Function at 0x140015bc0
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
movaps xmmword [rsp + 0x120], xmm6
mov rsi, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x140091088]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rcx, rdx
call fcn.14005dc90
mov rcx, qword [rbx + 0x48]
mov qword [rbx + 0x48], rax
test rcx, rcx
je 0x140015c13
call fcn.14005ccf0
mov r12, qword [rsi]
mov rcx, rdi
call fcn.14005dc90
mov rdi, rax
xor r15d, r15d
xor r13d, r13d
cmp qword [r12 + 0xa0], r15
setne bpl
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xb0], r15
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0xc8], 7
mov word [rsp + 0xb0], 0
mov rcx, qword [rsi]
call fcn.140012acc
test al, al
je 0x140015d1e
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x140015ec9
mov r15, rax
lea r8, [rsp + 0xa0]
mov qword [r8], 7
lea rax, str.pz_a_
mov qword [r8 + 8], rax
lea rcx, [rsp + 0xd0]
mov rdx, r15
call fcn.14001605c
mov rax, qword [rsp + 0xc8]
cmp rax, 8
jb 0x140015cda
mov rcx, qword [rsp + 0xb0]
lea rdx, [rax + rax]
add rdx, 2
call fcn.1400500c0
movups xmm0, xmmword [rsp + 0xd0]
movups xmm1, xmmword [rsp + 0xe0]
movaps xmmword [rsp + 0xc0], xmm1
movaps xmmword [rsp + 0xb0], xmm0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
cmp qword [rsp + 0xc0], 0
sete al
cmp qword [rsp + 0xc8], 8
setae r15b
jmp 0x140015d20
mov al, 1
mov r13b, bpl
shl r13d, 0x13
or r13d, 0x40c
mov rcx, qword [rsi]
movzx edx, byte [rcx + 0x20]
xor r8d, r8d
mov qword [rsp + 0x90], r8
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
add r12, 0x38
test r15b, r15b
je 0x140015d5e
mov r9, qword [rsp + 0xb0]
jmp 0x140015d66
lea r9, [rsp + 0xb0]
mov rbp, qword [rsp + 0x1a8]
test al, al
cmovne r9, r8
mov rcx, qword [rbx + 0x18]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], r9
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r8
mov rdx, r14
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140015eb6
lea rcx, [rsp + 0x60]
movabs r13, 0xaaaaaaaaaaaaaaaa
mov qword [rcx + 0x10], r13
movaps xmm6, xmmword [0x140076960]
movaps xmmword [rcx], xmm6
lea rdx, [rsp + 0x80]
call fcn.1400137b0
mov r14, qword [rbx + 0x20]
lea rax, [r14 + 1]
cmp rax, 2
jb 0x140015f19
mov qword [rsp + 0x58], 0
mov rdx, qword [rsp + 0x60]
lea r15, [rsp + 0x100]
mov qword [r15 + 0x10], r13
movaps xmmword [r15], xmm6
mov rcx, r15
xor r8d, r8d
xor r9d, r9d
call fcn.140017900
cmp byte [r15], 0
je 0x140015ee5
lea r12, [rsp + 0xd0]
mov qword [r12 + 0x20], r13
movaps xmmword [r12 + 0x10], xmm6
movaps xmmword [r12], xmm6
lea r15, [rsp + 0x108]
mov rcx, r15
mov rdx, r12
call fcn.140018220
cmp byte [r12], 0
je 0x140015ed3
mov r13, rbp
lea r9, [rbx + 0x50]
lea r12, [rsp + 0xd8]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov rcx, r14
xor edx, edx
mov r8, r12
call fcn.140027d1f
mov ebp, eax
cmp byte [r12 - 8], 0
je 0x140015e95
mov rcx, r12
call fcn.140014970
cmp byte [rsp + 0x100], 0
je 0x140015ea7
mov rcx, r15
call fcn.140003f40
test bpl, bpl
mov rbp, r13
je 0x140015ee5
mov r14, qword [rsp + 0x58]
jmp 0x140015ee5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp], eax
mov ebx, 0x12
jmp 0x140015ff6
mov ebx, 0x46
jmp 0x140016019
cmp byte [rsp + 0x100], 0
je 0x140015ee5
mov rcx, r15
call fcn.140003f40
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0xd0]
mov qword [rcx], rax
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x140015fa3
lea rcx, [rbx + 0x20]
call fcn.140003f40
lea rcx, [rsp + 0x58]
call fcn.140003f40
mov rcx, qword [rsp + 0x1a0]
lea rdx, [rsp + 0x60]
call fcn.1400139e0
test al, al
je 0x140015f69
mov rcx, qword [rsp + 0x60]
call fcn.14002f99a
mov qword [rbx + 0x40], rax
test rax, rax
je 0x140015f86
lea rax, [rbx + 0x40]
lea rcx, [0x140000000]
cmp qword [rax], rcx
je 0x140015fca
mov rcx, qword [rsp + 0x60]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x41
jmp 0x140015fec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp], eax
mov rcx, qword [rsp + 0x60]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x17
jmp 0x140015fec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp], eax
mov rcx, qword [rsp + 0x60]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x2b
jmp 0x140015fec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp], eax
mov rcx, qword [rsp + 0x60]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rcx, [rsp + 0x58]
call fcn.140003f40
mov ebx, 0x15
jmp 0x140015fec
lea rcx, [rsp + 0x60]
lea r14, [rsp + 0xd0]
mov rdx, r14
call fcn.140013b20
mov rcx, rbx
mov rdx, r14
call fcn.1400137e0
xor ebx, ebx
lea rcx, [rsp + 0x60]
call fcn.140013920
mov rax, qword [rsp + 0xc8]
cmp rax, 8
jb 0x140016019
mov rcx, qword [rsp + 0xb0]
lea rdx, [rax + rax]
add rdx, 2
call fcn.1400500c0
test rdi, rdi
je 0x140016026
mov rcx, rdi
call fcn.14005ccf0
mov rcx, rsi
call fcn.14000307a
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.140052880
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x120]
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret