Function at 0x14006376f
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
xor r12d, r12d
mov r14, qword [rbp + 0x80]
mov qword [rbp + 0x50], rcx
mov r15, r9
mov dword [rbp + 0x58], edx
mov qword [rbp + 0x60], r8
test r9, r9
je 0x14006384c
xor eax, eax
mov r13, rax
lea rax, [rax + 1]
mov r12, qword [r15 + rax*8 - 8]
test r12, r12
jne 0x1400637a7
mov dword [rbp - 4], r13d
test r13d, r13d
je 0x14006384c
lea rcx, [r13*8]
lea rax, [rcx + 0xf]
and rax, 0xfffffffffffffff0
call fcn.14006aac0
lea r9, [0x1400636fe]
mov r8d, 8
sub rsp, rax
mov rsi, r15
mov rdx, r13
lea rbx, [rsp + 0x50]
mov rdi, rbx
rep movsb byte [rdi], byte [rsi]
mov rcx, rbx
xor edi, edi
mov esi, 1
call sub.msvcrt.dll_qsort
mov rcx, qword [r15 + rdi*8]
inc rdi
call sub.msvcrt.dll_strlen
lea esi, [rsi + rax + 1]
cmp dword [rbp - 4], edi
jg 0x140063809
movsxd rcx, esi
movsxd r13, r13d
call fcn.1400644b3
lea rsi, [rbx + r13*8]
mov r12, rax
mov rcx, rax
mov rdx, qword [rbx]
add rbx, 8
call fcn.140064a40
lea rcx, [rax + 1]
cmp rbx, rsi
jne 0x140063833
mov byte [rax + 1], 0
mov rcx, qword [rbp + 0x50]
call sub.msvcrt.dll_strlen
mov rcx, qword [rbp + 0x50]
mov edx, 0x2f
mov rbx, rax
call sub.msvcrt.dll_strchr
test rax, rax
je 0x140063876
lea r15, [0x14014b954]
xor edx, edx
jmp 0x1400638de
mov rcx, qword [rbp + 0x50]
mov edx, 0x5c
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x14006386b
test byte [rbp + 0x58], 1
je 0x14006386b
lea rcx, str.PATH
call sub.msvcrt.dll_getenv
mov r15, rax
test rax, rax
je 0x14006386b
mov rcx, rax
xor edx, edx
cmp byte [rcx], 0
je 0x1400638de
mov rax, rcx
mov r8b, byte [rax]
cmp r8b, 0x3b
je 0x1400638c3
test r8b, r8b
je 0x1400638c3
inc rax
jmp 0x1400638b0
mov r9, rax
sub r9, rcx
cmp rdx, r9
cmovb rdx, r9
cmp r8b, 0x3b
jne 0x1400638d9
inc rax
mov rcx, rax
jmp 0x1400638a8
lea rcx, [rdx + rbx + 6]
call fcn.1400644b3
mov rbx, rax
mov r13, r15
mov al, byte [r13]
cmp al, 0x3b
je 0x1400638ff
test al, al
je 0x1400638ff
inc r13
jmp 0x1400638ee
mov rcx, r13
mov rdi, rbx
mov rsi, r15
sub rcx, r15
rep movsb byte [rdi], byte [rsi]
mov rcx, rdi
cmp r13, r15
je 0x14006391b
mov byte [rdi], 0x5c
inc rcx
mov rdx, qword [rbp + 0x50]
call sub.msvcrt.dll_strcpy
cmp byte [r13], 0x3b
jne 0x14006392e
inc r13
mov rsi, rbx
mov al, byte [rsi]
test al, al
je 0x140063943
cmp al, 0x2f
jne 0x14006393e
mov byte [rsi], 0x5c
inc rsi
jmp 0x140063931
lea rdi, str..com
mov r15, qword [rdi]
test r15, r15
je 0x1400639bc
mov byte [rsi], 0
mov rdx, r15
mov rcx, rbx
call sub.msvcrt.dll_strcat
xor edx, edx
mov rcx, rbx
xor r9d, r9d
mov qword [rsp + 0x30], rdx
mov r8d, 3
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x1400639b6
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r13
mov rsi, qword [rbp + 0x60]
xor ecx, ecx
movabs r10, 0x500000200
mov r9, rsi
jmp 0x140063a0c
add rdi, 8
jmp 0x14006394a
cmp byte [r13], 0
je 0x1400639cb
mov r15, r13
jmp 0x1400638eb
mov rcx, rbx
or rsi, 0xffffffffffffffff
xor ebx, ebx
call fcn.140074210
jmp 0x140063baa
cmp dl, 0x22
jbe 0x140063a1b
inc rax
mov dl, byte [r8 + rax]
test dl, dl
jne 0x1400639de
mov edx, eax
test eax, eax
je 0x140063a4b
xor edi, edi
test r11d, r11d
jne 0x140063a4b
add rax, rcx
lea ecx, [rdi + rdi + 1]
add r9, 8
movsxd rcx, ecx
add rcx, rax
mov r8, qword [r9]
test r8, r8
je 0x140063a6c
xor eax, eax
xor r11d, r11d
jmp 0x1400639e6
bt r10, rdx
jae 0x1400639e3
mov r11d, 1
cmp dl, 0x22
jne 0x1400639e3
lea rdx, [rax - 1]
inc rcx
cmp edx, 0xffffffff
je 0x140063a43
dec rdx
cmp byte [r8 + rdx + 1], 0x5c
je 0x140063a30
mov r11d, 1
jmp 0x1400639e3
dec edx
movsxd rdx, edx
cmp edx, 0xffffffff
je 0x140063a65
dec rdx
cmp byte [r8 + rdx + 1], 0x5c
jne 0x140063a65
inc rcx
jmp 0x140063a50
mov edi, 1
jmp 0x1400639fb
call fcn.1400644b3
movabs r9, 0x500000200
mov r15, rax
mov rdx, rax
mov rcx, qword [rsi]
test rcx, rcx
je 0x140063b59
xor eax, eax
mov r8b, byte [rcx + rax]
test r8b, r8b
je 0x140063aa9
cmp r8b, 0x22
ja 0x140063aa4
bt r9, r8
jb 0x140063aae
inc rax
jmp 0x140063a8f
xor r8d, r8d
jmp 0x140063ab4
mov r8d, 1
lea r10, [rdx + 1]
test eax, eax
je 0x140063ac4
xor r11d, r11d
test r8d, r8d
je 0x140063ad0
mov byte [rdx], 0x22
mov r11d, 1
mov rdx, r10
mov rax, rdx
or rdx, 0xffffffffffffffff
mov r8b, byte [rcx + rdx + 1]
test r8b, r8b
je 0x140063b1f
cmp r8b, 0x22
jne 0x140063b0e
mov r8, rdx
lea r10, [rax + 1]
cmp r8d, 0xffffffff
je 0x140063b08
cmp byte [rcx + r8], 0x5c
jne 0x140063b08
mov byte [r10 - 1], 0x5c
dec r8
mov rax, r10
jmp 0x140063aea
mov byte [rax], 0x5c
mov rax, r10
mov r8b, byte [rcx + rdx + 1]
inc rax
inc rdx
mov byte [rax - 1], r8b
jmp 0x140063ad7
movsxd rdx, edx
test r11d, r11d
je 0x140063b49
lea r8, [rax + 1]
cmp edx, 0xffffffff
je 0x140063b43
cmp byte [rcx + rdx], 0x5c
jne 0x140063b43
mov byte [r8 - 1], 0x5c
dec rdx
mov rax, r8
jmp 0x140063b27
mov byte [rax], 0x22
mov rax, r8
mov byte [rax], 0x20
lea rdx, [rax + 1]
add rsi, 8
jmp 0x140063a81
mov byte [rdx - 1], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x48], r14
mov rax, qword [rbp + 0x78]
mov rcx, rbx
or rsi, 0xffffffffffffffff
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov eax, dword [rbp + 0x70]
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140063baa
mov rcx, qword [r14 + 8]
call r13
mov rsi, qword [r14]
mov rcx, r12
call fcn.140074210
mov rcx, r15
call fcn.140074210
mov rcx, rbx
call fcn.140074210
mov rax, rsi
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret