Function at 0x1400c5c70
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Get common file path
Query environment variable

Disassembly:
push rbp
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 8]
sub rsp, 0x108
mov r15, rdx
mov qword [rdx + 8], rcx
mov dword [rdx + 0x58], 8
mov rdi, r8
xor r8d, r8d
mov eax, 0xa
mov dword [rdx + 0x10], eax
mov r14, rcx
add rdx, 0x20
mov qword [rsp + 0x50], r8
add rcx, 0x10
mov qword [rsp + 0x58], r8
mov qword [rbp + 0x50], r8
mov r13d, r8d
mov qword [rbp + 0x58], r8
mov r12d, r8d
mov qword [rdx], rcx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov qword [rsp + 0x60], r8
mov qword [rbp + 0x40], r8
mov qword [rax], rdx
mov qword [rcx + 8], rdx
mov qword [r15 + 0x60], r8
mov dword [r15 + 0x30], 0xffffffff
mov dword [r15 + 0x68], r8d
mov dword [r15 + 0xe8], r8d
mov qword [r15 + 0xf0], 0xffffffffffffffff
mov qword [r15 + 0xf8], 0xffffffffffffffff
mov byte [r15 + 0x100], r8b
mov dword [r15 + 0x78], select
mov qword [r15 + 0xb0], r8
mov qword [r15 + 0x70], r15
mov rax, qword [rdi]
mov qword [r15 + 0x60], rax
test byte [rdi + 0x28], 3
mov qword [rbp + 0x48], r8
je 0x1400c5d50
mov eax, 0xfffff02f
add rsp, 0x108
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400c61fa
cmp qword [rdi + 0x10], r8
je 0x1400c61fa
mov qword [rsp + 0x100], rbx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0xf8], rsi
call fcn.1400c5af0
mov ebx, eax
test eax, eax
jne 0x1400c5dfb
mov edx, dword [rdi + 0x28]
lea r8, [rsp + 0x58]
mov rcx, qword [rdi + 0x10]
and edx, 4
call fcn.1400c49c0
mov ebx, eax
test eax, eax
jne 0x1400c5dfb
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1400c5dbd
lea rdx, [rbp + 0x50]
call fcn.1400c4c80
mov r13, qword [rbp + 0x50]
mov ebx, eax
test eax, eax
jne 0x1400c5dfb
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x1400c5de3
lea rdx, [rbp + 0x58]
call fcn.1400c5af0
mov r12, qword [rbp + 0x58]
mov ebx, eax
test eax, eax
je 0x1400c5eac
mov rsi, qword [rbp + 0x40]
jmp 0x1400c5dfe
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
test eax, eax
jne 0x1400c5e72
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rsi, r12
xor r14d, r14d
mov rcx, qword [rsp + 0x50]
call fcn.1400a7f70
mov rcx, rsi
call fcn.1400a7f70
mov rcx, qword [rsp + 0x58]
call fcn.1400a7f70
mov rcx, r12
call fcn.1400a7f70
mov rcx, r13
call fcn.1400a7f70
mov rcx, qword [rsp + 0x60]
call fcn.1400a7f70
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x1400c5e49
call fcn.1400c97b0
mov qword [rbp + 0x48], r14
mov ecx, ebx
call fcn.1400b5700
mov rbx, qword [rsp + 0x100]
mov rsi, qword [rsp + 0xf8]
add rsp, 0x108
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
mov rcx, rbx
add rcx, rcx
call fcn.1400a8170
mov r12, rax
test rax, rax
jne 0x1400c5e91
mov rsi, qword [rbp + 0x40]
lea ebx, [rax + 0xe]
jmp 0x1400c5dfe
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1400c5f49
cmp eax, ebx
jae 0x1400c5f49
mov rcx, r13
test r13, r13
je 0x1400c5f31
mov edx, 0xffdf
nop dword [rax]
movzx eax, word [rcx]
test ax, ax
je 0x1400c5f31
sub ax, 0x50
test dx, ax
jne 0x1400c5eff
movzx eax, word [rcx + 2]
sub ax, 0x41
test dx, ax
jne 0x1400c5eff
movzx eax, word [rcx + 4]
sub ax, 0x54
test dx, ax
jne 0x1400c5eff
movzx eax, word [rcx + 6]
sub ax, 0x48
test dx, ax
jne 0x1400c5eff
cmp word [rcx + 8], 0x3d
je 0x1400c5f28
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1400c5f10
lea rcx, [rcx + rax*2]
add rcx, 2
jne 0x1400c5ec0
jmp 0x1400c5f31
lea rsi, [rcx + 0xa]
test rsi, rsi
jne 0x1400c5f99
xor r8d, r8d
lea rcx, [0x140115e20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
jne 0x1400c5f5a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [rbp + 0x40]
mov ebx, eax
jmp 0x1400c5dfe
mov rcx, rbx
add rcx, rcx
call fcn.1400a8170
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x1400c5f7b
mov rsi, qword [rbp + 0x40]
lea ebx, [rax + 0xe]
jmp 0x1400c5dfe
mov r8d, ebx
lea rcx, [0x140115e20]
mov rdx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400c5f49
cmp eax, ebx
jae 0x1400c5f49
lea r8, [rbp + 0x48]
mov rdx, rdi
mov rcx, r14
call fcn.1400c9340
mov ebx, eax
test eax, eax
jne 0x1400c5ddd
mov rcx, qword [rsp + 0x50]
mov r8, rsi
mov rdx, r12
call fcn.1400c50e0
xor r14d, r14d
mov qword [rbp + 0x40], rax
test rax, rax
jne 0x1400c5fd9
lea ebx, [rax + 2]
mov rsi, rax
jmp 0x1400c5e01
mov rcx, qword [rbp + 0x48]
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x80], 0x68
mov qword [rbp - 0x78], r14
mov dword [rbp - 0x44], 0x101
call fcn.1400c9820
mov rcx, qword [rbp + 0x48]
xor edx, edx
mov qword [rbp - 0x38], rcx
mov word [rbp - 0x3e], ax
call fcn.1400c9810
mov rcx, qword [rbp + 0x48]
mov edx, 1
mov qword [rbp - 0x30], rax
call fcn.1400c9810
mov rcx, qword [rbp + 0x48]
mov edx, 2
mov qword [rbp - 0x28], rax
call fcn.1400c9810
mov r14d, dword [rdi + 0x28]
xor edx, edx
mov qword [rbp - 0x20], rax
mov r10d, 0x400
test r14b, 0x30
je 0x1400c608b
movsxd r11, dword [rdi + 0x2c]
mov r8d, edx
test r11d, r11d
jle 0x1400c608b
mov r9d, edx
mov rdx, qword [rdi + 0x30]
nop dword [rax]
test byte [rdx], 2
jne 0x1400c6089
mov ecx, r10d
lea eax, [r11 - 1]
bts ecx, 0x1b
cmp r8d, eax
cmovne ecx, r10d
inc r8d
inc r9
add rdx, 0x10
mov r10d, ecx
cmp r9, r11
jl 0x1400c6060
xor edx, edx
test r14b, 0x50
jne 0x1400c609c
mov eax, 0xa
mov word [rbp - 0x40], ax
jmp 0x1400c60a0
mov word [rbp - 0x40], dx
mov rsi, qword [rbp + 0x40]
lea rcx, [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov eax, r10d
mov qword [rsp + 0x48], rcx
or eax, 0x208
lea rcx, [rbp - 0x80]
and r14b, 8
mov qword [rsp + 0x40], rcx
mov rcx, rsi
cmove eax, r10d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400c6102
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1400c5dfe
mov rax, qword [rsp + 0x68]
mov qword [r15 + 0xf8], rax
mov eax, dword [rsp + 0x78]
mov dword [r15 + 0x68], eax
test byte [rdi + 0x28], 8
jne 0x1400c6154
lea rdx, [0x1400c5530]
lea rcx, [0x1403c04d0]
call fcn.1400c9b50
mov rdx, qword [rsp + 0x68]
mov rcx, qword [0x1403c04c8]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x1400c6154
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1400c6211
xor r14d, r14d
mov edx, r14d
cmp dword [rdi + 0x2c], edx
jle 0x1400c6196
mov r8d, r14d
mov rax, qword [rdi + 0x30]
test byte [r8 + rax], 1
je 0x1400c618b
mov rcx, qword [r8 + rax + 8]
cmp dword [rcx + 0x10], 7
jne 0x1400c618b
cmp dword [rcx + 0x110], r14d
je 0x1400c618b
mov eax, dword [rsp + 0x78]
mov dword [rcx + 0x1e0], eax
inc edx
add r8, 0x10
cmp edx, dword [rdi + 0x2c]
jl 0x1400c6162
mov rdx, qword [r15 + 0xf8]
lea r8, [0x1400c4970]
mov dword [rsp + 0x28], select
lea rcx, [r15 + 0xf0]
mov r9, r15
mov dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x1400c6220
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [r15 + 0x58]
test al, 4
jne 0x1400c5e01
or eax, 4
mov dword [r15 + 0x58], eax
test al, 8
je 0x1400c5e01
mov rax, qword [r15 + 8]
inc dword [rax + 8]
jmp 0x1400c5e01
mov eax, 0xfffff019
add rsp, 0x108
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
lea rdx, [0x140116010]
mov ecx, eax
call fcn.1400b5650
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [0x140116030]
call fcn.1400b5650
int3