Function at 0x14008bb40
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rax, qword [0x1401198e8]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
mov r8d, 0x104
lea rdx, [rsp + 0x50]
lea rcx, str._systemroot_explorer.exe
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140006110
mov rdi, rax
mov rcx, qword [rax]
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x14008bbbe
mov rdx, qword [rcx]
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
jne 0x14008bbd8
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x14008be9e
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 1
mov r14, qword [rdi]
movsxd r15, dword [r14 - 0x10]
lea r12, str._select__
mov rbp, 0xffffffffffffffff
mov rdi, rbp
nop word [rax + rax]
inc rdi
cmp word [r12 + rdi*2], 0
jne 0x14008bc10
lea esi, [r15 + rdi]
test esi, esi
js 0x14008be93
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x14008bc49
mov edx, esi
lea rcx, [rsp + 0x38]
call fcn.140006870
mov rbx, qword [rsp + 0x38]
movsxd rax, edi
lea rdi, [rax + rax]
test rdi, rdi
je 0x14008bc7a
test rbx, rbx
jne 0x14008bc6c
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x14008bc7a
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call fcn.14009d3c0
mov r8, r15
add r8, r8
lea rcx, [rdi + rbx]
je 0x14008bcb1
test rcx, rcx
je 0x14008bca1
test r14, r14
je 0x14008bc9a
mov rdx, r14
call fcn.14009d3c0
jmp 0x14008bcb1
xor edx, edx
call fcn.14009e880
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
cmp esi, dword [rbx - 0xc]
jg 0x14008be93
mov dword [rbx - 0x10], esi
movsxd rax, esi
mov word [rbx + rax*2], r13w
lea r14, [rbx - 0x18]
mov rcx, qword [r14]
test rcx, rcx
je 0x14008bcdf
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14008bcf9
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x14008bea9
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x40], rdi
mov r13d, 3
mov dword [rsp + 0x30], r13d
lea rax, [0x1400f4b34]
mov rsi, rbp
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14008bd20
movsxd r12, dword [rbx - 0x10]
lea r15d, [rsi + r12]
test r15d, r15d
js 0x14008be88
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r15d
or eax, ecx
jge 0x14008bd5f
mov edx, r15d
lea rcx, [rsp + 0x40]
call fcn.140006870
mov rdi, qword [rsp + 0x40]
add r12, r12
je 0x14008bd89
test rdi, rdi
jne 0x14008bd7b
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x14008bd89
mov r8, r12
mov rdx, rbx
mov rcx, rdi
call fcn.14009d3c0
movsxd r8, esi
add r8, r8
lea rcx, [r12 + rdi]
je 0x14008bdb8
test rcx, rcx
jne 0x14008bdac
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x14008bdb8
lea rdx, [0x1400f4b34]
call fcn.14009d3c0
cmp r15d, dword [rdi - 0xc]
jg 0x14008be88
mov dword [rdi - 0x10], r15d
movsxd rax, r15d
xor ecx, ecx
mov word [rdi + rax*2], cx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rcx
mov r9, rdi
lea r8, [rsp + 0x50]
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, rax
and r13d, 0xfffffffd
mov dword [rsp + 0x30], r13d
lea rdx, [rdi - 0x18]
mov ecx, ebp
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14008be16
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
and dword [rsp + 0x30], 0xfffffffe
mov eax, ebp
lock xadd dword [r14 + 0x10], eax
sub eax, 1
jg 0x14008be35
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
sub ebp, 1
jg 0x14008be51
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
cmp ebx, 0x20
setge al
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14009c570
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80070057
call fcn.140007f00
nop
mov ecx, 0x80070057
call fcn.140007f00
int3
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
int3