Function at 0x10002affc
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x1fd0
call fcn.100002240
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x2000], rbx
mov qword [rsp + 0x2010], rbp
mov rax, qword [0x100090120]
xor rax, rsp
mov qword [rsp + 0x1fc0], rax
mov rsi, rdx
mov r12, rcx
mov r14d, 0x7d0
mov dword [rsp + 0x48], r14d
lea rcx, [0x100066a5c]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rsp + 0x38], rax
xor r13d, r13d
cmp rax, r13
jne 0x10002b079
mov ecx, 0x8007000e
call fcn.1000242ec
nop
jmp 0x10002b078
nop
lea rcx, [0x100066a5c]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x40], rax
cmp rax, r13
jne 0x10002b0a1
mov ecx, 0x8007000e
call fcn.1000242ec
nop
jmp 0x10002b0a0
nop
mov r9d, 0x30000000
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x1020]
mov rcx, qword [rsi]
call qword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
lea rsi, [rsp + 0x1032]
mov bpl, r13b
cmp word [rsp + 0x1032], r13w
je 0x10002b198
movzx ecx, word [rsi]
call qword [sym.imp.msvcrt.dll_iswspace]
cmp eax, r13d
je 0x10002b0ea
cmp bpl, r13b
je 0x10002b12a
movzx eax, word [rsi]
mov word [rsp + 0x30], ax
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.10000ae58
cmp eax, r13d
jne 0x10002b17e
cmp word [rsi], 0x27
je 0x10002b118
cmp word [rsi], 0x22
jne 0x10002b120
cmp bpl, r13b
jne 0x10002b12a
mov bpl, 1
add rsi, 2
cmp word [rsi], r13w
jne 0x10002b0d7
cmp word [rsi], r13w
je 0x10002b177
add rsi, 2
cmp rsi, rbx
je 0x10002b177
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp rsi, r13
je 0x10002b168
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x40], rax
cmp rax, r13
jne 0x10002b177
mov ecx, 0x8007000e
call fcn.1000242ec
int3
mov rbx, r13
mov qword [rsp + 0x40], rbx
mov rdi, qword [rsp + 0x38]
jmp 0x10002b198
mov rdi, qword [rsp + 0x38]
jmp 0x10002b198
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x10002b34f
mov r8d, r14d
lea rdx, [rsp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, r13d
je 0x10002b1f2
cmp eax, r14d
ja 0x10002b1f2
lea rax, [rsp + 0x80]
cmp rax, rdi
je 0x10002b1f2
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rsp + 0x80]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rsp + 0x38], rax
cmp rax, r13
jne 0x10002b1f2
mov ecx, 0x8007000e
call fcn.1000242ec
int3
mov r8d, r14d
lea rdx, [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, r13d
je 0x10002b24c
cmp eax, r14d
ja 0x10002b24c
lea rax, [rsp + 0x80]
cmp rax, rbx
je 0x10002b24c
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rsp + 0x80]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x40], rax
cmp rax, r13
jne 0x10002b24c
mov ecx, 0x8007000e
call fcn.1000242ec
int3
lea rcx, [rsp + 0x58]
mov rax, qword [str.getWmvMuiPath]
mov qword [rcx], rax
mov rax, qword [0x10006cc20]
mov qword [rcx + 8], rax
mov rax, qword [0x10006cc28]
mov qword [rcx + 0x10], rax
mov eax, dword [0x10006cc30]
mov dword [rcx + 0x18], eax
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r13d
jne 0x10002b2a0
mov r8d, 0x201
mov rdx, rbx
mov rcx, r12
call fcn.10002b384
jmp 0x10002b2c6
mov rax, qword [0x100090140]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r13
mov r9, rbx
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 8]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [0x100091a04], r13d
je 0x10002b33c
cmp byte [0x1000900ea], r13b
je 0x10002b2f3
mov al, byte [0x100091a08]
cmp al, 4
jae 0x10002b2e7
cmp al, r13b
jne 0x10002b33c
bt dword [0x100091a00], 0x10
jb 0x10002b321
jmp 0x10002b33c
mov al, byte [0x100091a08]
cmp al, 4
jae 0x10002b302
cmp al, r13b
jne 0x10002b33c
bt qword [0x1000919f0], 0x10
jae 0x10002b33c
mov rcx, qword [0x1000919f8]
mov rax, rcx
and eax, 0x10000
cmp rax, rcx
jne 0x10002b33c
lea r8, [0x10006c028]
lea rdx, [0x10006c1c8]
mov rcx, qword [0x100090180]
call fcn.100024724
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x1fc0]
xor rcx, rsp
call fcn.100001100
lea r11, [rsp + 0x1fd0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret