Function at 0x14009c670
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
movaps xmmword [rsp + 0x130], xmm7
movaps xmmword [rsp + 0x120], xmm6
mov r13, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x14013a028]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rcx, rdx
call fcn.1400a61d8
mov rdx, qword [rbx + 0x48]
mov qword [rbx + 0x48], rax
test rdx, rdx
jne 0x14009cec3
mov r15, qword [r13]
mov rcx, rdi
call fcn.1400a61d8
xor ebp, ebp
cmp qword [r15 + 0xa0], 0
mov rdi, rax
setne r9b
xorps xmm6, xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0xd0], 0
mov r8, qword [r13]
cmp byte [r8 + 0x21], 0
jne 0x14009c9f3
xor eax, eax
xor ecx, ecx
xor edx, edx
mov rsi, qword [rsp + 0x1b8]
mov bpl, r9b
shl ebp, 0x13
or ebp, 0x40c
movzx r8d, byte [r8 + 0x20]
xor r9d, r9d
lea r10, [rsp + 0x100]
mov qword [r10 + 0x10], r9
add r15, 0x38
test dl, dl
movzx edx, dl
cmovs rdx, rcx
movaps xmmword [r10], xmm6
lea r11, [rsp + 0xc0]
cmovs r11, rax
test rdx, rdx
cmove r11, rdx
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
mov rdx, r14
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x14009ced7
lea r14, [rsp + 0xe8]
xorps xmm0, xmm0
movaps xmmword [r14 - 8], xmm0
mov qword [r14 + 8], 0
mov rdx, qword [rsp + 0x100]
lea r15, [rsp + 0xe0]
mov rcx, r15
call fcn.14000c380
mov rdx, qword [rsp + 0x108]
mov rcx, r14
call fcn.14000c380
mov rax, qword [rsp + 0x110]
mov qword [r15 + 0x10], rax
mov rax, qword [r15 + 8]
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x14009ce77
mov rdx, qword [rsp + 0xe8]
movaps xmm0, xmmword [0x140119af0]
lea r14, [rsp + 0xa0]
movaps xmmword [r14], xmm0
mov rcx, r14
mov r8b, 1
xor r9d, r9d
call fcn.14001fc20
cmp byte [r14 + 8], 0
je 0x14009ce81
lea r14, [rsp + 0xa0]
mov rcx, r14
call fcn.14001fce0
mov ebp, eax
cmp byte [r14 + 8], 0
je 0x14009c863
lea rcx, [rsp + 0xa0]
call fcn.140006110
test bpl, bpl
jne 0x14009ce81
mov r14, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0xe0]
mov rdx, r14
call fcn.140018be0
test al, al
je 0x14009cea1
lea rdx, [r14 + 8]
mov rcx, qword [rsp + 0xe8]
call fcn.140018be0
test al, al
je 0x14009cea1
mov eax, dword [rsp + 0xf0]
mov dword [r14 + 0x10], eax
mov eax, dword [rsp + 0xf4]
mov dword [r14 + 0x14], eax
mov rcx, qword [rsp + 0xe0]
call fcn.14001fed0
mov qword [rbx + 0x40], rax
test rax, rax
je 0x14009cf0d
lea rcx, [0x140000000]
cmp rax, rcx
jne 0x14009cee9
mov rsi, qword [rsp + 0xe0]
mov qword [rsp + 0xe0], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14009c908
call fcn.14007a8b0
mov qword [rsp + 0xa0], rsi
mov rsi, qword [rsp + 0xe8]
mov qword [rsp + 0xe8], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14009c933
call fcn.14007a8b0
lea rdx, [rsp + 0xa0]
mov qword [rdx + 8], rsi
mov rax, qword [rsp + 0xf0]
mov qword [rdx + 0x10], rax
mov qword [rsp + 0xf0], 0
mov rcx, rbx
call fcn.14001fbb0
xor ebx, ebx
lea rcx, [rsp + 0xe0]
call fcn.14001b4a0
cmp byte [rsp + 0xd7], 0
jns 0x14009c985
mov rcx, qword [rsp + 0xc0]
call fcn.1400a5630
test rdi, rdi
je 0x14009c99c
lea rcx, fcn.1400619b0
mov rdx, rdi
xor r8d, r8d
call fcn.140068b90
mov rdi, qword [r13]
mov qword [r13], 0
test rdi, rdi
je 0x14009c9bd
mov rcx, rdi
call fcn.14001fdd0
mov rcx, rdi
call fcn.1400a5630
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.1400a77a0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x120]
movaps xmm7, xmmword [rsp + 0x130]
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov byte [rsp + 0x5f], r9b
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x14009cf03
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x90], rdi
xorps xmm7, xmm7
movaps xmmword [rsp + 0xa0], xmm7
mov qword [rsp + 0xb0], 0
mov rcx, rax
movzx eax, word [rax]
test ax, ax
mov qword [rsp + 0x88], rcx
je 0x14009cc85
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], r13
movabs rsi, 0x7ffffffffffffff7
lea rbx, str.Path
lea rdx, [rsp + 0xa0]
mov qword [rsp + 0x60], rdx
mov r13, rcx
jmp 0x14009cc0c
movzx eax, word [rdi + rbp*2 + 2]
inc rbp
add r12, 0xfffffffffffffffe
add r13, 2
test ax, ax
je 0x14009ca97
movzx eax, ax
cmp eax, 0x3d
jne 0x14009ca7a
test rdi, rdi
jne 0x14009caa5
test rbp, rbp
jne 0x14009ce6b
cmp rbp, rsi
ja 0x14009ce4e
cmp rbp, 0xa
jbe 0x14009ce57
lea rax, [rsi + 5]
and rax, rbp
add rax, 4
mov r14, rsi
mov rsi, rbp
or rsi, 3
cmp rsi, 0xb
cmove rsi, rax
inc rsi
js 0x14009ce51
lea rcx, [rsi + rsi]
call fcn.1400a5638
mov r15, rax
mov qword [rsp + 0x100], rax
lea rax, [r14 + rsi]
add rax, 9
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x108], rbp
mov rsi, r14
cmp r15, rdi
ja 0x14009cb21
mov rax, r15
sub rax, r12
cmp rax, rdi
ja 0x14009ce6e
test rbp, rbp
je 0x14009cb37
neg r12
mov rcx, r15
mov rdx, rdi
mov r8, r12
call fcn.1400a9230
mov word [r15 + rbp*2], 0
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xf0], rax
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xe0], xmm0
inc rbp
cmp word [r13], 0
lea r13, [r13 + 2]
jne 0x14009cb5e
movzx eax, byte [rsp + 0xf7]
test al, al
mov rcx, rax
cmovs rcx, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0xe0]
lea r8, [rsp + 0xe0]
cmovns rdx, r8
test rcx, rcx
mov r15d, 0xd0
js 0x14009ce54
je 0x14009cbb1
test rdx, rdx
je 0x14009ce71
xor r9d, r9d
cmp qword [r9 + rbx + 8], rcx
je 0x14009cc34
add r9, 0x10
cmp r9, r15
jne 0x14009cbb4
lea r8, [rbx + r15]
mov rcx, r8
sub rcx, rbx
sar rcx, 4
test rcx, rcx
jle 0x14009cc2d
cmp rcx, 0xe
jae 0x14009ce68
lea rcx, str.Path
cmp r8, rcx
jne 0x14009cc66
test al, al
jns 0x14009cbfe
mov rcx, qword [rsp + 0xe0]
call fcn.1400a5630
movzx eax, word [r13]
test ax, ax
je 0x14009cca4
mov rdi, r13
movaps xmmword [rsp + 0xe0], xmm7
mov qword [rsp + 0xf0], 0
xor r12d, r12d
xor ebp, ebp
jmp 0x14009ca8a
jns 0x14009cbe1
jmp 0x14009ce74
lea r8, [rbx + r9]
test rcx, rcx
je 0x14009cbc8
mov r10, qword [r8]
