Function at 0x14018fe60
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
movaps xmmword [rsp + 0x120], xmm6
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rcx, rdx
call fcn.1401aab80
mov rcx, qword [rbx + 0x48]
mov qword [rbx + 0x48], rax
test rcx, rcx
jne 0x140190723
mov r12, qword [r15]
mov rcx, rdi
call fcn.1401aab80
xor ebp, ebp
cmp qword [r12 + 0x98], 0
mov rdi, rax
setne r9b
xorps xmm6, xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0xd0], 0
mov r8, qword [r15]
cmp byte [r8 + 0x19], 1
je 0x14019017f
xor eax, eax
xor ecx, ecx
xor edx, edx
mov rsi, qword [rsp + 0x1a8]
mov bpl, r9b
shl ebp, 0x13
or ebp, 0x40c
movzx r8d, byte [r8 + 0x18]
xor r9d, r9d
lea r10, [rsp + 0x100]
mov qword [r10 + 0x10], r9
add r12, 0x30
test dl, dl
movzx edx, dl
cmovs rdx, rcx
movaps xmmword [r10], xmm6
lea r11, [rsp + 0xc0]
cmovs r11, rax
test rdx, rdx
cmove r11, rdx
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
mov rdx, r14
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x14019072f
xorps xmm0, xmm0
lea r14, [rsp + 0xe0]
movaps xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
lea rdx, [rsp + 0x100]
mov rcx, r14
call fcn.14002f1a0
mov rax, qword [r14 + 8]
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x1401906f9
mov rdx, qword [rsp + 0xe8]
movaps xmm0, xmmword [0x140299a90]
lea r14, [rsp + 0xa0]
movaps xmmword [r14], xmm0
xor ebp, ebp
mov rcx, r14
mov r8b, 1
xor r9d, r9d
call fcn.1400334a0
mov al, byte [r14 + 8]
cmp al, 1
jne 0x140190018
lea r14, [rsp + 0xa0]
mov rcx, r14
call fcn.140033580
mov ebp, eax
xor bpl, 1
mov al, byte [r14 + 8]
test al, 1
je 0x140190029
lea rcx, [rsp + 0xa0]
call fcn.140032a80
test bpl, bpl
je 0x140190703
mov rcx, qword [rsp + 0x1a0]
lea rdx, [rsp + 0xe0]
call fcn.1400337a0
test al, al
je 0x140190765
mov rcx, qword [rsp + 0xe0]
call fcn.140033670
mov qword [rbx + 0x40], rax
test rax, rax
je 0x140190787
lea rcx, [0x140000000]
cmp rax, rcx
jne 0x14019074b
mov rsi, qword [rsp + 0xe0]
mov qword [rsp + 0xe0], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14019009c
call fcn.140113f90
mov qword [rsp + 0xa0], rsi
mov rsi, qword [rsp + 0xe8]
mov qword [rsp + 0xe8], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1401900c7
call fcn.140113f90
lea rdx, [rsp + 0xa0]
mov qword [rdx + 8], rsi
mov rax, qword [rsp + 0xf0]
mov qword [rdx + 0x10], rax
mov qword [rsp + 0xf0], 0
mov rcx, rbx
call fcn.14002f1a0
xor ebx, ebx
lea rcx, [rsp + 0xe0]
call fcn.14002fd10
cmp byte [rsp + 0xd7], 0
jns 0x140190119
mov rcx, qword [rsp + 0xc0]
call fcn.1401a9dc4
test rdi, rdi
je 0x140190128
mov rcx, rdi
xor edx, edx
call fcn.140001b10
mov rdi, qword [r15]
mov qword [r15], 0
test rdi, rdi
je 0x140190147
mov rcx, rdi
call fcn.1400333c0
mov rcx, rdi
call fcn.1401a9dc4
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x140190161
call fcn.1401ac870
int3
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x120]
