Function at 0x14006bde0
Capabilities:
Create process on windows
Query environment variable
Resume thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x3d8
movaps xmmword [rsp + 0x3c0], xmm6
mov r15, r8
mov r12, rdx
mov r14, rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x3b8], rax
lea rcx, [rsp + 0x220]
mov r8d, 0x190
mov dl, 0xaa
call fcn.14013f660
cmp byte [r12 + 0x17], 0
mov rax, r12
jns 0x14006be3a
mov rax, qword [r12]
xor ecx, ecx
nop dword [rax]
movzx edx, word [rax + rcx*2]
mov word [rsp + rcx*2 + 0x220], dx
test dx, dx
je 0x14006be67
inc rcx
cmp rcx, 0xc8
jne 0x14006be40
mov word [rsp + 0x3ae], 0
lea rcx, [rsp + 0x220]
call fcn.1400b5b70
cmp byte [r15 + 0x21], 0
jne 0x14006c514
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov bpl, byte [0x140329260]
xor ebx, ebx
test bpl, 0x19
je 0x14006c1bf
lea rsi, [rsp + 0x110]
mov rcx, rsi
call fcn.1400c65b0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea r13, [0x140329260]
lea r8, str.LaunchProcess
mov cl, 0x58
mov rdx, r13
mov qword [rsp + 0x78], r8
xor r9d, r9d
call fcn.140189ab0
mov qword [rsp + 0x70], rax
lea rsi, [rsp + 0x1a0]
mov qword [rsi + 0x10], rdi
movaps xmm6, xmmword [0x1402e6d80]
movaps xmmword [rsi], xmm6
lea rdx, str.LaunchProcess
lea r8, str....._baseprocesslaunch_win.cc
lea rdi, [rsp + 0x110]
mov rcx, rdi
mov r9d, 0x121
call fcn.1400b5b90
lea r8, [0x14033afec]
mov rcx, rsi
mov rdx, rdi
call fcn.140189160
xorps xmm0, xmm0
movaps xmmword [rsp + 0x210], xmm0
mov dword [rsp + 0x18c], 0
movaps xmmword [rdi], xmm0
movaps xmmword [rdi + 0x60], xmm0
movaps xmmword [rdi + 0x50], xmm0
movaps xmmword [rdi + 0x40], xmm0
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
mov qword [rdi + 0x70], 0
mov dword [rdi + 8], 0x70
cmp byte [r15 + 0x7a], 0
je 0x14006bf99
call fcn.1401153b0
xor ebx, ebx
cmp eax, 0x10
setge bl
movzx eax, byte [r15 + 0x7b]
add ebx, eax
mov rcx, qword [r15 + 0x28]
xor r8d, r8d
cmp rcx, qword [r15 + 0x30]
setne r8b
add r8d, ebx
movzx edx, byte [r15 + 0x7c]
add edx, r8d
je 0x14006c815
lea rcx, [rsp + 0x110]
call fcn.14006cc30
test al, al
je 0x14006c483
mov al, byte [r15 + 0x7b]
mov ebx, 0x80000
mov dword [rsp + 0x10c], 2
test al, al
jne 0x14006c8c2
cmp byte [r15 + 0x7a], 0
je 0x14006c04a
call fcn.1401153b0
cmp eax, 0x10
jl 0x14006c04a
or byte [rsp + 0x21b], 0x20
mov rcx, qword [rsp + 0x180]
test rcx, rcx
je 0x14006c422
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], 0x10
lea r9, [rsp + 0x210]
mov r8d, 0x20007
xor edx, edx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x14006c422
mov qword [rsp + 0x68], r13
mov byte [rsp + 0x5f], bpl
mov qword [rsp + 0x60], r14
cmp byte [r15 + 0x7c], 0
jne 0x14006c95e
cmp dword [r15 + 0x24], 1
sete bpl
mov r13, qword [r15 + 0x28]
mov r14, qword [r15 + 0x30]
cmp r13, r14
je 0x14006c118
mov rax, r14
sub rax, r13
mov ecx, 0xfffffff8
cmp rax, rcx
ja 0x14006c4bd
mov rbp, qword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea rdi, [0x1402e7b24]
lea rsi, [rsp + 0x100]
mov rcx, qword [r13]
mov edx, 1
mov r8d, 1
call rbp
test eax, eax
je 0x14006c881
add r13, 8
cmp r13, r14
jne 0x14006c0a8
mov r9, qword [r15 + 0x28]
mov rax, qword [r15 + 0x30]
cmp rax, r9
je 0x14006c81c
mov rcx, qword [rsp + 0x180]
test rcx, rcx
je 0x14006c454
sub eax, r9d
and eax, 0xfffffff8
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rax
mov r8d, 0x20002
xor edx, edx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
mov bpl, 1
test eax, eax
je 0x14006c454
cmp byte [r15 + 0x22], 0
jne 0x14006c81f
cmp byte [r15 + 0x50], 0
jne 0x14006c82c
mov eax, dword [rsp + 0x154]
mov ecx, eax
or ecx, 1
mov dword [rsp + 0x154], ecx
mov edx, dword [r15 + 0x40]
test edx, edx
jne 0x14006c91c
xor ecx, ecx
cmp byte [r15 + 0x20], 0
sete cl
mov word [rsp + 0x158], cx
mov rcx, qword [r15 + 0x60]
mov rdx, qword [r15 + 0x68]
mov r8, qword [r15 + 0x70]
test rcx, rcx
jne 0x14006c7c7
test rdx, rdx
jne 0x14006c7c7
test r8, r8
jne 0x14006c7c7
cmp byte [r15 + 0x78], 0
lea r14d, [rbx + 0x1000000]
cmove r14d, ebx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xe0], xmm0
mov qword [rsp + 0xf0], 0
movzx eax, byte [r15 + 0x1f]
test al, al
js 0x14006c1d1
lea rbx, [r15 + 8]
and eax, 0x7f
jmp 0x14006c1d9
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
xor r13d, r13d
jmp 0x14006bef9
mov rax, qword [r15 + 0x10]
mov rbx, qword [r15 + 8]
test rax, rax
cmove rbx, rax
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xd0], rdi
movaps xmmword [rsp + 0xc0], xmm6
cmp byte [r12 + 0x17], 0
jns 0x14006c862
mov rdx, qword [r12]
mov r8, qword [r12 + 8]
lea rcx, [rsp + 0xc0]
call fcn.1400b07ba
cmp byte [r15 + 0x7d], 0
jne 0x14006c840
xor r12d, r12d
lea r13, [rsp + 0x118]
mov rdx, qword [r15 + 0x48]
test rdx, rdx
jne 0x14006c741
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1c0], xmm0
mov qword [rsp + 0x1d0], 0
mov al, byte [r15 + 0x98]
test al, al
jne 0x14006c573
cmp qword [r15 + 0x90], 0
jne 0x14006c573
xor eax, eax
movzx ecx, bpl
cmp byte [rsp + 0xd7], 0
js 0x14006c28d
lea rdx, [rsp + 0xc0]
jmp 0x14006c295
mov rdx, qword [rsp + 0xc0]
lea r8, [rsp + 0xe0]
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ecx
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14006c586
cmp byte [rsp + 0x1d7], 0
js 0x14006c442
mov r14, qword [rsp + 0x60]
mov bpl, byte [rsp + 0x5f]
mov r13, qword [rsp + 0x68]
xorps xmm0, xmm0
lea rcx, [rsp + 0xa0]
movaps xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
lea rdx, [rsp + 0xe0]
call fcn.14006cd00
test r12, r12
je 0x14006c320
cmp byte [r15 + 0x7d], 0
jne 0x14006c4ec
mov rcx, qword [r15 + 0x58]
test rcx, rcx
jne 0x14006c407
cmp byte [r15 + 0x79], 0
jne 0x14006c4a3
cmp byte [r15], 0
jne 0x14006c9d2
mov dword [rsp + 0xb0], 0
mov rsi, qword [rsp + 0xa0]
mov qword [rsp + 0xa0], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14006c370
call fcn.1400a6030
mov rcx, r14
mov rdx, rsi
call fcn.14012ece0
lea rcx, [rsp + 0xa0]
call fcn.14006cb70
cmp byte [rsp + 0xd7], 0
jns 0x14006c39f
mov rcx, qword [rsp + 0xc0]
call fcn.14013a6ac
lea rcx, [rsp + 0x110]
call fcn.14006cb30
lea rcx, [rsp + 0x1a0]
call fcn.1400c9df0
test bpl, 0x19
je 0x14006c3d8
cmp byte [r13], 0
je 0x14006c3d8
mov rcx, r13
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
call fcn.14018add0
mov rcx, qword [rsp + 0x3b8]
xor rcx, rsp
call fcn.14013d520
mov rax, r14
movaps xmm6, xmmword [rsp + 0x3c0]
add rsp, 0x3d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x14006c32d
jmp 0x14006ca3f
mov qword [r14], 0
mov byte [r14 + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
jne 0x14006c39f
jmp 0x14006cb10
mov rcx, qword [rsp + 0x1c0]
call fcn.14013a6ac
jmp 0x14006c2de
mov r14, qword [rsp + 0x60]
mov qword [r14], 0
mov byte [r14 + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
mov bpl, byte [rsp + 0x5f]
mov r13, qword [rsp + 0x68]
jne 0x14006c39f
jmp 0x14006cb13
mov qword [r14], 0
mov byte [r14 + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
jne 0x14006c39f
jmp 0x14006cb16
mov rcx, qword [rsp + 0xa0]
call fcn.140114c90
mov ecx, eax
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
jmp 0x14006c338
mov r14, qword [rsp + 0x60]
mov qword [r14], 0
mov byte [r14 + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
mov bpl, byte [rsp + 0x5f]
mov r13, qword [rsp + 0x68]
jne 0x14006c39f
jmp 0x14006cb19
mov ecx, dword [rsp + 0xb0]
mov edx, 4
mov rax, r12
call qword [case.0x14017aab5.0]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x14006c320
mov bl, byte [r15]
mov sil, byte [r15 + 0x20]
movzx eax, byte [r12 + 0x17]
mov ecx, eax
and ecx, 0x7f
test al, al
mov rax, qword [r12]
cmovns rax, r12
lea rdx, [rsp + 0x190]
mov qword [rdx], rax
cmovs rcx, qword [r12 + 8]
mov qword [rdx + 8], rcx
lea rdi, [rsp + 0x110]
mov rcx, rdi
call fcn.140136c20
mov rcx, r14
mov rdx, rdi
mov r8d, esi
mov r9d, ebx
call fcn.1401f5ec0
mov rcx, rdi
call fcn.140129620
jmp 0x14006c3d8
test al, al
jne 0x14006c5d0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
jne 0x14006c64a
mov rax, qword [rsp + 0x60]
mov qword [rax], 0
mov byte [rax + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x14006cb28
cmp byte [rsp + 0x1d7], 0
jns 0x14006c5bc
mov rcx, qword [rsp + 0x1c0]
call fcn.14013a6ac
mov r14, qword [rsp + 0x60]
mov bpl, byte [rsp + 0x5f]
mov r13, qword [rsp + 0x68]
jmp 0x14006c388
lea r8, [r15 + 0x80]
lea rdx, [0x1402f0d44]
lea rcx, [rsp + 0x80]
call fcn.140217c40
cmp byte [rsp + 0x1d7], 0
jns 0x14006c602
mov rcx, qword [rsp + 0x1c0]
call fcn.14013a6ac
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x1d0], rax
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x1c0], xmm0
cmp byte [rsp + 0x1d7], 0
js 0x14006c636
lea rax, [rsp + 0x1c0]
jmp 0x14006c63e
mov rax, qword [rsp + 0x1c0]
or r14d, 0x400
jmp 0x14006c275
mov rsi, rax
lea r8, [r15 + 0x80]
lea rcx, [rsp + 0x80]
mov rdx, rax
call fcn.140217c40
cmp byte [rsp + 0x1d7], 0
jns 0x14006c67b
mov rcx, qword [rsp + 0x1c0]
call fcn.14013a6ac
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x1d0], rax
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x1c0], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14006c622
movzx edx, bpl
cmp byte [rsp + 0xd7], 0
js 0x14006c6c1
lea r8, [rsp + 0xc0]
jmp 0x14006c6c9
mov r8, qword [rsp + 0xc0]
mov rcx, qword [r15 + 0x48]
lea r9, [rsp + 0xe0]
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], 0
xor edx, edx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
mov rcx, qword [rsp + 0x1c0]
call sub.USERENV.dll_DestroyEnvironmentBlock
test esi, esi
jne 0x14006c2de
mov rax, qword [rsp + 0x60]
mov qword [rax], 0
mov byte [rax + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
jne 0x14006c5bc
jmp 0x14006cb2b
lea rcx, [rsp + 0x1c0]
mov qword [rcx], 0
xor r8d, r8d
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x14006c71d
or r14d, 0x400
cmp byte [r15 + 0x7e], 0
mov rax, qword [rsp + 0x1c0]
je 0x14006c6a9
cmp byte [rsp + 0xd7], 0
js 0x14006c78a
lea r9, [rsp + 0xc0]
jmp 0x14006c792
mov r9, qword [rsp + 0xc0]
mov rcx, qword [r15 + 0x48]
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
jmp 0x14006c706
mov r9, qword [r15 + 0x28]
cmp r9, qword [r15 + 0x30]
jne 0x14006c7ec
test rcx, rcx
je 0x14006cb1f
test rdx, rdx
je 0x14006cb22
test r8, r8
je 0x14006cb25
or eax, 0x101
mov dword [rsp + 0x154], eax
mov qword [rsp + 0x168], rcx
mov qword [rsp + 0x170], rdx
mov qword [rsp + 0x178], r8
jmp 0x14006c186
xor ebx, ebx
jmp 0x14006bfde
int3
or byte [rsp + 0x154], 0x80
jmp 0x14006c123
lea rax, [0x1402e7b22]
mov qword [rsp + 0x128], rax
jmp 0x14006c12e
call fcn.140217bd0
test rax, rax
jne 0x14006c856
or r14d, 0x8000
jmp 0x14006c227
mov r12, rax
or r14d, 4
jmp 0x14006c22a
mov rax, qword [r12 + 0x10]
mov qword [rsp + 0xd0], rax
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0xc0], xmm0
jmp 0x14006c21c
lea rcx, [rsp + 0x1c0]
lea rdx, str.LaunchProcess
lea r8, str....._baseprocesslaunch_win.cc
mov r9d, 0x17c
call fcn.1400b5b90
mov rcx, rsi
mov rdx, rdi
lea r8, [rsp + 0x1c0]
call fcn.1401ffd60
mov rcx, rsi
call fcn.1401ffe30
jmp 0x14006c0c1
mov rcx, qword [rsp + 0x180]
test rcx, rcx
je 0x14006c8fe
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], 4
lea r9, [rsp + 0x10c]
mov r8d, 0x20012
xor edx, edx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x14006bff1
mov qword [r14], 0
mov byte [r14 + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
jne 0x14006c39f
int3
mov cx, 0xa
add edx, 0xfffffffe
cmp edx, 3
ja case.default.0x14006c93a
lea rcx, [0x1402f0d68]
movsxd rdx, dword [rcx + rdx*4]
add rdx, rcx
jmp rdx
mov cx, 1
jmp case.default.0x14006c93a
mov cx, 2
jmp case.default.0x14006c93a
mov cx, 7
jmp case.default.0x14006c93a
xor ecx, ecx
jmp case.default.0x14006c93a
mov dword [rsp + 0x18c], 1
mov rcx, qword [rsp + 0x180]
test rcx, rcx
je 0x14006c9a5
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], 4
lea r9, [rsp + 0x18c]
mov r8d, 0x2001c
xor edx, edx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x14006c064
mov r14, qword [rsp + 0x60]
mov qword [r14], 0
mov byte [r14 + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
mov bpl, byte [rsp + 0x5f]
mov r13, qword [rsp + 0x68]
jne 0x14006c39f
int3
lea rsi, [rsp + 0x1c0]
mov qword [rsi + 0x40], rdi
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
lea rdx, str.LaunchProcess
lea r8, str....._baseprocesslaunch_win.cc
lea rdi, [rsp + 0x80]
mov rcx, rdi
mov r9d, 0x21f
call fcn.1400b5b90
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
call fcn.140062770
mov rcx, qword [rsp + 0xa0]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
call fcn.140062a80
jmp 0x14006c342
movaps xmmword [rsp + 0x1c0], xmm6
mov dword [rsp + 0xb0], 0
mov rsi, qword [rsp + 0xa0]
mov qword [rsp + 0xa0], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14006ca75
call fcn.1400a6030
lea rdi, [rsp + 0x1c0]
mov rcx, rdi
mov rdx, rsi
call fcn.14012ece0
mov rcx, rdi
mov edx, 1
mov r8b, 1
call fcn.1401f5db0
mov rax, qword [rsp + 0x60]
mov qword [rax], 0
mov byte [rax + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x14006cb1c
mov rax, qword [rsp + 0x1c0]
inc rax
cmp rax, 2
jae 0x14006cad8
mov r14, qword [rsp + 0x60]
mov bpl, byte [rsp + 0x5f]
mov r13, qword [rsp + 0x68]
jmp 0x14006c37b
call fcn.1400a6030
mov rsi, qword [rsp + 0x1c0]
mov rcx, qword [0x14033c3e8]
test rcx, rcx
je 0x14006cb02
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rsi
call qword [case.0x14017aab5.0]
jmp 0x14006cac4
call fcn.1400515d0
mov rcx, qword [0x14033c3e8]
jmp 0x14006caf1
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3