Function at 0x140181740
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
movaps xmmword [rsp + 0x120], xmm6
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rcx, rdx
call fcn.14019b870
mov rcx, qword [rbx + 0x48]
mov qword [rbx + 0x48], rax
test rcx, rcx
jne 0x140182003
mov r12, qword [r15]
mov rcx, rdi
call fcn.14019b870
xor ebp, ebp
cmp qword [r12 + 0x98], 0
mov rdi, rax
setne r9b
xorps xmm6, xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0xd0], 0
mov r8, qword [r15]
cmp byte [r8 + 0x19], 1
je 0x140181a5f
xor eax, eax
xor ecx, ecx
xor edx, edx
mov rsi, qword [rsp + 0x1a8]
mov bpl, r9b
shl ebp, 0x13
or ebp, 0x40c
movzx r8d, byte [r8 + 0x18]
xor r9d, r9d
lea r10, [rsp + 0x100]
mov qword [r10 + 0x10], r9
add r12, 0x30
test dl, dl
movzx edx, dl
cmovs rdx, rcx
movaps xmmword [r10], xmm6
lea r11, [rsp + 0xc0]
cmovs r11, rax
test rdx, rdx
cmove r11, rdx
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
mov rdx, r14
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x14018200f
xorps xmm0, xmm0
lea r14, [rsp + 0xe0]
movaps xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
lea rdx, [rsp + 0x100]
mov rcx, r14
call fcn.14002f270
mov rax, qword [r14 + 8]
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x140181fd9
mov rdx, qword [rsp + 0xe8]
movaps xmm0, xmmword [0x140272a70]
lea r14, [rsp + 0xa0]
movaps xmmword [r14], xmm0
xor ebp, ebp
mov rcx, r14
mov r8b, 1
xor r9d, r9d
call fcn.140033570
mov al, byte [r14 + 8]
cmp al, 1
jne 0x1401818f8
lea r14, [rsp + 0xa0]
mov rcx, r14
call fcn.140033650
mov ebp, eax
xor bpl, 1
mov al, byte [r14 + 8]
test al, 1
je 0x140181909
lea rcx, [rsp + 0xa0]
call fcn.140032b50
test bpl, bpl
je 0x140181fe3
mov rcx, qword [rsp + 0x1a0]
lea rdx, [rsp + 0xe0]
call fcn.140033870
test al, al
je 0x140182045
mov rcx, qword [rsp + 0xe0]
call fcn.140033740
mov qword [rbx + 0x40], rax
test rax, rax
je 0x140182067
lea rcx, [0x140000000]
cmp rax, rcx
jne 0x14018202b
mov rsi, qword [rsp + 0xe0]
mov qword [rsp + 0xe0], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14018197c
call fcn.1401054e0
mov qword [rsp + 0xa0], rsi
mov rsi, qword [rsp + 0xe8]
mov qword [rsp + 0xe8], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1401819a7
call fcn.1401054e0
lea rdx, [rsp + 0xa0]
mov qword [rdx + 8], rsi
mov rax, qword [rsp + 0xf0]
mov qword [rdx + 0x10], rax
mov qword [rsp + 0xf0], 0
mov rcx, rbx
call fcn.14002f270
xor ebx, ebx
lea rcx, [rsp + 0xe0]
call fcn.14002fde0
cmp byte [rsp + 0xd7], 0
jns 0x1401819f9
mov rcx, qword [rsp + 0xc0]
call fcn.14019aab4
test rdi, rdi
je 0x140181a08
mov rcx, rdi
xor edx, edx
call fcn.140001b10
mov rdi, qword [r15]
mov qword [r15], 0
test rdi, rdi
je 0x140181a27
mov rcx, rdi
call fcn.140033490
mov rcx, rdi
call fcn.14019aab4
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
cmp rcx, qword [0x1402b3040]
je 0x140181a41
call fcn.14019d280
int3
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x120]