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov byte [rsp + 0x67], r9b
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x140190741
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], r15
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0x68], rax
movzx eax, word [rax]
test ax, ax
je 0x1401901f5
movabs rdi, 0x7ffffffffffffff7
lea r14, [rsp + 0x100]
mov r13, qword [rsp + 0x68]
jmp 0x14019046b
lea r12, [rsp + 0xa0]
mov rcx, r12
xor edx, edx
call fcn.140167d40
mov rax, qword [r12 + 0x10]
mov qword [rsp + 0xd0], rax
movaps xmm0, xmmword [r12]
movaps xmmword [rsp + 0xc0], xmm0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov dl, byte [rsp + 0xd7]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov r15, qword [rsp + 0x90]
mov r8, qword [r15]
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x70]
xor ebp, ebp
mov r9b, byte [rsp + 0x67]
jmp 0x14018fefa
xor r8d, r8d
lea r9, str.SystemDrive
movzx edx, word [r9]
cmp dx, word [rcx + r8*2]
jne 0x1401902a3
add r9, 2
inc r8
xor edx, edx
cmp rax, r8
jne 0x14019027e
lea r8, str.z1__
jmp 0x140190428
cmp rax, 0xa
jne 0x1401903fb
jmp 0x1401906ca
mov byte [rsp + 0x117], r15b
mov r12, r14
jmp 0x14019034c
movzx eax, ax
test eax, eax
je 0x1401902dc
movzx eax, word [r13 + r15*2 + 2]
inc r15
add rsi, 0xfffffffffffffffe
cmp ax, 0x3d
jne 0x1401902c2
test r15, r15
sete al
test r13, r13
setne cl
or cl, al
je 0x1401906df
cmp r15, rdi
ja 0x1401906e6
cmp r15, 0xa
jbe 0x1401902b2
mov rax, r15
or rax, 3
lea rbx, [rax + 1]
cmp rax, 0xb
mov eax, Ordinal_14
cmove rbx, rax
test rbx, rbx
js 0x1401906e1
lea rcx, [rbx + rbx]
call fcn.1401a9d88
mov r12, rax
mov qword [rsp + 0x100], rax
lea rax, [rdi + rbx]
add rax, 9
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x108], r15
cmp r13, r12
jb 0x140190360
mov rax, r12
sub rax, rsi
cmp r13, rax
jb 0x1401906df
test r15, r15
je 0x140190376
mov r8, rsi
neg r8
mov rcx, r12
mov rdx, r13
call fcn.1401e56b0
mov word [r12 + r15*2], 0
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xf0], rax
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xe0], xmm0
add rsi, 0xfffffffffffffffe
cmp word [r13 + r15*2], 0
lea r15, [r15 + 1]
jne 0x14019039d
movsx rbx, byte [rsp + 0xf7]
test rbx, rbx
mov rax, qword [rsp + 0xe8]
cmovns rax, rbx
mov rbp, qword [rsp + 0xe0]
lea rcx, [rsp + 0xe0]
cmovs rcx, rbp
cmp rax, 4
je 0x14019049b
cmp rax, 0xb
je 0x140190274
mov r8, rax
cmp rax, 0xa
je 0x1401904ff
cmp rax, 4
je 0x1401904cd
mov dl, 1
cmp rax, 3
je 0x140190475
cmp rax, 0xc
je 0x14019056a
lea r8, str.Path
cmp rax, 0x19
je 0x140190530
lea rax, str.p1__
sub r8, rax
cmp r8, 0x71
jge 0x1401906f3
test r8, r8
js 0x1401906f6
test dl, dl
je 0x1401905af
test bl, bl
jns 0x140190459
mov rcx, rbp
call fcn.1401a9dc4
movzx eax, word [r13 + r15*2]
sub r13, rsi
test ax, ax
je 0x1401901f5
xor esi, esi
xor r15d, r15d
jmp 0x1401902d6
xor r8d, r8d
lea r9, [0x1402c31b2]
movzx r10d, word [r9]
cmp r10w, word [rcx + r8*2]
jne 0x14019040d
add r9, 2
inc r8
cmp rax, r8
jne 0x14019047f
jmp 0x140190675
xor r8d, r8d
lea rdx, str.Path
movzx edx, word [r8 + rdx]
cmp dx, word [rcx + r8]
jne 0x1401903e4
add r8, 2
xor edx, edx
cmp r8, 8
jne 0x14019049e
lea r8, str.p1__
jmp 0x140190428
xor r8d, r8d
lea rdx, str.TEMP
movzx edx, word [r8 + rdx]
cmp dx, word [rcx + r8]
jne 0x140190405
add r8, 2
xor edx, edx
cmp r8, 8
jne 0x1401904d0
lea r8, str.TEMP
jmp 0x140190428
xor r9d, r9d
lea rdx, str.SystemRoot
movzx edx, word [r9 + rdx]
cmp dx, word [rcx + r9]
jne 0x1401903fb
add r9, 2
xor edx, edx
dec r8
jne 0x140190502
lea r8, str.SystemRoot
jmp 0x140190428
xor r8d, r8d
lea rdx, str.CHROME_CRASHPAD_PIPE_NAME
movzx edx, word [r8 + rdx]
cmp dx, word [rcx + r8]
setne dl
jne 0x14019055e
add r8, 2
dec rax
jne 0x140190533
lea r8, str.CHROME_CRASHPAD_PIPE_NAME
jmp 0x140190428
lea r8, str.Path
jmp 0x140190428
xor r8d, r8d
lea r9, str.LOCALAPPDATA
movzx r10d, word [r9]
cmp r10w, word [rcx + r8*2]
jne 0x140190599
add r9, 2
inc r8
cmp rax, r8
jne 0x140190574
xor edx, edx
lea r8, str.LOCALAPPDATA
jmp 0x140190428
lea r8, str.Path
cmp rax, 0x19
jne 0x140190428
jmp 0x1401906d5
test r13, r13
setne al
test r15, r15
sete cl
or cl, al
je 0x1401906df
movsx rax, byte [rsp + 0xb7]
mov edx, 0xa
mov r12, rax
test rax, rax
jns 0x1401905f0
lea rdx, [rdi + 8]
and rdx, qword [rsp + 0xb0]
dec rdx
mov r12, qword [rsp + 0xa8]
mov rcx, rdx
sub rcx, r12
cmp rcx, r15
jb 0x140190683
test r15, r15
je 0x14019044d
lea r14, [rsp + 0xa0]
test al, al
jns 0x14019061c
mov r14, qword [rsp + 0xa0]
test r15, r15
js 0x1401906df
lea rcx, [r14 + r12*2]
cmp r13, rcx
jb 0x14019063d
mov rax, rcx
sub rax, rsi
cmp r13, rax
jb 0x1401906df
mov r8, rsi
neg r8
mov rdx, r13
call fcn.1401e56b0
lea rax, [r12 + r15]
cmp byte [rsp + 0xb7], 0
jns 0x1401906b9
mov qword [rsp + 0xa8], rax
mov word [r14 + rax*2], 0
lea r14, [rsp + 0x100]
jmp 0x14019044d
xor edx, edx
lea r8, [0x1402c3140]
jmp 0x140190428
mov r8, r12
sub r8, rdx
add r8, r15
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0xa0]
mov r9, r12
call fcn.14014d400
jmp 0x14019044d
add r12d, r15d
and r12b, 0x7f
mov byte [rsp + 0xb7], r12b
jmp 0x140190661
mov r8d, 0xa
jmp 0x1401904ff
mov eax, Ordinal_26
jmp 0x140190530
ud2
call fcn.1401e9820
lea rcx, [rsp + 0x100]
call fcn.1401e97e0
int3
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
jmp 0x140190709
mov dword [rsi], 0x542
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x15
jmp 0x1401900f5
xor edx, edx
call fcn.140001b10
jmp 0x14018feb2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov ebx, 0x12
jmp 0x140190102
mov ebx, Ordinal_73
jmp 0x140190119
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x41
jmp 0x1401900f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, Ordinal_26
jmp 0x1401900f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, Ordinal_46
jmp 0x1401900f5