Function at 0x14005bba0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x6d8
lea rdx, [rsp + 0x4d0]
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14005be78
lea rcx, [rsp + 0x4d0]
mov rdx, rcx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x14005be78
movabs rax, 0x71c8d55bc20d9674
mov qword [rsp + 0x2c0], rax
mov rax, qword [rsp + 0x2c0]
mov qword [rsp + 0xb0], rax
movabs rax, 0x93ca4704c288dac0
mov qword [rsp + 0x2c0], rax
mov rax, qword [rsp + 0x2c0]
mov qword [rsp + 0xb8], rax
movabs r14, 0x719bd516c2429637
mov qword [rsp + 0x2c0], r14
mov rax, qword [rsp + 0x2c0]
mov qword [rsp + 0x2c0], rax
movabs r15, 0x93ca4747c2cdda90
mov qword [rsp + 0x40], r15
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x2c8], rax
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0xb0]
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0xb0], xmm0
lea rsi, [rsp + 0xb0]
lea rdi, [rsp + 0x2c0]
mov rcx, rsi
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14005be78
movabs rax, 0x71ffd536c2219618
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x40], rax
movabs rax, 0x93ca4767c2a1daf5
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0xb0], r14
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x20], r15
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
lea rbx, [rsp + 0x40]
mov rcx, rsi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov r12, qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x4d0]
mov rcx, rsi
call r12
movabs rax, 0x71f5d536c27c9617
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
movabs rax, 0x93ca4747c2a1dae5
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x38]
movaps xmm0, xmmword [rsp + 0x20]
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call r12
movabs rax, 0x4000000070
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
lea rax, str.Open
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14005be78
mov rcx, qword [rsp + 0xa8]
mov rsi, qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edx, 0x40
call rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x100
call rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea r8, [rsp + 0x4d0]
mov ecx, 4
mov edx, 5
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
nop
add rsp, 0x6d8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret