Function at 0x14008c560
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x388
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov rax, qword [0x1400eab80]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov qword [rsp + 0x30], 0
lea rax, str.CSynReflashLib::StartSynTPEnh
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 8
lea r9, [0x1400c1750]
mov r8d, 0x3d2
mov edx, dword [0x1400ec2f8]
lea rcx, [rsp + 0x50]
call fcn.14008f230
nop
call fcn.1400150d0
test eax, eax
jne 0x14008c5e6
lea rcx, [rsp + 0x50]
call fcn.14008f210
jmp 0x14008c978
mov r8d, 0x104
lea rdx, [rsp + 0x160]
mov rcx, qword [str.__ProgramFiles_SynapticsSynTPSynTPEnh.exe_]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [rsp + 0x398]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x14008c62e
cmp dword [rsp + 0x48], 1
je 0x14008c751
cmp dword [rsp + 0x48], 2
je 0x14008c820
jmp 0x14008c96e
mov rdx, qword [str.__ProgramFiles_SynapticsSynTPSynTPEnh.exe_]
lea rcx, [rsp + 0xc0]
call fcn.140008700
nop
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x100]
call fcn.140006e30
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x90]
call fcn.140008130
mov qword [rsp + 0x30], rax
lea rax, str.Stop_n_s__d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
lea r9, [0x1400c1778]
mov r8d, 0x3f3
mov edx, dword [0x1400ec2f8]
lea rcx, [rsp + 0x50]
call fcn.14008ef50
nop
lea rcx, [rsp + 0x100]
call fcn.140002320
nop
lea rcx, [rsp + 0xc0]
call fcn.1400087b0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
lea r9, [0x1400b93f4]
lea r8, [rsp + 0x160]
lea rdx, [0x1400c17c8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
cmp eax, 0x4000
jne 0x14008c74c
lea rax, str.Waiting_for_OS_to_finish_rebooting_n
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
lea r9, [0x1400c17e8]
mov r8d, 0x3f7
mov edx, dword [0x1400ec2f8]
lea rcx, [rsp + 0x50]
call fcn.14008ef50
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14008c6f8
jmp 0x14008c96e
mov rdx, qword [str.__ProgramFiles_SynapticsSynTPSynTPEnh.exe_]
lea rcx, [rsp + 0xa0]
call fcn.140008700
nop
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x140]
call fcn.140006e30
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x88]
call fcn.140008130
mov qword [rsp + 0x30], rax
lea rax, str.Start:_n_s
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
lea r9, [0x1400c1818]
mov r8d, 0x3fc
mov edx, dword [0x1400ec2f8]
lea rcx, [rsp + 0x50]
call fcn.14008ef50
nop
lea rcx, [rsp + 0x140]
call fcn.140002320
nop
lea rcx, [rsp + 0xa0]
call fcn.1400087b0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
lea r9, [0x1400c1810]
lea r8, [rsp + 0x160]
lea rdx, [0x1400c1840]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x14008c96e
lea rdx, str.__lrs
lea rcx, [rsp + 0x40]
call fcn.140015540
nop
mov rcx, qword [rsp + 0x3a0]
call fcn.140003880
test eax, eax
je 0x14008c888
lea rdx, [0x1400b8a4c]
lea rcx, [rsp + 0x40]
call fcn.1400155d0
mov rdx, qword [rsp + 0x3a0]
lea rcx, [rsp + 0x40]
call fcn.140003760
lea rdx, [0x1400c1850]
lea rcx, [rsp + 0x40]
call fcn.1400155d0
lea rdx, [0x1400b8a74]
lea rcx, [rsp + 0x40]
call fcn.1400155d0
mov rdx, qword [str.__ProgramFiles_SynapticsSynTPSynTPEnh.exe_]
lea rcx, [rsp + 0xe0]
call fcn.140008700
nop
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x120]
call fcn.140006e30
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x80]
call fcn.140008130
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
lea rax, str.Get_log_file:__n_s__S
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
lea r9, [0x1400c1888]
mov r8d, 0x407
mov edx, dword [0x1400ec2f8]
lea rcx, [rsp + 0x50]
call fcn.14008ef50
nop
lea rcx, [rsp + 0x120]
call fcn.140002320
nop
lea rcx, [rsp + 0xe0]
call fcn.1400087b0
lea rcx, [rsp + 0x40]
call fcn.140003850
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, [rsp + 0x160]
lea rdx, [0x1400c1878]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x40]
call fcn.140003680
nop
lea rcx, [rsp + 0x50]
call fcn.14008f210
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.140054f80
add rsp, 0x388
ret