Function at 0x140116450
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
movaps xmmword [rsp + 0x130], xmm7
movaps xmmword [rsp + 0x120], xmm6
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x140219028]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rcx, rdx
call fcn.14012dc50
mov rdx, qword [rbx + 0x48]
mov qword [rbx + 0x48], rax
test rdx, rdx
jne 0x140116d75
mov rbp, qword [r15]
mov rcx, rdi
call fcn.14012dc50
xor edi, edi
cmp qword [rbp + 0xa0], 0
mov r13, rax
setne r12b
xorps xmm6, xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0xd0], 0
mov r8, qword [r15]
cmp byte [r8 + 0x21], 0
je 0x14011684e
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x140116cb9
mov rsi, rax
xorps xmm7, xmm7
movaps xmmword [rsp + 0xa0], xmm7
mov qword [rsp + 0xb0], 0
movzx eax, word [rax]
test ax, ax
je 0x140116c23
mov byte [rsp + 0x67], r12b
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x90], r15
lea r12, [rsp + 0x100]
lea r15, [rsp + 0xe0]
mov rbp, rsi
lea rsi, str.PR__
lea r14, str.Path
mov qword [rsp + 0x68], rbp
jmp 0x14011670f
xor r8d, r8d
lea r9, str.SystemDrive
movzx r10d, word [r9]
cmp r10w, word [rdx + r8*2]
jne 0x14011659f
add r9, 2
inc r8
cmp rcx, r8
jne 0x14011657c
lea r8, str.ZR__
jmp 0x1401166d5
cmp rcx, 0xa
jne 0x1401166aa
mov r8d, 0xa
jmp 0x14011677a
xor r8d, r8d
lea r9, str.Path
movzx r9d, word [r8 + r9]
cmp r9w, word [rdx + r8]
jne 0x140116693
add r8, 2
cmp r8, 8
jne 0x1401165b7
mov r8, rsi
jmp 0x1401166d5
movzx eax, ax
test eax, eax
je 0x1401165fa
movzx eax, word [rbx + r13*2 + 2]
inc r13
add rbp, 2
cmp ax, 0x3d
jne 0x1401165e0
mov rcx, r12
mov rdx, rbx
mov r8, r13
call fcn.140168380
cmp byte [rsp + 0xf7], 0
js 0x140116d0b
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xf0], rax
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xe0], xmm0
nop word cs:[rax + rax]
inc r13
cmp word [rbp], 0
lea rbp, [rbp + 2]
jne 0x140116640
movzx eax, byte [rsp + 0xf7]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs rcx, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0xe0]
cmovns rdx, r15
test rcx, rcx
js 0x140116d1d
test rdx, rdx
jne 0x140116689
test rcx, rcx
jne 0x140116d49
cmp rcx, 4
je 0x1401165b4
cmp rcx, 0xb
je 0x140116572
mov r8, rcx
cmp rcx, 0xa
je 0x14011677a
cmp rcx, 4
je 0x14011674a
cmp rcx, 3
je 0x1401167a9
cmp rcx, 0xc
je 0x140116821
mov r8, r14
cmp rcx, 0x19
je 0x1401167df
sub r8, rsi
test r8, r8
jle 0x140116d02
cmp r8, 0x71
jae 0x140116cff
cmp r8, 0x70
jne 0x14011672e
test al, al
jns 0x140116702
mov rcx, qword [rsp + 0xe0]
call fcn.14012cd4c
movzx eax, word [rbp]
test ax, ax
je 0x140116859
mov rbx, rbp
movaps xmmword [rsp + 0xe0], xmm7
mov qword [rsp + 0xf0], 0
xor r13d, r13d
jmp 0x1401165f4
lea rcx, [rsp + 0xa0]
mov rdx, rbx
mov r8, r13
call fcn.140014560
mov al, byte [rsp + 0xf7]
jmp 0x1401166f1
xor r8d, r8d
lea r9, str.TEMP
movzx r9d, word [r8 + r9]
cmp r9w, word [rdx + r8]
jne 0x1401166b4
add r8, 2
cmp r8, 8
jne 0x14011674d
lea r8, str.TEMP
jmp 0x1401166d5
xor r9d, r9d
lea r10, str.SystemRoot
movzx r10d, word [r9 + r10]
cmp r10w, word [rdx + r9]
jne 0x1401166aa
add r9, 2
dec r8
jne 0x14011677d
lea r8, str.rR__
jmp 0x1401166d5
xor r8d, r8d
lea r9, [0x140205292]
movzx r10d, word [r9]
cmp r10w, word [rdx + r8*2]
jne 0x1401166be
add r9, 2
inc r8
cmp rcx, r8
jne 0x1401167b3
lea r8, [0x140205220]
jmp 0x1401166d5
mov ecx, 0x19
xor r8d, r8d
lea r9, str.CHROME_CRASHPAD_PIPE_NAME
movzx r9d, word [r8 + r9]
cmp r9w, word [rdx + r8]
jne 0x14011680a
add r8, 2
dec rcx
jne 0x1401167e2
lea r8, str.CHROME_CRASHPAD_PIPE_NAME
jmp 0x1401166d5
mov r8, r14
jmp 0x1401166d5
mov r8, r14
cmp rcx, 0x19
jne 0x1401166d5
jmp 0x1401167da
xor r8d, r8d
lea r9, str.LOCALAPPDATA
movzx r10d, word [r9]
cmp r10w, word [rdx + r8*2]
jne 0x140116812
add r9, 2
inc r8
cmp rcx, r8
jne 0x14011682b
lea r8, str.LOCALAPPDATA
jmp 0x1401166d5
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x140116928
mov al, byte [rsp + 0xb7]
test al, al
mov r15, qword [rsp + 0x90]
mov r14, qword [rsp + 0x88]
jns 0x140116be9
movabs r12, 0x7fffffffffffffff
and r12, qword [rsp + 0xb0]
dec r12
mov rax, qword [rsp + 0xa8]
cmp rax, r12
mov r13, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
je 0x140116c2d
mov rcx, qword [rsp + 0xa0]
lea rdx, [rax + 1]
mov qword [rsp + 0xa8], rdx
mov r12b, byte [rsp + 0x67]
mov dword [rcx + rax*2], 0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xc8], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov dl, byte [rsp + 0xd7]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov r8, qword [r15]
mov rsi, qword [rsp + 0x1b8]
mov dil, r12b
shl edi, 0x13
or edi, 0x40c
movzx r8d, byte [r8 + 0x20]
xor r9d, r9d
lea r10, [rsp + 0x100]
mov qword [r10 + 0x10], r9
add rbp, 0x38
mov r11d, edx
and r11b, 0x7f
test dl, dl
movzx edx, r11b
cmovs rdx, rcx
movaps xmmword [r10], xmm6
lea r11, [rsp + 0xc0]
cmovs r11, rax
test rdx, rdx
cmove r11, rdx
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
mov rdx, r14
mov r8, r13
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140116ca7
xorps xmm0, xmm0
lea r14, [rsp + 0xe0]
movaps xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
lea rdx, [rsp + 0x100]
mov rcx, r14
call fcn.140025a90
mov rax, qword [r14 + 8]
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x140116c9d
mov rdx, qword [rsp + 0xe8]
movaps xmm0, xmmword [0x1401ee3a0]
lea r14, [rsp + 0xa0]
movaps xmmword [r14], xmm0
mov rcx, r14
mov r8b, 1
xor r9d, r9d
call fcn.140037a40
cmp byte [r14 + 8], 0
je 0x140116c5b
lea r14, [rsp + 0xa0]
mov rcx, r14
call fcn.140037b20
mov ebp, eax
cmp byte [r14 + 8], 0
je 0x140116a5b
lea rcx, [rsp + 0xa0]
call fcn.140035520
test bpl, bpl
jne 0x140116c5b
mov r14, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0xe0]
mov rdx, r14
call fcn.1400261a0
test al, al
je 0x140116c7b
lea rdx, [r14 + 8]
mov rcx, qword [rsp + 0xe8]
call fcn.1400261a0
test al, al
je 0x140116c7b
mov eax, dword [rsp + 0xf0]
mov dword [r14 + 0x10], eax
mov eax, dword [rsp + 0xf4]
mov dword [r14 + 0x14], eax
mov rcx, qword [rsp + 0xe0]
call fcn.140037d10
mov qword [rbx + 0x40], rax
test rax, rax
je 0x140116cdd
lea rcx, [0x140000000]
cmp rax, rcx
jne 0x140116cc3
mov rsi, qword [rsp + 0xe0]
mov qword [rsp + 0xe0], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140116b00
call fcn.1400b9400
mov qword [rsp + 0xa0], rsi
mov rsi, qword [rsp + 0xe8]
mov qword [rsp + 0xe8], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140116b2b
call fcn.1400b9400
lea rdx, [rsp + 0xa0]
mov qword [rdx + 8], rsi
mov rax, qword [rsp + 0xf0]
mov qword [rdx + 0x10], rax
mov qword [rsp + 0xf0], 0
mov rcx, rbx
call fcn.140025a90
xor ebx, ebx
lea rcx, [rsp + 0xe0]
call fcn.140032260
cmp byte [rsp + 0xd7], 0
jns 0x140116b7d
mov rcx, qword [rsp + 0xc0]
call fcn.14012cd4c
test r13, r13
je 0x140116b94
lea rcx, fcn.1400bdd50
mov rdx, r13
xor r8d, r8d
call fcn.1400bace0
mov rdi, qword [r15]
mov qword [r15], 0
test rdi, rdi
je 0x140116bb3
mov rcx, rdi
call fcn.140037c10
mov rcx, rdi
call fcn.14012cd4c
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.14012f6f0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x120]
movaps xmm7, xmmword [rsp + 0x130]
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp al, 0xa
mov r13, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov r12b, byte [rsp + 0x67]
mov rsi, qword [rsp + 0x68]
je 0x140116c27
movzx eax, al
mov edx, eax
inc dl
and dl, 0x7f
lea rcx, [rsp + 0xa0]
mov byte [rcx + 0x17], dl
jmp 0x1401168ce
xor eax, eax
jmp 0x140116c09
mov r12d, 0xa
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], r12
lea rcx, [rsp + 0xa0]
mov r8d, 1
mov rdx, r12
mov r9, r12
call fcn.140102a20
mov rax, r12
jmp 0x1401168b5
mov dword [rsi], 0x542
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x15
jmp 0x140116b59
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x17
jmp 0x140116b59
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
jmp 0x140116c61
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov ebx, 0x12
jmp 0x140116b66
mov ebx, 0x46
jmp 0x140116b7d
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x41
jmp 0x140116b59
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x2b
jmp 0x140116b59
int3
jns 0x14011672e
int3
mov rcx, qword [rsp + 0xe0]
call fcn.14012cd4c
jmp 0x140116616
lea rax, str.string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len___static_cast_size_type__numeric_limits_difference_type_::max___
mov r8d, 0x13a
call fcn.140167fb0
lea rax, str.string_view::string_view__CharT___size_t_:_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len__0____s___nullptr
mov r8d, 0x13c
call fcn.140167fb0
lea rcx, fcn.1400bdd50
xor r8d, r8d
call fcn.1400bace0
jmp 0x1401164aa