + 0x60], rdx
mov qword [rax], rdx
mov dword [r14 + 0x30], 0xffffffff
mov dword [r14 + 0x68], edx
mov dword [r14 + 0xe8], edx
mov qword [r14 + 0xf0], 0xffffffffffffffff
mov qword [r14 + 0xf8], 0xffffffffffffffff
mov byte [r14 + 0x100], dl
mov dword [r14 + 0x78], reloc.WS2_32.dll_ntohl
mov qword [r14 + 0xb0], rdx
mov qword [r14 + 0x70], r14
mov qword [rsp + 0x60], rax
mov rax, qword [r8]
mov qword [r14 + 0x60], rax
test byte [r8 + 0x28], 3
mov qword [rsp + 0x58], rdx
mov qword [rbp + 0x40], rdx
je 0x140099dfc
mov eax, 0xfffff02f
add rsp, 0x108
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
mov rcx, qword [r8 + 8]
test rcx, rcx
je 0x14009a2ba
cmp qword [r8 + 0x10], rdx
je 0x14009a2ba
mov qword [rsp + 0x100], rbx
lea rdx, [rbp + 0x58]
mov qword [rsp + 0xf8], rsi
call fcn.14009a300
mov ebx, eax
test eax, eax
jne 0x140099eaa
mov edx, dword [rdi + 0x28]
lea r8, [rsp + 0x50]
mov rcx, qword [rdi + 0x10]
and edx, 4
call fcn.140098dd0
mov ebx, eax
test eax, eax
jne 0x140099eaa
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x140099e68
lea rdx, [rbp + 0x48]
call fcn.140099090
mov r13, qword [rbp + 0x48]
mov ebx, eax
test eax, eax
jne 0x140099eaa
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x140099e8e
lea rdx, [rbp + 0x50]
call fcn.14009a300
mov r12, qword [rbp + 0x50]
mov ebx, eax
test eax, eax
je 0x140099f5d
mov rsi, qword [rbp + 0x40]
jmp 0x140099ead
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
test eax, eax
jne 0x140099f23
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rsi, r12
xor r15d, r15d
mov rcx, qword [rbp + 0x58]
call fcn.140090ac0
mov rcx, rsi
call fcn.140090ac0
mov rcx, qword [rsp + 0x50]
call fcn.140090ac0
mov rcx, r12
call fcn.140090ac0
mov rcx, r13
call fcn.140090ac0
mov rcx, qword [rsp + 0x58]
call fcn.140090ac0
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140099efa
call fcn.140092060
mov qword [rdi], r15
mov ecx, ebx
call fcn.14009c1d0
mov rbx, qword [rsp + 0x100]
mov rsi, qword [rsp + 0xf8]
add rsp, 0x108
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
mov rcx, rbx
add rcx, rcx
call fcn.140090af0
mov r12, rax
test rax, rax
jne 0x140099f42
mov rsi, qword [rbp + 0x40]
lea ebx, [rax + 0xe]
jmp 0x140099ead
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140099ff9
cmp eax, ebx
jae 0x140099ff9
mov rcx, r13
test r13, r13
je 0x140099fe1
mov edx, 0xffdf
nop word [rax + rax]
movzx eax, word [rcx]
test ax, ax
je 0x140099fe1
sub ax, 0x50
test dx, ax
jne 0x140099faf
movzx eax, word [rcx + 2]
sub ax, 0x41
test dx, ax
jne 0x140099faf
movzx eax, word [rcx + 4]
sub ax, 0x54
test dx, ax
jne 0x140099faf
movzx eax, word [rcx + 6]
sub ax, 0x48
test dx, ax
jne 0x140099faf
cmp word [rcx + 8], 0x3d
je 0x140099fd8
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140099fc0
lea rcx, [rcx + rax*2]
add rcx, 2
jne 0x140099f70
jmp 0x140099fe1
lea rsi, [rcx + 0xa]
test rsi, rsi
jne 0x14009a049
xor r8d, r8d
lea rcx, [0x1400e0ea0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
jne 0x14009a00a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [rbp + 0x40]
mov ebx, eax
jmp 0x140099ead
mov rcx, rbx
add rcx, rcx
call fcn.140090af0
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x14009a02b
mov rsi, qword [rbp + 0x40]
lea ebx, [rax + 0xe]
jmp 0x140099ead
mov r8d, ebx
lea rcx, [0x1400e0ea0]
mov rdx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140099ff9
cmp eax, ebx
jae 0x140099ff9
lea r8, [r14 + 0xe0]
mov rdx, rdi
mov rcx, r15
call fcn.140091bf0
mov ebx, eax
test eax, eax
jne 0x140099e88
mov rcx, qword [rbp + 0x58]
mov r8, rsi
mov rdx, r12
call fcn.1400994f0
xor r15d, r15d
mov qword [rbp + 0x40], rax
test rax, rax
jne 0x14009a08b
lea ebx, [rax + 2]
mov rsi, rax
jmp 0x140099eb0
mov rcx, qword [r14 + 0xe0]
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x80], 0x68
mov qword [rbp - 0x78], r15
mov dword [rbp - 0x44], 0x101
call fcn.1400920d0
mov rcx, qword [r14 + 0xe0]
xor edx, edx
mov qword [rbp - 0x38], rcx
mov word [rbp - 0x3e], ax
call fcn.1400920c0
mov rcx, qword [r14 + 0xe0]
mov edx, 1
mov qword [rbp - 0x30], rax
call fcn.1400920c0
mov rcx, qword [r14 + 0xe0]
mov edx, 2
mov qword [rbp - 0x28], rax
call fcn.1400920c0
mov r15d, dword [rdi + 0x28]
xor edx, edx
mov qword [rbp - 0x20], rax
mov r10d, 0x400
test r15b, 0x30
je 0x14009a14b
movsxd r11, dword [rdi + 0x2c]
mov r8d, edx
test r11d, r11d
jle 0x14009a14b
mov r9d, edx
mov rdx, qword [rdi + 0x30]
nop word [rax + rax]
test byte [rdx], 2
jne 0x14009a149
mov ecx, r10d
lea eax, [r11 - 1]
bts ecx, 0x1b
cmp r8d, eax
cmovne ecx, r10d
inc r8d
inc r9
add rdx, 0x10
mov r10d, ecx
cmp r9, r11
jl 0x14009a120
xor edx, edx
test r15b, 0x50
jne 0x14009a15c
mov eax, 0xa
mov word [rbp - 0x40], ax
jmp 0x14009a160
mov word [rbp - 0x40], dx
mov rsi, qword [rbp + 0x40]
lea rcx, [rsp + 0x68]
mov rdx, qword [rsp + 0x50]
mov eax, r10d
mov qword [rsp + 0x48], rcx
or eax, 0x208
lea rcx, [rbp - 0x80]
and r15b, 8
mov qword [rsp + 0x40], rcx
mov rcx, rsi
cmove eax, r10d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14009a1c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140099ead
mov rax, qword [rsp + 0x68]
mov qword [r14 + 0xf8], rax
mov eax, dword [rsp + 0x78]
mov dword [r14 + 0x68], eax
test byte [rdi + 0x28], 8
jne 0x14009a214
lea rdx, [0x140099930]
lea rcx, [0x14010d0d8]
call fcn.14009a610
mov rdx, qword [rsp + 0x68]
mov rcx, qword [0x14010d0d0]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x14009a214
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14009a2d1
xor r15d, r15d
mov edx, r15d
cmp dword [rdi + 0x2c], edx
jle 0x14009a256
mov r8d, r15d
mov rax, qword [rdi + 0x30]
test byte [r8 + rax], 1
je 0x14009a24b
mov rcx, qword [r8 + rax + 8]
cmp dword [rcx + 0x10], 7
jne 0x14009a24b
cmp dword [rcx + 0x110], r15d
je 0x14009a24b
mov eax, dword [rsp + 0x78]
mov dword [rcx + 0x1e0], eax
inc edx
add r8, 0x10
cmp edx, dword [rdi + 0x2c]
jl 0x14009a222
mov rdx, qword [r14 + 0xf8]
lea r8, [0x140098d80]
mov dword [rsp + 0x28], select
lea rcx, [r14 + 0xf0]
mov r9, r14
mov dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x14009a2e0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [r14 + 0x58]
test al, 4
jne 0x140099eb0
or eax, 4
mov dword [r14 + 0x58], eax
test al, 8
je 0x140099eb0
mov rax, qword [r14 + 8]
inc dword [rax + 8]
jmp 0x140099eb0
mov eax, 0xfffff019
add rsp, 0x108
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
lea rdx, [0x1400e1090]
mov ecx, eax
call fcn.14009c120
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [0x1400e10b0]
call fcn.14009c120
int3