Function at 0x14003f880
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
movaps xmmword [rsp + 0x180], xmm6
mov rbx, r8
mov qword [rsp + 0x58], rdx
mov r12, rcx
mov rax, qword [0x14016c028]
xor rax, rsp
mov qword [rsp + 0x178], rax
movaps xmm6, xmmword [0x140146a10]
lea rdi, [rsp + 0x160]
movaps xmmword [rdi], xmm6
lea rdx, str.LaunchProcess
lea r8, str..._.._base_process_launch_win.cc
lea rsi, [rsp + 0xe0]
mov rcx, rsi
mov r9d, 0xf8
call fcn.140003270
lea r8, [0x140173a8c]
mov rcx, rdi
mov rdx, rsi
call fcn.140040520
movabs r13, 0xaaaaaaaaaaaaaaaa
mov qword [rsi + 0x70], r13
movaps xmmword [rsi + 0x60], xmm6
movaps xmmword [rsi + 0x50], xmm6
movaps xmmword [rsi + 0x40], xmm6
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
lea rcx, [rsp + 0xe0]
call fcn.140040080
cmp dword [rbx + 0x24], 1
sete r15b
mov rbp, qword [rbx + 0x28]
mov rsi, qword [rbx + 0x30]
cmp rbp, rsi
je 0x14003fa46
mov rax, rsi
sub rax, rbp
sar rax, 3
cmp rax, 0x1fffffff
ja 0x14003f9f3
mov rcx, qword [rbp]
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x14003fec1
lea rax, [rbp + 8]
cmp rax, rsi
je 0x14003f9b4
mov rcx, qword [rax]
mov edx, 1
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x14003ff65
add rbp, 0x10
cmp rbp, rsi
jne 0x14003fe82
lea rcx, [rsp + 0xe0]
mov edx, 1
call fcn.1400403a0
test al, al
je 0x14003f9f3
mov r9d, dword [rbx + 0x30]
mov r8, qword [rbx + 0x28]
sub r9d, r8d
and r9d, 0xfffffff8
lea rcx, [rsp + 0xe0]
mov edx, 0x20002
call fcn.140040170
test al, al
jne 0x14003ff97
mov rcx, r12
xor edx, edx
call fcn.1400400c0
lea rcx, [rsp + 0xe0]
call fcn.140040100
lea rcx, [rsp + 0x160]
call fcn.140040270
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14010e4a0
mov rax, r12
movaps xmm6, xmmword [rsp + 0x180]
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor esi, esi
cmp byte [rbx + 0x21], 0
jne 0x14003fef3
cmp byte [rbx + 0x50], 0
jne 0x14003ff00
mov eax, dword [rsp + 0x124]
mov ecx, eax
or ecx, 1
mov dword [rsp + 0x124], ecx
mov edx, dword [rbx + 0x40]
cmp edx, 3
jne 0x14003ff14
mov cx, 2
mov word [rsp + 0x128], cx
mov rbp, qword [rbx + 0x60]
mov rdx, qword [rbx + 0x68]
mov rcx, rbp
or rcx, rdx
jne 0x14003faa0
cmp qword [rbx + 0x70], 0
je 0x14003fac8
xor edx, edx
or eax, 0x101
mov dword [rsp + 0x124], eax
mov qword [rsp + 0x138], rbp
mov qword [rsp + 0x140], rdx
mov rax, qword [rbx + 0x70]
mov qword [rsp + 0x148], rax
cmp qword [rbx + 0x58], 0
jne 0x14003ff40
mov ebp, esi
or ebp, 0x1000000
cmp byte [rbx + 0x78], 0
cmove ebp, esi
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], 0
movzx eax, byte [rbx + 0x1f]
test al, al
jns 0x14003fb0b
mov rax, qword [rbx + 0x10]
mov r14, qword [rbx + 8]
jmp 0x14003fb0f
lea r14, [rbx + 8]
test rax, rax
cmove r14, rax
lea rsi, [rsp + 0xe8]
lea rdi, [rsp + 0xa0]
mov qword [rdi + 0x10], r13
movaps xmmword [rdi], xmm6
mov rcx, rdi
mov rdx, qword [rsp + 0x58]
call fcn.14001e110
mov rdx, qword [rbx + 0x48]
test rdx, rdx
jne 0x14003fbeb
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], 0
cmp byte [rbx + 0x98], 0
jne 0x14003ffa4
cmp qword [rbx + 0x90], 0
je 0x14003ffe5
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x14003fe1f
mov rdi, rax
lea r8, [rbx + 0x80]
lea rcx, [rsp + 0x60]
mov rdx, rax
call fcn.140040980
cmp byte [rsp + 0x97], 0
js 0x14003fe49
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x80], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
cmp byte [rsp + 0x97], 0
jns 0x14003fd9b
mov rax, qword [rsp + 0x80]
jmp 0x14003fda3
lea rcx, [rsp + 0x80]
mov qword [rcx], 0
xor r8d, r8d
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x14003ff56
mov r8, rsi
or ebp, 0x400
mov rdx, qword [rsp + 0x80]
movzx eax, r15b
cmp byte [rsp + 0xb7], 0
jns 0x14003fc31
mov rdi, qword [rsp + 0xa0]
mov rcx, qword [rbx + 0x48]
lea rsi, [rsp + 0xc0]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], 0
xor edx, edx
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
mov rcx, qword [rsp + 0x80]
call sub.USERENV.dll_DestroyEnvironmentBlock
test esi, esi
je 0x14003ff56
lea rcx, [rsp + 0x80]
mov qword [rcx + 0x10], r13
movaps xmmword [rcx], xmm6
lea rdx, [rsp + 0xc0]
call fcn.140040140
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x14003fcc2
mov rdx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x14003fd57
cmp byte [rbx + 0x79], 0
je 0x14003fcdd
mov rcx, qword [rsp + 0x80]
call fcn.1400401e0
mov ecx, eax
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
cmp byte [rbx], 0
je 0x14003fcf5
mov rcx, qword [rsp + 0x80]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [rsp + 0x90]
mov rcx, qword [0x140173af0]
test rcx, rcx
je 0x14003fd12
mov r8, qword [rsp + 0x58]
call fcn.140040720
lea rcx, [rsp + 0x80]
call fcn.1400401b0
mov rcx, r12
mov rdx, rax
call fcn.1400400c0
lea rcx, [rsp + 0x80]
call fcn.140040460
cmp byte [rsp + 0xb7], 0
jns 0x14003f9fd
mov rcx, qword [rsp + 0xa0]
call fcn.14010b880
jmp 0x14003f9fd
lea rsi, [rsp + 0x60]
movaps xmmword [rsi], xmm6
lea rcx, [rsp + 0x80]
call fcn.1400401b0
mov rcx, rsi
mov rdx, rax
call fcn.1400400c0
mov rcx, rsi
mov edx, 1
mov r8b, 1
call fcn.140040890
mov rcx, r12
xor edx, edx
call fcn.1400400c0
mov rcx, rsi
call fcn.140040fd0
jmp 0x14003fd2a
lea rax, [rsp + 0x80]
or ebp, 0x400
movzx ecx, r15b
cmp byte [rsp + 0xb7], 0
jns 0x14003fdc1
mov rdx, qword [rsp + 0xa0]
jmp 0x14003fdc9
lea rdx, [rsp + 0xa0]
lea rdi, [rsp + 0xc0]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ecx
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14003fe1f
cmp byte [rsp + 0x97], 0
jns 0x14003fc87
mov rcx, qword [rsp + 0x80]
call fcn.14010b880
jmp 0x14003fc87
mov rcx, r12
xor edx, edx
call fcn.1400400c0
cmp byte [rsp + 0x97], 0
jns 0x14003fd37
mov rcx, qword [rsp + 0x80]
call fcn.14010b880
jmp 0x14003fd37
mov rax, qword [rsp + 0x80]
mov word [rax], 0
mov qword [rsp + 0x88], 0
cmp byte [rsp + 0x97], 0
jns 0x14003fbad
mov rcx, qword [rsp + 0x80]
call fcn.14010b880
jmp 0x14003fbad
mov r15, qword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea r14, str..._.._base_process_launch_win.cc
lea rdi, [rsp + 0xc0]
mov rcx, qword [rbp]
mov edx, 1
mov r8d, 1
call r15
test eax, eax
je 0x140040005
add rbp, 8
cmp rsi, rbp
je 0x14003f9b4
jmp 0x14003fe98
lea rdx, str..._.._base_process_launch_win.cc
lea rdi, [rsp + 0xc0]
mov rcx, rdi
mov r8d, 0x10c
call fcn.14009a6b0
mov rcx, rdi
call fcn.14009a6d0
mov rcx, rdi
call fcn.14009a6e0
jmp 0x14003f982
or byte [rsp + 0x124], 0x80
jmp 0x14003fa52
lea rax, [0x14014d69a]
mov qword [rsp + 0xf8], rax
jmp 0x14003fa5c
mov cx, 0xa
cmp edx, 5
ja case.0x14003ff32.1
mov edx, edx
lea rbp, [0x140040064]
movsxd rdx, dword [rbp + rdx*4]
add rdx, rbp
jmp rdx
movzx ecx, byte [rbx + 0x20]
xor ecx, 1
jmp case.0x14003ff32.1
call fcn.1400094e0
lea ecx, [rsi + 0x1000000]
cmp eax, 5
cmovl esi, ecx
jmp 0x14003fad3
mov rcx, r12
xor edx, edx
call fcn.1400400c0
jmp 0x14003fd37
lea rdx, str..._.._base_process_launch_win.cc
lea rdi, [rsp + 0xc0]
mov rcx, rdi
mov r8d, 0x10c
call fcn.14009a6b0
mov rcx, rdi
call fcn.14009a6d0
mov rcx, rdi
call fcn.14009a6e0
jmp 0x14003f9a7
mov r15b, 1
mov esi, 0x80000
jmp 0x14003fa48
lea r8, [rbx + 0x80]
lea rdx, [0x14014d69c]
lea rcx, [rsp + 0x60]
call fcn.140040980
cmp byte [rsp + 0x97], 0
js 0x14004002b
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x80], xmm0
jmp 0x14003fbd0
xor eax, eax
jmp 0x14003fda9
mov cx, 1
jmp case.0x14003ff32.1
mov cx, 7
jmp case.0x14003ff32.1
xor ecx, ecx
jmp case.0x14003ff32.1
mov rcx, rdi
mov rdx, r14
mov r8d, 0x10c
call fcn.14009a6b0
mov rcx, rdi
call fcn.14009a6d0
mov rcx, rdi
call fcn.14009a6e0
jmp 0x14003feb2
mov rax, qword [rsp + 0x80]
mov word [rax], 0
mov qword [rsp + 0x88], 0
cmp byte [rsp + 0x97], 0
jns 0x14003ffc6
mov rcx, qword [rsp + 0x80]
call fcn.14010b880
jmp 0x14003ffc6