Function at 0x14017cd40
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
movaps xmmword [rsp + 0x130], xmm7
movaps xmmword [rsp + 0x120], xmm6
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x1402b4040]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rcx, rdx
call fcn.140190aa0
mov rdx, qword [rbx + 0x48]
mov qword [rbx + 0x48], rax
test rdx, rdx
jne 0x14017d5ff
mov rbp, qword [r15]
mov rcx, rdi
call fcn.140190aa0
xor edi, edi
cmp qword [rbp + 0xa0], 0
mov r13, rax
setne r12b
xorps xmm6, xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0xd0], 0
mov r8, qword [r15]
cmp byte [r8 + 0x21], 1
je 0x14017d09e
xor eax, eax
xor ecx, ecx
xor edx, edx
mov rsi, qword [rsp + 0x1b8]
mov dil, r12b
shl edi, 0x13
or edi, 0x40c
movzx r8d, byte [r8 + 0x20]
xor r9d, r9d
lea r10, [rsp + 0x100]
mov qword [r10 + 0x10], r9
add rbp, 0x38
test dl, dl
movzx edx, dl
cmovs rdx, rcx
movaps xmmword [r10], xmm6
lea r11, [rsp + 0xc0]
cmovs r11, rax
test rdx, rdx
cmove r11, rdx
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
mov rdx, r14
mov r8, r13
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x14017d613
xorps xmm0, xmm0
lea r14, [rsp + 0xe0]
movaps xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
lea rdx, [rsp + 0x100]
mov rcx, r14
call fcn.1400439a0
mov rax, qword [r14 + 8]
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x14017d5b3
mov rdx, qword [rsp + 0xe8]
movaps xmm0, xmmword [0x140270080]
lea r14, [rsp + 0xa0]
movaps xmmword [r14], xmm0
xor ebp, ebp
mov rcx, r14
mov r8b, 1
xor r9d, r9d
call fcn.14003d180
mov al, byte [r14 + 8]
cmp al, 1
jne 0x14017ceff
lea r14, [rsp + 0xa0]
mov rcx, r14
call fcn.14003d260
mov ebp, eax
xor bpl, 1
mov al, byte [r14 + 8]
test al, 1
je 0x14017cf10
lea rcx, [rsp + 0xa0]
call fcn.14002d380
test bpl, bpl
je 0x14017d5bd
mov r14, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0xe0]
mov rdx, r14
call fcn.1400360f0
test al, al
je 0x14017d5dd
lea rdx, [r14 + 8]
mov rcx, qword [rsp + 0xe8]
call fcn.1400360f0
test al, al
je 0x14017d5dd
mov eax, dword [rsp + 0xf0]
mov dword [r14 + 0x10], eax
mov eax, dword [rsp + 0xf4]
mov dword [r14 + 0x14], eax
mov rcx, qword [rsp + 0xe0]
call fcn.14003d460
mov qword [rbx + 0x40], rax
test rax, rax
je 0x14017d649
lea rcx, [0x140000000]
cmp rax, rcx
jne 0x14017d62f
mov rsi, qword [rsp + 0xe0]
mov qword [rsp + 0xe0], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14017cfb5
call fcn.140119350
mov qword [rsp + 0xa0], rsi
mov rsi, qword [rsp + 0xe8]
mov qword [rsp + 0xe8], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14017cfe0
call fcn.140119350
lea rdx, [rsp + 0xa0]
mov qword [rdx + 8], rsi
mov rax, qword [rsp + 0xf0]
mov qword [rdx + 0x10], rax
mov qword [rsp + 0xf0], 0
mov rcx, rbx
call fcn.1400439a0
xor ebx, ebx
lea rcx, [rsp + 0xe0]
call fcn.140036e00
cmp byte [rsp + 0xd7], 0
jns 0x14017d032
mov rcx, qword [rsp + 0xc0]
call fcn.14018fb90
test r13, r13
je 0x14017d049
lea rcx, fcn.14011fd50
mov rdx, r13
xor r8d, r8d
call fcn.14011de30
mov rdi, qword [r15]
mov qword [r15], 0
test rdi, rdi
je 0x14017d068
mov rcx, rdi
call fcn.14003d350
mov rcx, rdi
call fcn.14018fb90
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.140192360
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x120]
movaps xmm7, xmmword [rsp + 0x130]
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x14017d625
mov rsi, rax
xorps xmm7, xmm7
movaps xmmword [rsp + 0xa0], xmm7
mov qword [rsp + 0xb0], 0
movzx eax, word [rax]
test ax, ax
je 0x14017d121
mov byte [rsp + 0x67], r12b
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], r15
lea r12, [rsp + 0x100]
lea r14, [rsp + 0xe0]
mov rbp, rsi
lea rsi, str.Path
lea r15, str.Path
mov qword [rsp + 0x68], rbp
jmp 0x14017d409
xor eax, eax
jmp 0x14017d151
cmp al, 0xa
mov r15, qword [rsp + 0x88]
mov r13, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov r12b, byte [rsp + 0x67]
mov rsi, qword [rsp + 0x68]
je 0x14017d53b
movzx eax, al
mov edx, eax
inc dl
and dl, 0x7f
lea rcx, [rsp + 0xa0]
mov byte [rcx + 0x17], dl
jmp 0x14017d1d9
mov al, byte [rsp + 0xb7]
test al, al
mov r14, qword [rsp + 0x90]
jns 0x14017d125
movabs r12, 0x7fffffffffffffff
and r12, qword [rsp + 0xb0]
dec r12
mov rax, qword [rsp + 0xa8]
cmp rax, r12
mov r15, qword [rsp + 0x88]
mov r13, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
je 0x14017d541
mov rcx, qword [rsp + 0xa0]
lea rdx, [rax + 1]
mov qword [rsp + 0xa8], rdx
mov r12b, byte [rsp + 0x67]
mov dword [rcx + rax*2], 0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xc8], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov dl, byte [rsp + 0xd7]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov r8, qword [r15]
jmp 0x14017cde1
xor r9d, r9d
lea r10, str.SystemDrive
movzx r8d, word [r10]
cmp r8w, word [rdx + r9*2]
jne 0x14017d268
add r10, 2
inc r9
xor r8d, r8d
cmp rcx, r9
jne 0x14017d242
lea r9, str.SystemDrive
jmp 0x14017d3cc
cmp rcx, 0xa
jne 0x14017d39e
jmp 0x14017d526
xor r10d, r10d
lea r8, str.SystemRoot
movzx r8d, word [r10 + r8]
cmp r8w, word [rdx + r10]
jne 0x14017d39e
add r10, 2
xor r8d, r8d
dec r9
jne 0x14017d27a
lea r9, str.SystemRoot
jmp 0x14017d3cc
xor r9d, r9d
lea r8, str.Path
movzx r8d, word [r9 + r8]
cmp r8w, word [rdx + r9]
jne 0x14017d387
add r9, 2
xor r8d, r8d
cmp r9, 8
jne 0x14017d2ac
mov r9, rsi
jmp 0x14017d3cc
movzx eax, ax
test eax, eax
je 0x14017d2f2
movzx eax, word [rbx + r13*2 + 2]
inc r13
add rbp, 2
cmp ax, 0x3d
jne 0x14017d2d8
mov rcx, r12
mov rdx, rbx
mov r8, r13
call fcn.14003d080
cmp byte [rsp + 0xf7], 0
js 0x14017d58e
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xf0], rax
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xe0], xmm0
inc r13
cmp word [rbp], 0
lea rbp, [rbp + 2]
jne 0x14017d32e
movsx rax, byte [rsp + 0xf7]
test rax, rax
mov rcx, qword [rsp + 0xe8]
cmovns rcx, rax
mov rdx, qword [rsp + 0xe0]
cmovns rdx, r14