xor r11d, r11d
mov r14, rsi
movzx esi, word [r10 + r11*2]
cmp si, word [rdx + r11*2]
mov rsi, r14
jne 0x14009cbbb
inc r11
cmp rcx, r11
jne 0x14009cc43
jmp 0x14009cbc8
lea rcx, [rsp + 0xa0]
mov rdx, rdi
mov r8, rbp
call fcn.14009c290
mov al, byte [rsp + 0xf7]
jmp 0x14009cbed
xor eax, eax
movzx edi, al
mov eax, edi
inc al
and al, 0x7f
lea r12, [rsp + 0xa0]
mov byte [r12 + 0x17], al
mov rbx, qword [rsp + 0x68]
jmp 0x14009cd07
mov al, byte [rsp + 0xb7]
test al, al
jns 0x14009cf2f
lea rax, [rsi + 8]
and rax, qword [rsp + 0xb0]
lea rdi, [rax - 1]
mov rcx, qword [rsp + 0xa8]
cmp rcx, rdi
mov r13, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
mov r15, qword [rsp + 0x70]
mov ebp, 0
je 0x14009cd7a
mov r12, qword [rsp + 0xa0]
mov rdi, rcx
lea rax, [rdi + 1]
mov qword [rsp + 0xa8], rax
mov dword [r12 + rdi*2], 0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xc8], rax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov dl, byte [rsp + 0xd7]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov r8, qword [r13]
mov rdi, qword [rsp + 0x90]
mov r9b, byte [rsp + 0x5f]
jmp 0x14009c713
lea rcx, [rsi + 1]
cmp rax, rcx
je 0x14009cf58
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x60], rax
movabs rax, 0x3ffffffffffffff2
mov rbx, rsi
cmp rdi, rax
ja 0x14009cddf
lea rbx, [rdi + rdi]
lea rax, [rdi + 1]
cmp rax, rbx
cmova rbx, rax
cmp rbx, 0xb
jb 0x14009cf5b
lea rax, [rsi + 5]
and rax, rbx
add rax, 4
or rbx, 3
cmp rbx, 0xb
cmove rbx, rax
inc rbx
js 0x14009cf65
lea rcx, [rbx + rbx]
call fcn.1400a5638
mov r12, rax
test rdi, rdi
jne 0x14009ce1c
mov rcx, qword [rsp + 0x60]
call fcn.1400a5630
mov qword [rsp + 0xa0], r12
lea rax, [rsi + rbx]
add rax, 9
mov qword [rsp + 0xb0], rax
mov rbx, qword [rsp + 0x68]
jmp 0x14009ccfb
mov rdx, qword [rsp + 0x60]
cmp rdx, r12
jb 0x14009ce3a
lea rax, [r12 + rdi*2]
cmp rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x60]
ja 0x14009cf68
lea r8, [rdi + rdi]
mov rcx, r12
call fcn.1400a9230
cmp rdi, 0xa
je 0x14009cdfa
jmp 0x14009cdf0
int3
int3
int3
lea r15, [rsp + 0x100]
mov byte [r15 + 0x17], bpl
jmp 0x14009cb0d
int3
int3
int3
int3
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
jmp 0x14009ce87
mov dword [rsi], 0x542
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x15
jmp 0x14009c961
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x17
jmp 0x14009c961
lea rcx, fcn.1400619b0
xor r8d, r8d
call fcn.140068b90
jmp 0x14009c6ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov ebx, 0x12
jmp 0x14009c96e
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x41
jmp 0x14009c961
mov ebx, 0x46
jmp 0x14009c985
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x2b
jmp 0x14009c961
mov edi, 0xa
cmp al, 0xa
mov r13, qword [rsp + 0x80]
mov r14, qword [rsp + 0x78]
mov r15, qword [rsp + 0x70]
mov ebp, 0
je 0x14009cda6
jmp 0x14009cc87
int3
mov ebx, 0xb
jmp 0x14009cddf
int3
int3