Function at 0x140183750
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
movaps xmmword [rsp + 0x120], xmm6
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x1402b7040]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rcx, rdx
call fcn.14019d880
mov rcx, qword [rbx + 0x48]
mov qword [rbx + 0x48], rax
test rcx, rcx
jne 0x140184013
mov r12, qword [r15]
mov rcx, rdi
call fcn.14019d880
xor ebp, ebp
cmp qword [r12 + 0x98], 0
mov rdi, rax
setne r9b
xorps xmm6, xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0xd0], 0
mov r8, qword [r15]
cmp byte [r8 + 0x19], 1
je 0x140183a6f
xor eax, eax
xor ecx, ecx
xor edx, edx
mov rsi, qword [rsp + 0x1a8]
mov bpl, r9b
shl ebp, 0x13
or ebp, 0x40c
movzx r8d, byte [r8 + 0x18]
xor r9d, r9d
lea r10, [rsp + 0x100]
mov qword [r10 + 0x10], r9
add r12, 0x30
test dl, dl
movzx edx, dl
cmovs rdx, rcx
movaps xmmword [r10], xmm6
lea r11, [rsp + 0xc0]
cmovs r11, rax
test rdx, rdx
cmove r11, rdx
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
mov rdx, r14
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x14018401f
xorps xmm0, xmm0
lea r14, [rsp + 0xe0]
movaps xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
lea rdx, [rsp + 0x100]
mov rcx, r14
call fcn.14002f270
mov rax, qword [r14 + 8]
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x140183fe9
mov rdx, qword [rsp + 0xe8]
movaps xmm0, xmmword [0x140275a70]
lea r14, [rsp + 0xa0]
movaps xmmword [r14], xmm0
xor ebp, ebp
mov rcx, r14
mov r8b, 1
xor r9d, r9d
call fcn.140033570
mov al, byte [r14 + 8]
cmp al, 1
jne 0x140183908
lea r14, [rsp + 0xa0]
mov rcx, r14
call fcn.140033650
mov ebp, eax
xor bpl, 1
mov al, byte [r14 + 8]
test al, 1
je 0x140183919
lea rcx, [rsp + 0xa0]
call fcn.140032b50
test bpl, bpl
je 0x140183ff3
mov rcx, qword [rsp + 0x1a0]
lea rdx, [rsp + 0xe0]
call fcn.140033870
test al, al
je 0x140184055
mov rcx, qword [rsp + 0xe0]
call fcn.140033740
mov qword [rbx + 0x40], rax
test rax, rax
je 0x140184077
lea rcx, [0x140000000]
cmp rax, rcx
jne 0x14018403b
mov rsi, qword [rsp + 0xe0]
mov qword [rsp + 0xe0], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14018398c
call fcn.1401074f0
mov qword [rsp + 0xa0], rsi
mov rsi, qword [rsp + 0xe8]
mov qword [rsp + 0xe8], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1401839b7
call fcn.1401074f0
lea rdx, [rsp + 0xa0]
mov qword [rdx + 8], rsi
mov rax, qword [rsp + 0xf0]
mov qword [rdx + 0x10], rax
mov qword [rsp + 0xf0], 0
mov rcx, rbx
call fcn.14002f270
xor ebx, ebx
lea rcx, [rsp + 0xe0]
call fcn.14002fde0
cmp byte [rsp + 0xd7], 0
jns 0x140183a09
mov rcx, qword [rsp + 0xc0]
call fcn.14019cac4
test rdi, rdi
je 0x140183a18
mov rcx, rdi
xor edx, edx
call fcn.140001b10
mov rdi, qword [r15]
mov qword [r15], 0
test rdi, rdi
je 0x140183a37
mov rcx, rdi
call fcn.140033490
mov rcx, rdi
call fcn.14019cac4
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
cmp rcx, qword [0x1402b7040]
je 0x140183a51
call fcn.14019f290
