Function at 0x10002b018
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x1fd0
call fcn.100002240
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x2000], rbx
mov qword [rsp + 0x2010], rbp
mov rax, qword [0x100090120]
xor rax, rsp
mov qword [rsp + 0x1fc0], rax
mov rsi, rdx
mov r12, rcx
mov r14d, 0x7d0
mov dword [rsp + 0x48], r14d
lea rcx, [0x100066a5c]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rsp + 0x38], rax
xor r13d, r13d
cmp rax, r13
jne 0x10002b095
mov ecx, 0x8007000e
call fcn.1000242f0
nop
jmp 0x10002b094
nop
lea rcx, [0x100066a5c]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x40], rax
cmp rax, r13
jne 0x10002b0bd
mov ecx, 0x8007000e
call fcn.1000242f0
nop
jmp 0x10002b0bc
nop
mov r9d, 0x30000000
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x1020]
mov rcx, qword [rsi]
call qword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
lea rsi, [rsp + 0x1032]
mov bpl, r13b
cmp word [rsp + 0x1032], r13w
je 0x10002b1b4
movzx ecx, word [rsi]
call qword [sym.imp.msvcrt.dll_iswspace]
cmp eax, r13d
je 0x10002b106
cmp bpl, r13b
je 0x10002b146
movzx eax, word [rsi]
mov word [rsp + 0x30], ax
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.10000adf0
cmp eax, r13d
jne 0x10002b19a
cmp word [rsi], 0x27
je 0x10002b134
cmp word [rsi], 0x22
jne 0x10002b13c
cmp bpl, r13b
jne 0x10002b146
mov bpl, 1
add rsi, 2
cmp word [rsi], r13w
jne 0x10002b0f3
cmp word [rsi], r13w
je 0x10002b193
add rsi, 2
cmp rsi, rbx
je 0x10002b193
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp rsi, r13
je 0x10002b184
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x40], rax
cmp rax, r13
jne 0x10002b193
mov ecx, 0x8007000e
call fcn.1000242f0
int3
mov rbx, r13
mov qword [rsp + 0x40], rbx
mov rdi, qword [rsp + 0x38]
jmp 0x10002b1b4
mov rdi, qword [rsp + 0x38]
jmp 0x10002b1b4
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x10002b36b
mov r8d, r14d
lea rdx, [rsp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, r13d
je 0x10002b20e
cmp eax, r14d
ja 0x10002b20e
lea rax, [rsp + 0x80]
cmp rax, rdi
je 0x10002b20e
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rsp + 0x80]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rsp + 0x38], rax
cmp rax, r13
jne 0x10002b20e
mov ecx, 0x8007000e
call fcn.1000242f0
int3
mov r8d, r14d
lea rdx, [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, r13d
je 0x10002b268
cmp eax, r14d
ja 0x10002b268
lea rax, [rsp + 0x80]
cmp rax, rbx
je 0x10002b268
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rsp + 0x80]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x40], rax
cmp rax, r13
jne 0x10002b268
mov ecx, 0x8007000e
call fcn.1000242f0
int3
lea rcx, [rsp + 0x58]
mov rax, qword [str.getWmvMuiPath]
mov qword [rcx], rax
mov rax, qword [0x10006cc20]
mov qword [rcx + 8], rax
mov rax, qword [0x10006cc28]
mov qword [rcx + 0x10], rax
mov eax, dword [0x10006cc30]
mov dword [rcx + 0x18], eax
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r13d
jne 0x10002b2bc
mov r8d, 0x201
mov rdx, rbx
mov rcx, r12
call fcn.10002b3a0
jmp 0x10002b2e2
mov rax, qword [0x100090140]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r13
mov r9, rbx
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 8]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [0x100091a04], r13d
je 0x10002b358
cmp byte [0x1000900ea], r13b
je 0x10002b30f
mov al, byte [0x100091a08]
cmp al, 4
jae 0x10002b303
cmp al, r13b
jne 0x10002b358
bt dword [0x100091a00], 0x10
jb 0x10002b33d
jmp 0x10002b358
mov al, byte [0x100091a08]
cmp al, 4
jae 0x10002b31e
cmp al, r13b
jne 0x10002b358
bt qword [0x1000919f0], 0x10
jae 0x10002b358
mov rcx, qword [0x1000919f8]
mov rax, rcx
and eax, 0x10000
cmp rax, rcx
jne 0x10002b358
lea r8, [0x10006c028]
lea rdx, [0x10006c1c8]
mov rcx, qword [0x100090180]
call fcn.10002469c
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x1fc0]
xor rcx, rsp
call fcn.100001100
lea r11, [rsp + 0x1fd0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret