Function at 0x140124e20
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
movaps xmmword [rsp + 0x130], xmm7
movaps xmmword [rsp + 0x120], xmm6
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x14022c040]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rcx, rdx
call fcn.140134bb0
mov rcx, qword [rbx + 0x48]
mov qword [rbx + 0x48], rax
test rcx, rcx
jne 0x140125718
mov r12, qword [r15]
mov rcx, rdi
call fcn.140134bb0
xor ebp, ebp
cmp qword [r12 + 0x98], 0
mov rdi, rax
setne r9b
xorps xmm6, xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0xd0], 0
mov r8, qword [r15]
cmp byte [r8 + 0x19], 1
je 0x14012514f
xor eax, eax
xor ecx, ecx
xor edx, edx
mov rsi, qword [rsp + 0x1b8]
mov bpl, r9b
shl ebp, 0x13
or ebp, 0x40c
movzx r8d, byte [r8 + 0x18]
xor r9d, r9d
lea r10, [rsp + 0x100]
mov qword [r10 + 0x10], r9
add r12, 0x30
test dl, dl
movzx edx, dl
cmovs rdx, rcx
movaps xmmword [r10], xmm6
lea r11, [rsp + 0xc0]
cmovs r11, rax
test rdx, rdx
cmove r11, rdx
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
mov rdx, r14
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140125724
xorps xmm0, xmm0
lea r14, [rsp + 0xe0]
movaps xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
lea rdx, [rsp + 0x100]
mov rcx, r14
call fcn.14003aad0
mov rax, qword [r14 + 8]
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x1401256ee
mov rdx, qword [rsp + 0xe8]
movaps xmm0, xmmword [0x1401fa990]
lea r14, [rsp + 0xa0]
movaps xmmword [r14], xmm0
xor ebp, ebp
mov rcx, r14
mov r8b, 1
xor r9d, r9d
call fcn.14004d8b0
mov al, byte [r14 + 8]
cmp al, 1
jne 0x140124fe0
lea r14, [rsp + 0xa0]
mov rcx, r14
call fcn.14004d990
mov ebp, eax
xor bpl, 1
mov al, byte [r14 + 8]
test al, 1
je 0x140124ff1
lea rcx, [rsp + 0xa0]
call fcn.14004ce90
test bpl, bpl
je 0x1401256f8
mov rcx, qword [rsp + 0x1b0]
lea rdx, [rsp + 0xe0]
call fcn.14004dbb0
test al, al
je 0x14012575a
mov rcx, qword [rsp + 0xe0]
call fcn.14004da80
mov qword [rbx + 0x40], rax
test rax, rax
je 0x14012577c
lea rcx, [0x140000000]
cmp rax, rcx
jne 0x140125740
mov rsi, qword [rsp + 0xe0]
mov qword [rsp + 0xe0], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140125064
call fcn.1400a7ad0
mov qword [rsp + 0xa0], rsi
mov rsi, qword [rsp + 0xe8]
mov qword [rsp + 0xe8], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14012508f
call fcn.1400a7ad0
lea rdx, [rsp + 0xa0]
mov qword [rdx + 8], rsi
mov rax, qword [rsp + 0xf0]
mov qword [rdx + 0x10], rax
mov qword [rsp + 0xf0], 0
mov rcx, rbx
call fcn.14003aad0
xor ebx, ebx
lea rcx, [rsp + 0xe0]
call fcn.14004a0e0
cmp byte [rsp + 0xd7], 0
jns 0x1401250e1
mov rcx, qword [rsp + 0xc0]
call fcn.140133b2c
test rdi, rdi
je 0x1401250f0
mov rcx, rdi
xor edx, edx
call fcn.1400021e0
mov rdi, qword [r15]
mov qword [r15], 0
test rdi, rdi
je 0x14012510f
mov rcx, rdi
call fcn.14004d7d0
mov rcx, rdi
call fcn.140133b2c
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
cmp rcx, qword [0x14022c040]
je 0x140125129
call fcn.1401363f0
int3
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x120]
movaps xmm7, xmmword [rsp + 0x130]
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov byte [rsp + 0x67], r9b
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x140125736
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], r15
xorps xmm7, xmm7
movaps xmmword [rsp + 0xa0], xmm7
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0x68], rax
movzx eax, word [rax]
test ax, ax
je 0x1401251cb
movabs r12, 0x7ffffffffffffff7
lea r15, str.Path
lea rbx, str.Path
mov r13, qword [rsp + 0x68]
jmp 0x140125460
lea r12, [rsp + 0xa0]
mov rcx, r12
xor edx, edx
call fcn.140102820
mov rax, qword [r12 + 0x10]
mov qword [rsp + 0xd0], rax
movaps xmm0, xmmword [r12]
movaps xmmword [rsp + 0xc0], xmm0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov dl, byte [rsp + 0xd7]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov r15, qword [rsp + 0x90]
mov r8, qword [r15]
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x70]
xor ebp, ebp
mov r9b, byte [rsp + 0x67]
jmp 0x140124ec2
xor r8d, r8d
lea r9, str.SystemDrive
movzx edx, word [r9]
cmp dx, word [rcx + r8*2]
jne 0x140125279
add r9, 2
inc r8
xor edx, edx
cmp rax, r8
jne 0x140125254
lea r8, str.SystemDrive
jmp 0x140125419
cmp rax, 0xa
jne 0x1401253f0
jmp 0x1401256bf
mov byte [rsp + 0x117], r14b
lea rbp, [rsp + 0x100]
jmp 0x140125327
movzx eax, ax
test eax, eax
je 0x1401252b7
movzx eax, word [r13 + r14*2 + 2]
inc r14
add rdi, 0xfffffffffffffffe
cmp ax, 0x3d
jne 0x14012529d
test r14, r14
sete al
test r13, r13
setne cl
or cl, al
je 0x1401256d4
cmp r14, r12
ja 0x1401256db
cmp r14, 0xa
jbe 0x140125288
mov rax, r14
or rax, 3
lea rsi, [rax + 1]
cmp rax, 0xb
mov eax, 0xd
cmove rsi, rax
test rsi, rsi
js 0x1401256d6
lea rcx, [rsi + rsi]
call fcn.140133b54
mov rbp, rax
mov qword [rsp + 0x100], rax
lea rax, [r12 + rsi]
add rax, 9
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x108], r14
cmp rbp, r13
ja 0x14012533b
mov rax, rbp
sub rax, rdi
cmp rax, r13
ja 0x1401256d4
test r14, r14
je 0x140125351
mov r8, rdi
neg r8
mov rcx, rbp
mov rdx, r13
call fcn.14016a030
mov word [rbp + r14*2], 0
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xf0], rax
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xe0], xmm0
add rdi, 0xfffffffffffffffe
cmp word [r13 + r14*2], 0
lea r14, [r14 + 1]
jne 0x140125379
movsx rax, byte [rsp + 0xf7]
test rax, rax
cmovs rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xe0]
lea rdx, [rsp + 0xe0]
cmovns rcx, rdx
test rax, rax
js 0x1401256d4
setne dl
test rcx, rcx
sete r8b
test dl, r8b
jne 0x1401256d4
cmp rax, 4
je 0x1401254a8
cmp rax, 0xb
je 0x14012524a
mov r8, rax
cmp rax, 0xa
je 0x140125508
cmp rax, 4
je 0x1401254d6
mov dl, 1
cmp rax, 3
je 0x14012547e
cmp rax, 0xc
je 0x14012556f
mov r8, rbx
cmp rax, 0x19
je 0x140125539
sub r8, r15
cmp r8, 0x71
jge 0x1401256e8
test r8, r8
js 0x1401256eb
test dl, dl
je 0x1401255b0
cmp byte [rsp + 0xf7], 0
jns 0x14012544e
mov rcx, qword [rsp + 0xe0]
call fcn.140133b2c
movzx eax, word [r13 + r14*2]
sub r13, rdi
test ax, ax
je 0x1401251cb
movaps xmmword [rsp + 0xe0], xmm7
mov qword [rsp + 0xf0], 0
xor edi, edi
xor r14d, r14d
jmp 0x1401252b1
xor r8d, r8d
lea r9, [0x140217822]
movzx r10d, word [r9]
cmp r10w, word [rcx + r8*2]
jne 0x140125402
add r9, 2
inc r8
cmp rax, r8
jne 0x140125488
jmp 0x14012566a
xor r8d, r8d
lea rdx, str.Path
movzx edx, word [r8 + rdx]
cmp dx, word [rcx + r8]
jne 0x1401253d9
add r8, 2
xor edx, edx
cmp r8, 8
jne 0x1401254ab
mov r8, r15
jmp 0x140125419
xor r8d, r8d
lea rdx, str.TEMP
movzx edx, word [r8 + rdx]
cmp dx, word [rcx + r8]
jne 0x1401253fa
add r8, 2
xor edx, edx
cmp r8, 8
jne 0x1401254d9
lea r8, str.TEMP
jmp 0x140125419
xor r9d, r9d
lea rdx, str.SystemRoot
movzx edx, word [r9 + rdx]
cmp dx, word [rcx + r9]
jne 0x1401253f0
add r9, 2
xor edx, edx
dec r8
jne 0x14012550b
lea r8, str.SystemRoot
jmp 0x140125419
xor r8d, r8d
lea rdx, str.CHROME_CRASHPAD_PIPE_NAME
movzx edx, word [r8 + rdx]
cmp dx, word [rcx + r8]
setne dl
jne 0x140125567
add r8, 2
dec rax
jne 0x14012553c
lea r8, str.x__
jmp 0x140125419
mov r8, rbx
jmp 0x140125419
xor r8d, r8d
lea r9, str.LOCALAPPDATA
movzx r10d, word [r9]
cmp r10w, word [rcx + r8*2]
jne 0x14012559e
add r9, 2
inc r8
cmp rax, r8
jne 0x140125579
xor edx, edx
lea r8, str.LOCALAPPDATA
jmp 0x140125419
mov r8, rbx
cmp rax, 0x19
jne 0x140125419
jmp 0x1401256ca
test r13, r13
setne al
test r14, r14
sete cl
or cl, al
je 0x1401256d4
movsx rax, byte [rsp + 0xb7]
mov edx, 0xa
mov rbp, rax
test rax, rax
jns 0x1401255f2
lea rdx, [r12 + 8]
and rdx, qword [rsp + 0xb0]
dec rdx
mov rbp, qword [rsp + 0xa8]
mov rcx, rdx
sub rcx, rbp
cmp rcx, r14
jb 0x140125678
test r14, r14
je 0x140125437
lea rsi, [rsp + 0xa0]
test al, al
jns 0x14012561a
mov rsi, qword [rsp + 0xa0]
test r14, r14
js 0x1401256d4
lea rcx, [rsi + rbp*2]
cmp rcx, r13
ja 0x14012563b
mov rax, rcx
sub rax, rdi
cmp rax, r13
ja 0x1401256d4
mov r8, rdi
neg r8
mov rdx, r13
call fcn.14016a030
lea rax, [r14 + rbp]
cmp byte [rsp + 0xb7], 0
jns 0x1401256ae
mov qword [rsp + 0xa8], rax
mov word [rsi + rax*2], 0
jmp 0x140125437
xor edx, edx
lea r8, str._x__
jmp 0x140125419
mov r8, rbp
sub r8, rdx
add r8, r14
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0xa0]
mov r9, rbp
call fcn.140009fe0
jmp 0x140125437
add ebp, r14d
and bpl, 0x7f
mov byte [rsp + 0xb7], bpl
jmp 0x14012565f
mov r8d, 0xa
jmp 0x140125508
mov eax, 0x19
jmp 0x140125539
ud2
call fcn.14016eb90
lea rcx, [rsp + 0x100]
call fcn.14016eb50
int3
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
jmp 0x1401256fe
mov dword [rsi], 0x542
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x15
jmp 0x1401250bd
xor edx, edx
call fcn.1400021e0
jmp 0x140124e7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov ebx, 0x12
jmp 0x1401250ca
mov ebx, 0x46
jmp 0x1401250e1
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x41
jmp 0x1401250bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x17
jmp 0x1401250bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x2b
jmp 0x1401250bd