int3
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x120]
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov byte [rsp + 0x67], r9b
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x140184031
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], r15
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0x68], rax
movzx eax, word [rax]
test ax, ax
je 0x140183ae5
movabs rdi, 0x7ffffffffffffff7
lea r14, [rsp + 0x100]
mov r13, qword [rsp + 0x68]
jmp 0x140183d5b
lea r12, [rsp + 0xa0]
mov rcx, r12
xor edx, edx
call fcn.14015b2a0
mov rax, qword [r12 + 0x10]
mov qword [rsp + 0xd0], rax
movaps xmm0, xmmword [r12]
movaps xmmword [rsp + 0xc0], xmm0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov dl, byte [rsp + 0xd7]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov r15, qword [rsp + 0x90]
mov r8, qword [r15]
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x70]
xor ebp, ebp
mov r9b, byte [rsp + 0x67]
jmp 0x1401837ea
xor r8d, r8d
lea r9, str.SystemDrive
movzx edx, word [r9]
cmp dx, word [rcx + r8*2]
jne 0x140183b93
add r9, 2
inc r8
xor edx, edx
cmp rax, r8
jne 0x140183b6e
lea r8, str.SystemDrive
jmp 0x140183d18
cmp rax, 0xa
jne 0x140183ceb
jmp 0x140183fba
mov byte [rsp + 0x117], r15b
mov r12, r14
jmp 0x140183c3c
movzx eax, ax
test eax, eax
je 0x140183bcc
movzx eax, word [r13 + r15*2 + 2]
inc r15
add rsi, 0xfffffffffffffffe
cmp ax, 0x3d
jne 0x140183bb2
test r15, r15
sete al
test r13, r13
setne cl
or cl, al
je 0x140183fcf
cmp r15, rdi
ja 0x140183fd6
cmp r15, 0xa
jbe 0x140183ba2
mov rax, r15
or rax, 3
lea rbx, [rax + 1]
cmp rax, 0xb
mov eax, Ordinal_14
cmove rbx, rax
test rbx, rbx
js 0x140183fd1
lea rcx, [rbx + rbx]
call fcn.14019ca88
mov r12, rax
mov qword [rsp + 0x100], rax
lea rax, [rdi + rbx]
add rax, 9
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x108], r15
cmp r13, r12
jb 0x140183c50
mov rax, r12
sub rax, rsi
cmp r13, rax
jb 0x140183fcf
test r15, r15
je 0x140183c66
mov r8, rsi
neg r8
mov rcx, r12
mov rdx, r13
call fcn.1401d8080
mov word [r12 + r15*2], 0
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xf0], rax
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xe0], xmm0
add rsi, 0xfffffffffffffffe
cmp word [r13 + r15*2], 0
lea r15, [r15 + 1]
jne 0x140183c8d
movsx rbx, byte [rsp + 0xf7]
test rbx, rbx
mov rax, qword [rsp + 0xe8]
cmovns rax, rbx
mov rbp, qword [rsp + 0xe0]
lea rcx, [rsp + 0xe0]
cmovs rcx, rbp
cmp rax, 4
je 0x140183d8b
cmp rax, 0xb
je 0x140183b64
mov r8, rax
cmp rax, 0xa
je 0x140183def
cmp rax, 4
je 0x140183dbd
mov dl, 1
cmp rax, 3
je 0x140183d65
cmp rax, 0xc
je 0x140183e5a
lea r8, str.Path
cmp rax, 0x19
je 0x140183e20
lea rax, str.Path
sub r8, rax
cmp r8, 0x71
jge 0x140183fe3
test r8, r8
js 0x140183fe6
test dl, dl
je 0x140183e9f
test bl, bl
jns 0x140183d49
mov rcx, rbp
call fcn.14019cac4
movzx eax, word [r13 + r15*2]
sub r13, rsi
test ax, ax
je 0x140183ae5
xor esi, esi
xor r15d, r15d
jmp 0x140183bc6
xor r8d, r8d
lea r9, [0x14029f202]
movzx r10d, word [r9]
cmp r10w, word [rcx + r8*2]
jne 0x140183cfd
add r9, 2
inc r8
cmp rax, r8
jne 0x140183d6f
jmp 0x140183f65
xor r8d, r8d
lea rdx, str.Path
movzx edx, word [r8 + rdx]
cmp dx, word [rcx + r8]
jne 0x140183cd4
add r8, 2
xor edx, edx
cmp r8, 8
jne 0x140183d8e
lea r8, str.Path
jmp 0x140183d18
xor r8d, r8d
lea rdx, str.TEMP
movzx edx, word [r8 + rdx]
cmp dx, word [rcx + r8]
jne 0x140183cf5
add r8, 2
xor edx, edx
cmp r8, 8
jne 0x140183dc0
lea r8, str.TEMP
jmp 0x140183d18
xor r9d, r9d
lea rdx, str.SystemRoot
movzx edx, word [r9 + rdx]
cmp dx, word [rcx + r9]
jne 0x140183ceb
add r9, 2
xor edx, edx
dec r8
jne 0x140183df2
lea r8, str.SystemRoot
jmp 0x140183d18
xor r8d, r8d
lea rdx, str.CHROME_CRASHPAD_PIPE_NAME
movzx edx, word [r8 + rdx]
cmp dx, word [rcx + r8]
setne dl
jne 0x140183e4e
add r8, 2
dec rax
jne 0x140183e23
lea r8, str.CHROME_CRASHPAD_PIPE_NAME
jmp 0x140183d18
lea r8, str.Path
jmp 0x140183d18
xor r8d, r8d
lea r9, str.LOCALAPPDATA
movzx r10d, word [r9]
cmp r10w, word [rcx + r8*2]
jne 0x140183e89
add r9, 2
inc r8
cmp rax, r8
jne 0x140183e64
xor edx, edx
lea r8, str.LOCALAPPDATA
jmp 0x140183d18
lea r8, str.Path
cmp rax, 0x19
jne 0x140183d18
jmp 0x140183fc5
test r13, r13
setne al
test r15, r15
sete cl
or cl, al
je 0x140183fcf
movsx rax, byte [rsp + 0xb7]
mov edx, 0xa
mov r12, rax
test rax, rax
jns 0x140183ee0
lea rdx, [rdi + 8]
and rdx, qword [rsp + 0xb0]
dec rdx
mov r12, qword [rsp + 0xa8]
mov rcx, rdx
sub rcx, r12
cmp rcx, r15
jb 0x140183f73
test r15, r15
je 0x140183d3d
lea r14, [rsp + 0xa0]
test al, al
jns 0x140183f0c
mov r14, qword [rsp + 0xa0]
test r15, r15
js 0x140183fcf
lea rcx, [r14 + r12*2]
cmp r13, rcx
jb 0x140183f2d
mov rax, rcx
sub rax, rsi
cmp r13, rax
jb 0x140183fcf
mov r8, rsi
neg r8
mov rdx, r13
call fcn.1401d8080
lea rax, [r12 + r15]
cmp byte [rsp + 0xb7], 0
jns 0x140183fa9
mov qword [rsp + 0xa8], rax
mov word [r14 + rax*2], 0
lea r14, [rsp + 0x100]
jmp 0x140183d3d
xor edx, edx
lea r8, [0x14029f190]
jmp 0x140183d18
mov r8, r12
sub r8, rdx
add r8, r15
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0xa0]
mov r9, r12
call fcn.140140960
jmp 0x140183d3d
add r12d, r15d
and r12b, 0x7f
mov byte [rsp + 0xb7], r12b
jmp 0x140183f51
mov r8d, 0xa
jmp 0x140183def
mov eax, Ordinal_26
jmp 0x140183e20
ud2
call fcn.1401dc2e0
lea rcx, [rsp + 0x100]
call fcn.1401dc2a0
int3
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
jmp 0x140183ff9
mov dword [rsi], 0x542
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x15
jmp 0x1401839e5
xor edx, edx
call fcn.140001b10
jmp 0x1401837a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov ebx, 0x12
jmp 0x1401839f2
mov ebx, Ordinal_73
jmp 0x140183a09
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x41
jmp 0x1401839e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, Ordinal_26
jmp 0x1401839e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, Ordinal_46
jmp 0x1401839e5