Function at 0x140103520
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x108
movaps xmmword [rsp + 0xf0], xmm6
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x1401fdbb8]
xor rax, rsp
mov qword [rsp + 0xe8], rax
mov rcx, rdx
call fcn.14018fcb8
mov rcx, qword [rbx + 0x48]
mov qword [rbx + 0x48], rax
test rcx, rcx
je 0x140103573
call fcn.140193770
mov r12, qword [r15]
mov rcx, rdi
call fcn.14018fcb8
mov rsi, rax
xor ebp, ebp
cmp qword [r12 + 0xa0], 0
setne r13b
xorps xmm6, xmm6
movaps xmmword [rsp + 0xd0], xmm6
mov qword [rsp + 0xe0], 0
mov rcx, qword [r15]
call fcn.1401030a0
test al, al
mov qword [rsp + 0x58], r15
je 0x140103649
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x140103823
mov r15, rax
lea rax, str.Path
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 7
lea rcx, [rsp + 0xb0]
lea r8, [rsp + 0xa0]
mov rdx, r15
call fcn.140103970
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xe0], rax
movups xmm0, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0xd0], xmm0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
movzx edx, byte [rsp + 0xd0]
mov rcx, qword [rsp + 0xd8]
mov rax, qword [rsp + 0xe0]
mov r15, qword [rsp + 0x58]
jmp 0x14010364f
xor eax, eax
xor ecx, ecx
xor edx, edx
mov rdi, qword [rsp + 0x178]
mov bpl, r13b
shl ebp, 0x13
or ebp, 0x40c
mov r8, qword [r15]
movzx r13d, byte [r8 + 0x20]
movaps xmmword [rsp + 0xb0], xmm6
add r12, 0x38
mov r8d, edx
shr r8b, 1
test dl, 1
movzx edx, r8b
cmovne rdx, rcx
mov qword [rsp + 0xc0], 0
lea r15, [rsp + 0xd2]
cmovne r15, rax
test rdx, rdx
cmove r15, rdx
lea rcx, [rbx + 0x18]
call fcn.140048170
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r14
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1401037fd
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x90], rax
movaps xmm6, xmmword [section..rdata]
movaps xmmword [rsp + 0x80], xmm6
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0xb0]
call fcn.1401030b0
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x78], rax
lea rcx, [rbx + 0x20]
call fcn.140048170
lea rcx, [rsp + 0x78]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x140103819
mov rdx, qword [rsp + 0x88]
movaps xmmword [rsp + 0x60], xmm6
lea rcx, [rsp + 0x60]
xor ebp, ebp
mov r8b, 1
xor r9d, r9d
call fcn.1400e2b30
movzx eax, byte [rsp + 0x68]
cmp al, 1
je 0x14010382a
test al, 1
jne 0x140103847
test bpl, bpl
je 0x14010385a
mov rcx, qword [rsp + 0x170]
lea rdx, [rsp + 0x80]
call fcn.140103250
test al, al
je 0x1401038f8
mov rcx, qword [rsp + 0x80]
call fcn.14012c6a0
mov qword [rbx + 0x40], rax
test rax, rax
je 0x14010391a
lea rax, [rbx + 0x40]
lea rcx, [0x140000000]
cmp qword [rax], rcx
je 0x14010393c
mov rcx, qword [rsp + 0x80]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x41
jmp 0x140103875
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov ebx, 0x12
test byte [rsp + 0xd0], 1
jne 0x14010388c
jmp 0x140103899
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
jmp 0x140103860
mov ebx, 0x46
jmp 0x140103899
lea rcx, [rsp + 0x60]
call fcn.1400e36c0
mov ebp, eax
xor bpl, 1
movzx eax, byte [rsp + 0x68]
test al, 1
je 0x140103792
lea rcx, [rsp + 0x60]
call fcn.140042f20
test bpl, bpl
jne 0x14010379b
mov dword [rdi], 0x542
mov rcx, qword [rsp + 0x80]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x15
lea rcx, [rsp + 0x80]
call fcn.140103190
test byte [rsp + 0xd0], 1
je 0x140103899
mov rcx, qword [rsp + 0xe0]
call fcn.140173cf0
test rsi, rsi
je 0x1401038a6
mov rcx, rsi
call fcn.140193770
mov rax, qword [rsp + 0x58]
mov rdi, qword [rax]
mov qword [rax], 0
test rdi, rdi
je 0x1401038ca
mov rcx, rdi
call fcn.140102900
mov rcx, rdi
call fcn.140173cf0
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.140174050
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xf0]
add rsp, 0x108
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rcx, qword [rsp + 0x80]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x17
jmp 0x140103875
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rcx, qword [rsp + 0x80]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x2b
jmp 0x140103875
lea rcx, [rsp + 0x80]
lea r14, [rsp + 0x60]
mov rdx, r14
call fcn.140103350
mov rcx, rbx
mov rdx, r14
call fcn.1401030e0
xor ebx, ebx
jmp 0x140103875