Function at 0x14008e9f0
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
movaps xmmword [rsp + 0x130], xmm7
movaps xmmword [rsp + 0x120], xmm6
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x140140040]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rcx, rdx
call fcn.1400a34d4
mov rdx, qword [rbx + 0x48]
mov qword [rbx + 0x48], rax
test rdx, rdx
jne 0x14008f11d
mov r13, qword [r15]
mov rcx, rdi
call fcn.1400a34d4
xor ebp, ebp
cmp qword [r13 + 0xa0], 0
mov rdi, rax
setne r12b
xorps xmm6, xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0xd0], 0
mov r8, qword [r15]
cmp byte [r8 + 0x21], 0
jne 0x14008ed4a
xor eax, eax
xor ecx, ecx
xor edx, edx
mov rsi, qword [rsp + 0x1b8]
mov bpl, r12b
shl ebp, 0x13
or ebp, 0x40c
movzx r8d, byte [r8 + 0x20]
xor r9d, r9d
lea r10, [rsp + 0x100]
mov qword [r10 + 0x10], r9
add r13, 0x38
test dl, dl
movzx edx, dl
cmovs rdx, rcx
movaps xmmword [r10], xmm6
lea r11, [rsp + 0xc0]
cmovs r11, rax
test rdx, rdx
cmove r11, rdx
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
mov rdx, r14
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x14008f131
xorps xmm0, xmm0
lea r14, [rsp + 0xe0]
movaps xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
lea rdx, [rsp + 0x100]
mov rcx, r14
call fcn.14002a4b0
mov rax, qword [r14 + 8]
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x14008f0d1
mov rdx, qword [rsp + 0xe8]
movaps xmm0, xmmword [0x14011ea30]
lea r14, [rsp + 0xa0]
movaps xmmword [r14], xmm0
mov rcx, r14
mov r8b, 1
xor r9d, r9d
call fcn.140018000
cmp byte [r14 + 8], 0
je 0x14008f0db
lea r14, [rsp + 0xa0]
mov rcx, r14
call fcn.1400180e0
mov ebp, eax
cmp byte [r14 + 8], 0
je 0x14008ebbc
lea rcx, [rsp + 0xa0]
call fcn.140019740
test bpl, bpl
jne 0x14008f0db
mov r14, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0xe0]
mov rdx, r14
call fcn.14002a0d0
test al, al
je 0x14008f0fb
lea rdx, [r14 + 8]
mov rcx, qword [rsp + 0xe8]
call fcn.14002a0d0
test al, al
je 0x14008f0fb
mov eax, dword [rsp + 0xf0]
mov dword [r14 + 0x10], eax
mov eax, dword [rsp + 0xf4]
mov dword [r14 + 0x14], eax
mov rcx, qword [rsp + 0xe0]
call fcn.1400182e0
mov qword [rbx + 0x40], rax
test rax, rax
je 0x14008f167
lea rcx, [0x140000000]
cmp rax, rcx
jne 0x14008f14d
mov rsi, qword [rsp + 0xe0]
mov qword [rsp + 0xe0], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14008ec61
call fcn.14005d1b0
mov qword [rsp + 0xa0], rsi
mov rsi, qword [rsp + 0xe8]
mov qword [rsp + 0xe8], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14008ec8c
call fcn.14005d1b0
lea rdx, [rsp + 0xa0]
mov qword [rdx + 8], rsi
mov rax, qword [rsp + 0xf0]
mov qword [rdx + 0x10], rax
mov qword [rsp + 0xf0], 0
mov rcx, rbx
call fcn.14002a4b0
xor ebx, ebx
lea rcx, [rsp + 0xe0]
call fcn.140016480
cmp byte [rsp + 0xd7], 0
jns 0x14008ecde
mov rcx, qword [rsp + 0xc0]
call fcn.1400a2cfc
test rdi, rdi
je 0x14008ecf5
lea rcx, fcn.140061ab0
mov rdx, rdi
xor r8d, r8d
call fcn.140060910
mov rdi, qword [r15]
mov qword [r15], 0
test rdi, rdi
je 0x14008ed14
mov rcx, rdi
call fcn.1400181d0
mov rcx, rdi
call fcn.1400a2cfc
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.1400a4d90
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x120]
movaps xmm7, xmmword [rsp + 0x130]
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x14008f143
mov rsi, rax
xorps xmm7, xmm7
movaps xmmword [rsp + 0xa0], xmm7
mov qword [rsp + 0xb0], 0
movzx eax, word [rax]
test ax, ax
je 0x14008edcb
mov byte [rsp + 0x67], r12b
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], r15
lea r12, [rsp + 0x100]
mov rbp, rsi
lea rsi, str.Path
lea rbx, str.Path
mov r15d, 0xd0
mov qword [rsp + 0x68], rbp
jmp 0x14008efef
xor eax, eax
jmp 0x14008ee08
cmp al, 0xa
mov r15, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r14, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov ebp, 0
mov r12b, byte [rsp + 0x67]
mov rsi, qword [rsp + 0x68]
je 0x14008f059
movzx eax, al
mov edx, eax
inc dl
and dl, 0x7f
lea rcx, [rsp + 0xa0]
mov byte [rcx + 0x17], dl
jmp 0x14008ee95
mov al, byte [rsp + 0xb7]
test al, al
jns 0x14008edcf
movabs r12, 0x7fffffffffffffff
and r12, qword [rsp + 0xb0]
dec r12
mov rax, qword [rsp + 0xa8]
cmp rax, r12
mov r15, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r14, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov ebp, 0
mov rsi, qword [rsp + 0x68]
je 0x14008f05f
mov rcx, qword [rsp + 0xa0]
lea rdx, [rax + 1]
mov qword [rsp + 0xa8], rdx
mov r12b, byte [rsp + 0x67]
mov dword [rcx + rax*2], 0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xc8], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov dl, byte [rsp + 0xd7]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov r8, qword [r15]
jmp 0x14008ea91
movzx eax, ax
test eax, eax
je 0x14008ef0e
movzx eax, word [rdi + r13*2 + 2]
inc r13
add rbp, 2
cmp ax, 0x3d
jne 0x14008eef4
mov rcx, r12
mov rdx, rdi
mov r8, r13
call fcn.140017f10
cmp byte [rsp + 0xf7], 0
js 0x14008f0ac
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xf0], rax
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xe0], xmm0
inc r13
cmp word [rbp], 0
lea rbp, [rbp + 2]
jne 0x14008ef4a
movsx rax, byte [rsp + 0xf7]
test rax, rax
mov rcx, qword [rsp + 0xe8]
cmovns rcx, rax
mov rdx, qword [rsp + 0xe0]
lea r8, [rsp + 0xe0]
cmovns rdx, r8
test rcx, rcx
js 0x14008f099
je 0x14008ef98
test rdx, rdx
je 0x14008f0be
xor r9d, r9d
cmp qword [r9 + rsi + 8], rcx
je 0x14008f00e
add r9, 0x10
cmp r9, r15
jne 0x14008ef9b
lea r8, [rsi + r15]
mov rcx, r8
sub rcx, rsi
sar rcx, 4
test rcx, rcx
jle 0x14008f090
cmp rcx, 0xe
jae 0x14008f08d
cmp r8, rbx
jne 0x14008f03a
test al, al
jns 0x14008efe2
mov rcx, qword [rsp + 0xe0]
call fcn.1400a2cfc
movzx eax, word [rbp]
test ax, ax
je 0x14008ee1f
mov rdi, rbp
movaps xmmword [rsp + 0xe0], xmm7
mov qword [rsp + 0xf0], 0
xor r13d, r13d
jmp 0x14008ef08
lea r8, [rsi + r9]
test rcx, rcx
je 0x14008efaf
mov r10, qword [r8]
xor r11d, r11d
movzx r14d, word [r10 + r11*2]
cmp r14w, word [rdx + r11*2]
jne 0x14008efa2
inc r11
cmp rcx, r11
jne 0x14008f01d
jmp 0x14008efaf
lea rcx, [rsp + 0xa0]
mov rdx, rdi
mov r8, r13
call fcn.1400734c0
mov al, byte [rsp + 0xf7]
jmp 0x14008efd1
mov r12d, 0xa
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], r12
lea rcx, [rsp + 0xa0]
mov r8d, 1
mov rdx, r12
mov r9, r12
call fcn.1400736d0
mov rax, r12
jmp 0x14008ee7c
int3
jns 0x14008efcc
int3
lea rcx, [0x140121d8c]
lea rdx, str....._third_partylibc_srcinclude_string_view:314:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
call fcn.1400d6ae0
mov rcx, qword [rsp + 0xe0]
call fcn.1400a2cfc
jmp 0x14008ef2a
lea rcx, [0x140121d8c]
lea rdx, str....._third_partylibc_srcinclude_string_view:316:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
call fcn.1400d6ae0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
jmp 0x14008f0e1
mov dword [rsi], 0x542
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x15
jmp 0x14008ecba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x17
jmp 0x14008ecba
lea rcx, fcn.140061ab0
xor r8d, r8d
call fcn.140060910
jmp 0x14008ea4a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov ebx, 0x12
jmp 0x14008ecc7
mov ebx, 0x46
jmp 0x14008ecde
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x41
jmp 0x14008ecba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x2b
jmp 0x14008ecba