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov byte [rsp + 0x67], r9b
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x140182021
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], r15
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0x68], rax
movzx eax, word [rax]
test ax, ax
je 0x140181ad5
movabs rdi, 0x7ffffffffffffff7
lea r14, [rsp + 0x100]
mov r13, qword [rsp + 0x68]
jmp 0x140181d4b
lea r12, [rsp + 0xa0]
mov rcx, r12
xor edx, edx
call fcn.140159290
mov rax, qword [r12 + 0x10]
mov qword [rsp + 0xd0], rax
movaps xmm0, xmmword [r12]
movaps xmmword [rsp + 0xc0], xmm0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov dl, byte [rsp + 0xd7]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov r15, qword [rsp + 0x90]
mov r8, qword [r15]
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x70]
xor ebp, ebp
mov r9b, byte [rsp + 0x67]
jmp 0x1401817da
xor r8d, r8d
lea r9, str.SystemDrive
movzx edx, word [r9]
cmp dx, word [rcx + r8*2]
jne 0x140181b83
add r9, 2
inc r8
xor edx, edx
cmp rax, r8
jne 0x140181b5e
lea r8, str.SystemDrive
jmp 0x140181d08
cmp rax, 0xa
jne 0x140181cdb
jmp 0x140181faa
mov byte [rsp + 0x117], r15b
mov r12, r14
jmp 0x140181c2c
movzx eax, ax
test eax, eax
je 0x140181bbc
movzx eax, word [r13 + r15*2 + 2]
inc r15
add rsi, 0xfffffffffffffffe
cmp ax, 0x3d
jne 0x140181ba2
test r15, r15
sete al
test r13, r13
setne cl
or cl, al
je 0x140181fbf
cmp r15, rdi
ja 0x140181fc6
cmp r15, 0xa
jbe 0x140181b92
mov rax, r15
or rax, 3
lea rbx, [rax + 1]
cmp rax, 0xb
mov eax, Ordinal_14
cmove rbx, rax
test rbx, rbx
js 0x140181fc1
lea rcx, [rbx + rbx]
call fcn.14019aa78
mov r12, rax
mov qword [rsp + 0x100], rax
lea rax, [rdi + rbx]
add rax, 9
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x108], r15
cmp r13, r12
jb 0x140181c40
mov rax, r12
sub rax, rsi
cmp r13, rax
jb 0x140181fbf
test r15, r15
je 0x140181c56
mov r8, rsi
neg r8
mov rcx, r12
mov rdx, r13
call fcn.1401d6070
mov word [r12 + r15*2], 0
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xf0], rax
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xe0], xmm0
add rsi, 0xfffffffffffffffe
cmp word [r13 + r15*2], 0
lea r15, [r15 + 1]
jne 0x140181c7d
movsx rbx, byte [rsp + 0xf7]
test rbx, rbx
mov rax, qword [rsp + 0xe8]
cmovns rax, rbx
mov rbp, qword [rsp + 0xe0]
lea rcx, [rsp + 0xe0]
cmovs rcx, rbp
cmp rax, 4
je 0x140181d7b
cmp rax, 0xb
je 0x140181b54
mov r8, rax
cmp rax, 0xa
je 0x140181ddf
cmp rax, 4
je 0x140181dad
mov dl, 1
cmp rax, 3
je 0x140181d55
cmp rax, 0xc
je 0x140181e4a
lea r8, str.Path
cmp rax, 0x19
je 0x140181e10
lea rax, str.Path
sub r8, rax
cmp r8, 0x71
jge 0x140181fd3
test r8, r8
js 0x140181fd6
test dl, dl
je 0x140181e8f
test bl, bl
jns 0x140181d39
mov rcx, rbp
call fcn.14019aab4
movzx eax, word [r13 + r15*2]
sub r13, rsi
test ax, ax
je 0x140181ad5
xor esi, esi
xor r15d, r15d
jmp 0x140181bb6
xor r8d, r8d
lea r9, [0x14029c062]