test rcx, rcx
js 0x14017d57b
setne r8b
test rdx, rdx
sete r9b
test r8b, r9b
jne 0x14017d5a0
cmp rcx, 4
je 0x14017d2a9
cmp rcx, 0xb
je 0x14017d238
mov r9, rcx
cmp rcx, 0xa
je 0x14017d277
cmp rcx, 4
je 0x14017d46e
mov r8b, 1
cmp rcx, 3
je 0x14017d444
cmp rcx, 0xc
je 0x14017d4e7
mov r9, r15
cmp rcx, 0x19
je 0x14017d4a1
sub r9, rsi
sar r9, 4
test r9, r9
jle 0x14017d572
cmp r9, 8
jae 0x14017d56f
test r8b, r8b
je 0x14017d428
test al, al
jns 0x14017d3fc
mov rcx, qword [rsp + 0xe0]
call fcn.14018fb90
movzx eax, word [rbp]
test ax, ax
je 0x14017d168
mov rbx, rbp
movaps xmmword [rsp + 0xe0], xmm7
mov qword [rsp + 0xf0], 0
xor r13d, r13d
jmp 0x14017d2ec
lea rcx, [rsp + 0xa0]
mov rdx, rbx
mov r8, r13
call fcn.14016f420
mov al, byte [rsp + 0xf7]
jmp 0x14017d3eb
xor r9d, r9d
lea r10, [0x14029af82]
movzx r11d, word [r10]
cmp r11w, word [rdx + r9*2]
jne 0x14017d3b5
add r10, 2
inc r9
cmp rcx, r9
jne 0x14017d44e
jmp 0x14017d517
xor r9d, r9d
lea r8, str.TEMP
movzx r8d, word [r9 + r8]
cmp r8w, word [rdx + r9]
jne 0x14017d3a8
add r9, 2
xor r8d, r8d
cmp r9, 8
jne 0x14017d471
lea r9, str.TEMP
jmp 0x14017d3cc
xor r9d, r9d
lea r8, str.CHROME_CRASHPAD_PIPE_NAME
movzx r8d, word [r9 + r8]
cmp r8w, word [rdx + r9]
setne r8b
jne 0x14017d4d0
add r9, 2
dec rcx
jne 0x14017d4a4
lea r9, str.CHROME_CRASHPAD_PIPE_NAME
jmp 0x14017d3cc
mov r9, r15
jmp 0x14017d3cc
mov r9, r15
cmp rcx, 0x19
jne 0x14017d3cc
jmp 0x14017d531
xor r9d, r9d
lea r10, str.LOCALAPPDATA
movzx r11d, word [r10]
cmp r11w, word [rdx + r9*2]
jne 0x14017d4d8
add r10, 2
inc r9
cmp rcx, r9
jne 0x14017d4f1
xor r8d, r8d
lea r9, str.LOCALAPPDATA
jmp 0x14017d3cc
xor r8d, r8d
lea r9, [0x14029af10]
jmp 0x14017d3cc
mov r9d, 0xa
jmp 0x14017d277
mov ecx, Ordinal_26
jmp 0x14017d4a1
mov r12d, 0xa
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], r12
lea rcx, [rsp + 0xa0]
mov r8d, 1
mov rdx, r12
mov r9, r12
call fcn.14014b710
mov rax, r12
jmp 0x14017d1c0
int3
jns 0x14017d3e6
int3
lea rcx, [0x140275393]
lea rdx, str....._third_partylibc_srcinclude_string_view:318:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
call fcn.1401cf0c0
mov rcx, qword [rsp + 0xe0]
call fcn.14018fb90
jmp 0x14017d30e
lea rcx, [0x140275393]
lea rdx, str....._third_partylibc_srcinclude_string_view:320:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
call fcn.1401cf0c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
jmp 0x14017d5c3
mov dword [rsi], 0x542
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x15
jmp 0x14017d00e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, Ordinal_26
jmp 0x14017d00e
lea rcx, fcn.14011fd50
xor r8d, r8d
call fcn.14011de30
jmp 0x14017cd9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov ebx, 0x12
jmp 0x14017d01b
mov ebx, Ordinal_73
jmp 0x14017d032
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x41
jmp 0x14017d00e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, Ordinal_46
jmp 0x14017d00e