Function at 0x140115c20
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
movaps xmmword [rsp + 0x130], xmm7
movaps xmmword [rsp + 0x120], xmm6
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x140231040]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rcx, rdx
call fcn.14012bae0
mov rdx, qword [rbx + 0x48]
mov qword [rbx + 0x48], rax
test rdx, rdx
jne 0x1401164d2
mov rbp, qword [r15]
mov rcx, rdi
call fcn.14012bae0
xor edi, edi
cmp qword [rbp + 0xa0], 0
mov r13, rax
setne r12b
xorps xmm6, xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0xd0], 0
mov r8, qword [r15]
cmp byte [r8 + 0x21], 0
jne 0x140115f7a
xor eax, eax
xor ecx, ecx
xor edx, edx
mov rsi, qword [rsp + 0x1b8]
mov dil, r12b
shl edi, 0x13
or edi, 0x40c
movzx r8d, byte [r8 + 0x20]
xor r9d, r9d
lea r10, [rsp + 0x100]
mov qword [r10 + 0x10], r9
add rbp, 0x38
test dl, dl
movzx edx, dl
cmovs rdx, rcx
movaps xmmword [r10], xmm6
lea r11, [rsp + 0xc0]
cmovs r11, rax
test rdx, rdx
cmove r11, rdx
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
mov rdx, r14
mov r8, r13
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1401164e6
xorps xmm0, xmm0
lea r14, [rsp + 0xe0]
movaps xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
lea rdx, [rsp + 0x100]
mov rcx, r14
call fcn.14004ad20
mov rax, qword [r14 + 8]
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x140116486
mov rdx, qword [rsp + 0xe8]
movaps xmm0, xmmword [0x1401fd000]
lea r14, [rsp + 0xa0]
movaps xmmword [r14], xmm0
mov rcx, r14
mov r8b, 1
xor r9d, r9d
call fcn.140044150
cmp byte [r14 + 8], 0
je 0x140116490
lea r14, [rsp + 0xa0]
mov rcx, r14
call fcn.140044230
mov ebp, eax
cmp byte [r14 + 8], 0
je 0x140115dec
lea rcx, [rsp + 0xa0]
call fcn.1400376a0
test bpl, bpl
jne 0x140116490
mov r14, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0xe0]
mov rdx, r14
call fcn.14004a8d0
test al, al
je 0x1401164b0
lea rdx, [r14 + 8]
mov rcx, qword [rsp + 0xe8]
call fcn.14004a8d0
test al, al
je 0x1401164b0
mov eax, dword [rsp + 0xf0]
mov dword [r14 + 0x10], eax
mov eax, dword [rsp + 0xf4]
mov dword [r14 + 0x14], eax
mov rcx, qword [rsp + 0xe0]
call fcn.140044430
mov qword [rbx + 0x40], rax
test rax, rax
je 0x14011651c
lea rcx, [0x140000000]
cmp rax, rcx
jne 0x140116502
mov rsi, qword [rsp + 0xe0]
mov qword [rsp + 0xe0], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140115e91
call fcn.1400b28a0
mov qword [rsp + 0xa0], rsi
mov rsi, qword [rsp + 0xe8]
mov qword [rsp + 0xe8], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140115ebc
call fcn.1400b28a0
lea rdx, [rsp + 0xa0]
mov qword [rdx + 8], rsi
mov rax, qword [rsp + 0xf0]
mov qword [rdx + 0x10], rax
mov qword [rsp + 0xf0], 0
mov rcx, rbx
call fcn.14004ad20
xor ebx, ebx
lea rcx, [rsp + 0xe0]
call fcn.14003dd30
cmp byte [rsp + 0xd7], 0
jns 0x140115f0e
mov rcx, qword [rsp + 0xc0]
call fcn.14012aa6c
test r13, r13
je 0x140115f25
lea rcx, str.PM_v_
mov rdx, r13
xor r8d, r8d
call fcn.1400ce810
mov rdi, qword [r15]
mov qword [r15], 0
test rdi, rdi
je 0x140115f44
mov rcx, rdi
call fcn.140044320
mov rcx, rdi
call fcn.14012aa6c
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.14012d2c0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x120]
movaps xmm7, xmmword [rsp + 0x130]
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x1401164f8
mov rsi, rax
xorps xmm7, xmm7
movaps xmmword [rsp + 0xa0], xmm7
mov qword [rsp + 0xb0], 0
movzx eax, word [rax]
test ax, ax
je 0x140115ffd
mov byte [rsp + 0x67], r12b
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], r15
lea r12, [rsp + 0x100]
lea r14, [rsp + 0xe0]
mov rbp, rsi
lea rsi, str.Path
lea r15, str.Path
mov qword [rsp + 0x68], rbp
jmp 0x1401162dc
xor eax, eax
jmp 0x14011602d
cmp al, 0xa
mov r15, qword [rsp + 0x88]
mov r13, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov r12b, byte [rsp + 0x67]
mov rsi, qword [rsp + 0x68]
je 0x14011640e
movzx eax, al
mov edx, eax
inc dl
and dl, 0x7f
lea rcx, [rsp + 0xa0]
mov byte [rcx + 0x17], dl
jmp 0x1401160b5
mov al, byte [rsp + 0xb7]
test al, al
mov r14, qword [rsp + 0x90]
jns 0x140116001
movabs r12, 0x7fffffffffffffff
and r12, qword [rsp + 0xb0]
dec r12
mov rax, qword [rsp + 0xa8]
cmp rax, r12
mov r15, qword [rsp + 0x88]
mov r13, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
je 0x140116414
mov rcx, qword [rsp + 0xa0]
lea rdx, [rax + 1]
mov qword [rsp + 0xa8], rdx
mov r12b, byte [rsp + 0x67]
mov dword [rcx + rax*2], 0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xc8], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov dl, byte [rsp + 0xd7]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov r8, qword [r15]
jmp 0x140115cc1
xor r9d, r9d
lea r10, str.SystemDrive
movzx r8d, word [r10]
cmp r8w, word [rdx + r9*2]
jne 0x140116144
add r10, 2
inc r9
xor r8d, r8d
cmp rcx, r9
jne 0x14011611e
lea r9, str.SystemDrive
jmp 0x14011629f
cmp rcx, 0xa
jne 0x140116271
jmp 0x1401163f9
xor r10d, r10d
lea r8, str.SystemRoot
movzx r8d, word [r10 + r8]
cmp r8w, word [rdx + r10]
jne 0x140116271
add r10, 2
xor r8d, r8d
dec r9
jne 0x140116156
lea r9, str.SystemRoot
jmp 0x14011629f
xor r9d, r9d
lea r8, str.Path
movzx r8d, word [r9 + r8]
cmp r8w, word [rdx + r9]
jne 0x14011625a
add r9, 2
xor r8d, r8d
cmp r9, 8
jne 0x140116188
mov r9, rsi
jmp 0x14011629f
movzx eax, ax
test eax, eax
je 0x1401161ce
movzx eax, word [rbx + r13*2 + 2]
inc r13
add rbp, 2
cmp ax, 0x3d
jne 0x1401161b4
mov rcx, r12
mov rdx, rbx
mov r8, r13
call fcn.140044060
cmp byte [rsp + 0xf7], 0
js 0x140116461
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xf0], rax
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xe0], xmm0
inc r13
cmp word [rbp], 0
lea rbp, [rbp + 2]
jne 0x14011620a
movsx rax, byte [rsp + 0xf7]
test rax, rax
mov rcx, qword [rsp + 0xe8]
cmovns rcx, rax
mov rdx, qword [rsp + 0xe0]
cmovns rdx, r14
test rcx, rcx
js 0x14011644e
je 0x140116250
test rdx, rdx
je 0x140116473
cmp rcx, 4
je 0x140116185
cmp rcx, 0xb
je 0x140116114
mov r9, rcx
cmp rcx, 0xa
je 0x140116153
cmp rcx, 4
je 0x140116341
mov r8b, 1
cmp rcx, 3
je 0x140116317
cmp rcx, 0xc
je 0x1401163ba
mov r9, r15
cmp rcx, 0x19
je 0x140116374
sub r9, rsi
sar r9, 4
test r9, r9
jle 0x140116445
cmp r9, 8
jae 0x140116442
test r8b, r8b
je 0x1401162fb
test al, al
jns 0x1401162cf
mov rcx, qword [rsp + 0xe0]
call fcn.14012aa6c
movzx eax, word [rbp]
test ax, ax
je 0x140116044
mov rbx, rbp
movaps xmmword [rsp + 0xe0], xmm7
mov qword [rsp + 0xf0], 0
xor r13d, r13d
jmp 0x1401161c8
lea rcx, [rsp + 0xa0]
mov rdx, rbx
mov r8, r13
call fcn.1400ea270
mov al, byte [rsp + 0xf7]
jmp 0x1401162be
xor r9d, r9d
lea r10, [0x14021b452]
movzx r11d, word [r10]
cmp r11w, word [rdx + r9*2]
jne 0x140116288
add r10, 2
inc r9
cmp rcx, r9
jne 0x140116321
jmp 0x1401163ea
xor r9d, r9d
lea r8, str.TEMP
movzx r8d, word [r9 + r8]
cmp r8w, word [rdx + r9]
jne 0x14011627b
add r9, 2
xor r8d, r8d
cmp r9, 8
jne 0x140116344
lea r9, str.TEMP
jmp 0x14011629f
xor r9d, r9d
lea r8, str.CHROME_CRASHPAD_PIPE_NAME
movzx r8d, word [r9 + r8]
cmp r8w, word [rdx + r9]
setne r8b
jne 0x1401163a3
add r9, 2
dec rcx
jne 0x140116377
lea r9, str.CHROME_CRASHPAD_PIPE_NAME
jmp 0x14011629f
mov r9, r15
jmp 0x14011629f
mov r9, r15
cmp rcx, 0x19
jne 0x14011629f
jmp 0x140116404
xor r9d, r9d
lea r10, str.LOCALAPPDATA
movzx r11d, word [r10]
cmp r11w, word [rdx + r9*2]
jne 0x1401163ab
add r10, 2
inc r9
cmp rcx, r9
jne 0x1401163c4
xor r8d, r8d
lea r9, str.LOCALAPPDATA
jmp 0x14011629f
xor r8d, r8d
lea r9, [0x14021b3e0]
jmp 0x14011629f
mov r9d, 0xa
jmp 0x140116153
mov ecx, 0x19
jmp 0x140116374
mov r12d, 0xa
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], r12
lea rcx, [rsp + 0xa0]
mov r8d, 1
mov rdx, r12
mov r9, r12
call fcn.1400e63f0
mov rax, r12
jmp 0x14011609c
int3
jns 0x1401162b9
int3
lea rcx, [0x14020310b]
lea rdx, str....._third_partylibc_srcinclude_string_view:314:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
call fcn.140164a90
mov rcx, qword [rsp + 0xe0]
call fcn.14012aa6c
jmp 0x1401161ea
lea rcx, [0x14020310b]
lea rdx, str....._third_partylibc_srcinclude_string_view:316:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
call fcn.140164a90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
jmp 0x140116496
mov dword [rsi], 0x542
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x15
jmp 0x140115eea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x17
jmp 0x140115eea
lea rcx, str.PM_v_
xor r8d, r8d
call fcn.1400ce810
jmp 0x140115c7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov ebx, 0x12
jmp 0x140115ef7
mov ebx, 0x46
jmp 0x140115f0e
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x41
jmp 0x140115eea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x2b
jmp 0x140115eea