Function at 0x140045690
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
movaps xmmword [rsp + 0x180], xmm6
mov rbx, r8
mov qword [rsp + 0x58], rdx
mov r12, rcx
mov rax, qword [0x140163028]
xor rax, rsp
mov qword [rsp + 0x178], rax
movaps xmm6, xmmword [0x140141df0]
lea rdi, [rsp + 0x160]
movaps xmmword [rdi], xmm6
lea rdx, str.LaunchProcess
lea r8, str..._.._base_process_launch_win.cc
lea rsi, [rsp + 0xe0]
mov rcx, rsi
mov r9d, 0xee
call fcn.140006710
lea r8, [0x14016940c]
mov rcx, rdi
mov rdx, rsi
call fcn.140046330
movabs r13, 0xaaaaaaaaaaaaaaaa
mov qword [rsi + 0x70], r13
movaps xmmword [rsi + 0x60], xmm6
movaps xmmword [rsi + 0x50], xmm6
movaps xmmword [rsi + 0x40], xmm6
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
lea rcx, [rsp + 0xe0]
call fcn.140045e90
cmp dword [rbx + 0x24], 1
sete r15b
mov rbp, qword [rbx + 0x28]
mov rsi, qword [rbx + 0x30]
cmp rbp, rsi
je 0x140045856
mov rax, rsi
sub rax, rbp
sar rax, 3
cmp rax, 0x1fffffff
ja 0x140045803
mov rcx, qword [rbp]
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x140045cd1
lea rax, [rbp + 8]
cmp rax, rsi
je 0x1400457c4
mov rcx, qword [rax]
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x140045d75
add rbp, 0x10
cmp rbp, rsi
jne 0x140045c92
lea rcx, [rsp + 0xe0]
mov edx, 1
call fcn.1400461b0
test al, al
je 0x140045803
mov r9d, dword [rbx + 0x30]
mov r8, qword [rbx + 0x28]
sub r9d, r8d
and r9d, 0xfffffff8
lea rcx, [rsp + 0xe0]
mov edx, 0x20002
call fcn.140045f80
test al, al
jne 0x140045da7
mov rcx, r12
xor edx, edx
call fcn.140045ed0
lea rcx, [rsp + 0xe0]
call fcn.140045f10
lea rcx, [rsp + 0x160]
call fcn.140046080
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140107cc0
mov rax, r12
movaps xmm6, xmmword [rsp + 0x180]
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor esi, esi
cmp byte [rbx + 0x21], 0
jne 0x140045d03
cmp byte [rbx + 0x50], 0
jne 0x140045d10
mov eax, dword [rsp + 0x124]
mov ecx, eax
or ecx, 1
mov dword [rsp + 0x124], ecx
mov edx, dword [rbx + 0x40]
cmp edx, 3
jne 0x140045d24
mov cx, 2
mov word [rsp + 0x128], cx
mov rbp, qword [rbx + 0x60]
mov rdx, qword [rbx + 0x68]
mov rcx, rbp
or rcx, rdx
jne 0x1400458b0
cmp qword [rbx + 0x70], 0
je 0x1400458d8
xor edx, edx
or eax, 0x101
mov dword [rsp + 0x124], eax
mov qword [rsp + 0x138], rbp
mov qword [rsp + 0x140], rdx
mov rax, qword [rbx + 0x70]
mov qword [rsp + 0x148], rax
cmp qword [rbx + 0x58], 0
jne 0x140045d50
mov ebp, esi
or ebp, 0x1000000
cmp byte [rbx + 0x78], 0
cmove ebp, esi
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], 0
movzx eax, byte [rbx + 0x1f]
test al, al
jns 0x14004591b
mov rax, qword [rbx + 0x10]
mov r14, qword [rbx + 8]
jmp 0x14004591f
lea r14, [rbx + 8]
test rax, rax
cmove r14, rax
lea rsi, [rsp + 0xe8]
lea rdi, [rsp + 0xa0]
mov qword [rdi + 0x10], r13
movaps xmmword [rdi], xmm6
mov rcx, rdi
mov rdx, qword [rsp + 0x58]
call fcn.140027b30
mov rdx, qword [rbx + 0x48]
test rdx, rdx
jne 0x1400459fb
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], 0
cmp byte [rbx + 0x98], 0
jne 0x140045db4
cmp qword [rbx + 0x90], 0
je 0x140045df5
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x140045c2f
mov rdi, rax
lea r8, [rbx + 0x80]
lea rcx, [rsp + 0x60]
mov rdx, rax
call fcn.140046790
cmp byte [rsp + 0x97], 0
js 0x140045c59
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x80], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
cmp byte [rsp + 0x97], 0
jns 0x140045bab
mov rax, qword [rsp + 0x80]
jmp 0x140045bb3
lea rcx, [rsp + 0x80]
mov qword [rcx], 0
xor r8d, r8d
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x140045d66
mov r8, rsi
or ebp, 0x400
mov rdx, qword [rsp + 0x80]
movzx eax, r15b
cmp byte [rsp + 0xb7], 0
jns 0x140045a41
mov rdi, qword [rsp + 0xa0]
mov rcx, qword [rbx + 0x48]
lea rsi, [rsp + 0xc0]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], 0
xor edx, edx
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
mov rcx, qword [rsp + 0x80]
call sub.USERENV.dll_DestroyEnvironmentBlock
test esi, esi
je 0x140045d66
lea rcx, [rsp + 0x80]
mov qword [rcx + 0x10], r13
movaps xmmword [rcx], xmm6
lea rdx, [rsp + 0xc0]
call fcn.140045f50
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x140045ad2
mov rdx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x140045b67
cmp byte [rbx + 0x79], 0
je 0x140045aed
mov rcx, qword [rsp + 0x80]
call fcn.140045ff0
mov ecx, eax
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
cmp byte [rbx], 0
je 0x140045b05
mov rcx, qword [rsp + 0x80]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [rsp + 0x90]
mov rcx, qword [0x140169470]
test rcx, rcx
je 0x140045b22
mov r8, qword [rsp + 0x58]
call fcn.140046530
lea rcx, [rsp + 0x80]
call fcn.140045fc0
mov rcx, r12
mov rdx, rax
call fcn.140045ed0
lea rcx, [rsp + 0x80]
call fcn.140046270
cmp byte [rsp + 0xb7], 0
jns 0x14004580d
mov rcx, qword [rsp + 0xa0]
call fcn.140105028
jmp 0x14004580d
lea rsi, [rsp + 0x60]
movaps xmmword [rsi], xmm6
lea rcx, [rsp + 0x80]
call fcn.140045fc0
mov rcx, rsi
mov rdx, rax
call fcn.140045ed0
mov rcx, rsi
mov edx, 1
mov r8b, 1
call fcn.1400466a0
mov rcx, r12
xor edx, edx
call fcn.140045ed0
mov rcx, rsi
call fcn.14002eda0
jmp 0x140045b3a
lea rax, [rsp + 0x80]
or ebp, 0x400
movzx ecx, r15b
cmp byte [rsp + 0xb7], 0
jns 0x140045bd1
mov rdx, qword [rsp + 0xa0]
jmp 0x140045bd9
lea rdx, [rsp + 0xa0]
lea rdi, [rsp + 0xc0]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ecx
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140045c2f
cmp byte [rsp + 0x97], 0
jns 0x140045a97
mov rcx, qword [rsp + 0x80]
call fcn.140105028
jmp 0x140045a97
mov rcx, r12
xor edx, edx
call fcn.140045ed0
cmp byte [rsp + 0x97], 0
jns 0x140045b47
mov rcx, qword [rsp + 0x80]
call fcn.140105028
jmp 0x140045b47
mov rax, qword [rsp + 0x80]
mov word [rax], 0
mov qword [rsp + 0x88], 0
cmp byte [rsp + 0x97], 0
jns 0x1400459bd
mov rcx, qword [rsp + 0x80]
call fcn.140105028
jmp 0x1400459bd
mov r15, qword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea r14, str..._.._base_process_launch_win.cc
lea rdi, [rsp + 0xc0]
mov rcx, qword [rbp]
mov edx, 1
mov r8d, 1
call r15
test eax, eax
je 0x140045e15
add rbp, 8
cmp rsi, rbp
je 0x1400457c4
jmp 0x140045ca8
lea rdx, str..._.._base_process_launch_win.cc
lea rdi, [rsp + 0xc0]
mov rcx, rdi
mov r8d, 0x102
call fcn.14009e7d0
mov rcx, rdi
call fcn.14009e7f0
mov rcx, rdi
call fcn.14009e800
jmp 0x140045792
or byte [rsp + 0x124], 0x80
jmp 0x140045862
lea rax, [0x1401458ca]
mov qword [rsp + 0xf8], rax
jmp 0x14004586c
mov cx, 0xa
cmp edx, 5
ja case.0x140045d42.1
mov edx, edx
lea rbp, [0x140045e74]
movsxd rdx, dword [rbp + rdx*4]
add rdx, rbp
jmp rdx
movzx ecx, byte [rbx + 0x20]
xor ecx, 1
jmp case.0x140045d42.1
call fcn.14001a020
lea ecx, [rsi + 0x1000000]
cmp eax, 5
cmovl esi, ecx
jmp 0x1400458e3
mov rcx, r12
xor edx, edx
call fcn.140045ed0
jmp 0x140045b47
lea rdx, str..._.._base_process_launch_win.cc
lea rdi, [rsp + 0xc0]
mov rcx, rdi
mov r8d, 0x102
call fcn.14009e7d0
mov rcx, rdi
call fcn.14009e7f0
mov rcx, rdi
call fcn.14009e800
jmp 0x1400457b7
mov r15b, 1
mov esi, 0x80000
jmp 0x140045858
lea r8, [rbx + 0x80]
lea rdx, [0x1401458cc]
lea rcx, [rsp + 0x60]
call fcn.140046790
cmp byte [rsp + 0x97], 0
js 0x140045e3b
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x80], xmm0
jmp 0x1400459e0
xor eax, eax
jmp 0x140045bb9
mov cx, 1
jmp case.0x140045d42.1
mov cx, 7
jmp case.0x140045d42.1
xor ecx, ecx
jmp case.0x140045d42.1
mov rcx, rdi
mov rdx, r14
mov r8d, 0x102
call fcn.14009e7d0
mov rcx, rdi
call fcn.14009e7f0
mov rcx, rdi
call fcn.14009e800
jmp 0x140045cc2
mov rax, qword [rsp + 0x80]
mov word [rax], 0
mov qword [rsp + 0x88], 0
cmp byte [rsp + 0x97], 0
jns 0x140045dd6
mov rcx, qword [rsp + 0x80]
call fcn.140105028
jmp 0x140045dd6