movzx r10d, word [r9]
cmp r10w, word [rcx + r8*2]
jne 0x140181ced
add r9, 2
inc r8
cmp rax, r8
jne 0x140181d5f
jmp 0x140181f55
xor r8d, r8d
lea rdx, str.Path
movzx edx, word [r8 + rdx]
cmp dx, word [rcx + r8]
jne 0x140181cc4
add r8, 2
xor edx, edx
cmp r8, 8
jne 0x140181d7e
lea r8, str.Path
jmp 0x140181d08
xor r8d, r8d
lea rdx, str.TEMP
movzx edx, word [r8 + rdx]
cmp dx, word [rcx + r8]
jne 0x140181ce5
add r8, 2
xor edx, edx
cmp r8, 8
jne 0x140181db0
lea r8, str.TEMP
jmp 0x140181d08
xor r9d, r9d
lea rdx, str.SystemRoot
movzx edx, word [r9 + rdx]
cmp dx, word [rcx + r9]
jne 0x140181cdb
add r9, 2
xor edx, edx
dec r8
jne 0x140181de2
lea r8, str.SystemRoot
jmp 0x140181d08
xor r8d, r8d
lea rdx, str.CHROME_CRASHPAD_PIPE_NAME
movzx edx, word [r8 + rdx]
cmp dx, word [rcx + r8]
setne dl
jne 0x140181e3e
add r8, 2
dec rax
jne 0x140181e13
lea r8, str.CHROME_CRASHPAD_PIPE_NAME
jmp 0x140181d08
lea r8, str.Path
jmp 0x140181d08
xor r8d, r8d
lea r9, str.LOCALAPPDATA
movzx r10d, word [r9]
cmp r10w, word [rcx + r8*2]
jne 0x140181e79
add r9, 2
inc r8
cmp rax, r8
jne 0x140181e54
xor edx, edx
lea r8, str.LOCALAPPDATA
jmp 0x140181d08
lea r8, str.Path
cmp rax, 0x19
jne 0x140181d08
jmp 0x140181fb5
test r13, r13
setne al
test r15, r15
sete cl
or cl, al
je 0x140181fbf
movsx rax, byte [rsp + 0xb7]
mov edx, 0xa
mov r12, rax
test rax, rax
jns 0x140181ed0
lea rdx, [rdi + 8]
and rdx, qword [rsp + 0xb0]
dec rdx
mov r12, qword [rsp + 0xa8]
mov rcx, rdx
sub rcx, r12
cmp rcx, r15
jb 0x140181f63
test r15, r15
je 0x140181d2d
lea r14, [rsp + 0xa0]
test al, al
jns 0x140181efc
mov r14, qword [rsp + 0xa0]
test r15, r15
js 0x140181fbf
lea rcx, [r14 + r12*2]
cmp r13, rcx
jb 0x140181f1d
mov rax, rcx
sub rax, rsi
cmp r13, rax
jb 0x140181fbf
mov r8, rsi
neg r8
mov rdx, r13
call fcn.1401d6070
lea rax, [r12 + r15]
cmp byte [rsp + 0xb7], 0
jns 0x140181f99
mov qword [rsp + 0xa8], rax
mov word [r14 + rax*2], 0
lea r14, [rsp + 0x100]
jmp 0x140181d2d
xor edx, edx
lea r8, [0x14029bff0]
jmp 0x140181d08
mov r8, r12
sub r8, rdx
add r8, r15
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0xa0]
mov r9, r12
call fcn.14013e950
jmp 0x140181d2d
add r12d, r15d
and r12b, 0x7f
mov byte [rsp + 0xb7], r12b
jmp 0x140181f41
mov r8d, 0xa
jmp 0x140181ddf
mov eax, Ordinal_26
jmp 0x140181e10
ud2
call fcn.1401da2d0
lea rcx, [rsp + 0x100]
call fcn.1401da290
int3
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
jmp 0x140181fe9
mov dword [rsi], 0x542
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x15
jmp 0x1401819d5
xor edx, edx
call fcn.140001b10
jmp 0x140181792
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov ebx, 0x12
jmp 0x1401819e2
mov ebx, Ordinal_73
jmp 0x1401819f9
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x41
jmp 0x1401819d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, Ordinal_26
jmp 0x1401819d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, Ordinal_46
jmp 0x1401819d5