Function at 0x140009b70
Capabilities:
Create process on windows
Resume thread
Set environment variable
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x140055008]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rax, qword [0x140055248]
lea rcx, [0x140055248]
xor edi, edi
mov r12, r9
mov r14, r8
mov rbx, rdx
mov esi, edi
mov rax, qword [rax + 0x18]
call qword [0x1400185c0]
mov rdx, rbx
lea rcx, [rsp + 0x50]
add rax, 0x18
mov qword [rsp + 0x50], rax
call fcn.140006910
lea r15, [rdi - 1]
test al, al
jne 0x140009c09
test rbx, rbx
jne 0x140009bec
mov eax, edi
jmp 0x140009bf9
mov rax, r15
nop
inc rax
cmp word [rbx + rax*2], si
jne 0x140009bf0
mov r8d, eax
lea rcx, [rsp + 0x50]
mov rdx, rbx
call fcn.140007e80
mov rax, qword [0x140055248]
lea rcx, [0x140055248]
mov rax, qword [rax + 0x18]
call qword [0x1400185c0]
xorps xmm1, xmm1
mov dword [rbp - 0x50], 0x68
add rax, 0x18
xorps xmm0, xmm0
mov qword [rsp + 0x58], rax
xor eax, eax
cmp dword [0x140055944], eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
lea r13d, [rax + 7]
mov dword [rbp + 0x14], eax
movups xmmword [rbp - 0x4c], xmm1
movups xmmword [rbp - 0x3c], xmm1
movups xmmword [rbp - 0x2c], xmm1
movups xmmword [rbp - 0x1c], xmm1
movups xmmword [rbp - 0xc], xmm1
movups xmmword [rbp + 4], xmm1
je 0x140009c81
mov r9, rbx
movzx edx, r13w
lea r8, str._Calling_command_line__S_n
mov ecx, 0xfffffff4
call fcn.1400085c0
mov r8d, dword [reloc.OLEAUT32.dll_SysReAllocString]
lea rdx, [0x14004f080]
lea rcx, [rsp + 0x58]
call fcn.14000b090
mov rbx, qword [rsp + 0x58]
lea rcx, str.MFTRACE_FLAGS
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140009d84
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test eax, eax
jle 0x140009ccb
movzx esi, ax
or esi, 0x80070000
mov edx, 0x114f
mov r10d, esi
mov r11, rdi
lea r9, [0x14003c070]
nop dword [rax]
mov eax, edi
mov r8, r10
add rax, rax
mov ecx, edi
mov eax, dword [r9 + rax*8]
sub r8, rax
je 0x140009d10
mov ecx, edx
sub ecx, edi
shr ecx, 1
add ecx, edi
test r8, r8
mov eax, ecx
cmovns eax, edx
cmovns edi, ecx
inc edi
mov edx, eax
cmp eax, edi
jae 0x140009ce0
jmp 0x140009d18
add rcx, rcx
mov r11, qword [r9 + rcx*8 + 8]
cmp dword [0x140055944], 0
je 0x14000a03e
lea rax, str.SetEnvironmentVariableW__L_MFTRACE_FLAGS___strFlags__
movzx edx, r13w
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
mov r9d, esi
mov qword [rsp + 0x20], r11
mov ecx, 0xfffffff4
call fcn.1400085c0
cmp dword [0x140055944], 0
je 0x14000a03e
mov dword [rsp + 0x20], 0x146
lea r9, str.avcoremf_samplesmf360mftracemftracelibmftracedprocess.cpp
movzx edx, r13w
lea r8, str.___at__s:_i_n
mov ecx, 0xfffffff4
call fcn.1400085c0
jmp 0x14000a03e
mov rdx, r14
lea rcx, str.MFTRACE_DLL_DETOURS
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140009e58
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test eax, eax
jle 0x140009db1
movzx esi, ax
or esi, 0x80070000
mov edx, 0x114f
mov r10d, esi
mov r11, rdi
lea r9, [0x14003c070]
nop dword [rax]
nop word [rax + rax]
mov eax, edi
mov r8, r10
add rax, rax
mov ecx, edi
mov eax, dword [r9 + rax*8]
sub r8, rax
je 0x140009e00
mov ecx, edx
sub ecx, edi
shr ecx, 1
add ecx, edi
test r8, r8
mov eax, ecx
cmovns eax, edx
cmovns edi, ecx
inc edi
mov edx, eax
cmp eax, edi
jae 0x140009dd0
jmp 0x140009e08
add rcx, rcx
mov r11, qword [r9 + rcx*8 + 8]
cmp dword [0x140055944], 0
je 0x14000a03e
lea rax, str.SetEnvironmentVariableW__L_MFTRACE_DLL_DETOURS___pszDetoursDllFullPath__
movzx edx, r13w
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
mov r9d, esi
mov qword [rsp + 0x20], r11
mov ecx, 0xfffffff4
call fcn.1400085c0
cmp dword [0x140055944], 0
je 0x14000a03e
mov dword [rsp + 0x20], 0x149
jmp 0x140009d63
mov rdx, r14
lea rcx, [rbp + 0x20]
call fcn.1400089dc
mov rdx, qword [rsp + 0x50]
mov r14, qword [rax]
cmp dword [rdx - 8], 1
jle 0x140009e84
mov edx, dword [rdx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140007cf0
mov rdx, qword [rsp + 0x50]
lea rax, [rbp - 0x78]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp - 0x50]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x4000004
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
movsd xmm1, qword [rbp - 0x68]
movsd qword [rbp - 0x80], xmm1
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rsp + 0x70], xmm0
test eax, eax
jne 0x140009ed6
mov r14b, 1
jmp 0x140009f1e
mov rax, qword [rbp - 0x60]
lea rdx, [rbp - 0x60]
mov rcx, qword [rbp - 0x78]
test r14, r14
mov r8d, edi
cmovne rax, r14
setne r8b
mov qword [rbp - 0x60], rax
call fcn.140015c68
test eax, eax
jne 0x140009f11
mov rcx, qword [rbp - 0x78]
mov edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
mov r14b, 1
jmp 0x140009f1e
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
xor r14b, r14b
mov rcx, qword [rbp + 0x20]
lea rax, [rbp + 0x28]
cmp rcx, rax
je 0x140009f31
call qword [sym.imp.msvcrt.dll_free]
test r14b, r14b
je 0x140009faf
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test eax, eax
jle 0x140009f4b
movzx esi, ax
or esi, 0x80070000
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], rdi
mov ecx, esi
call fcn.140008520
cmp dword [0x140055944], edi
je 0x14000a03e
lea rax, str.DetourCreateProcessWithDllW__0__strCmdLineLocal.GetBuffer____0__0___0__0x04000000__0__0__si__pi__CW2A__pszDetoursDllFullPath____0__
movzx edx, r13w
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
mov rax, qword [rsp + 0x60]
mov r9d, esi
mov ecx, 0xfffffff4
mov qword [rsp + 0x20], rax
call fcn.1400085c0
cmp dword [0x140055944], edi
je 0x14000a03e
mov dword [rsp + 0x20], 0x158
jmp 0x140009d63
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x14000a030
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test eax, eax
jle 0x140009fd4
movzx esi, ax
or esi, 0x80070000
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x68], rdi
mov ecx, esi
call fcn.140008520
cmp dword [0x140055944], edi
je 0x14000a03e
lea rax, str.dwRet____DWORD__1
movzx edx, r13w
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
mov rax, qword [rsp + 0x68]
mov r9d, esi
mov ecx, 0xfffffff4
mov qword [rsp + 0x20], rax
call fcn.1400085c0
cmp dword [0x140055944], edi
je 0x14000a03e
mov dword [rsp + 0x20], 0x15b
jmp 0x140009d63
mov rax, qword [rsp + 0x70]
mov qword [r12], rax
mov qword [rsp + 0x70], rdi
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000a04e
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000a05e
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000a07f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400185c0]
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x14000a0a4
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [0x1400185c0]
mov eax, esi
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.140016790
mov rbx, qword [rsp + 0x200]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret