Function at 0x14002ff90
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
movaps xmmword [rsp + 0x170], xmm6
mov ebp, r9d
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov r13, qword [rsp + 0x1f0]
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov rcx, rdx
call qword [sym.imp.mozglue.dll__wcsdup]
mov rcx, qword [rdi + 0x50]
mov qword [rdi + 0x50], rax
test rcx, rcx
jne 0x1400302fd
mov r14, qword [rsp + 0x200]
mov rcx, rsi
call qword [sym.imp.mozglue.dll__wcsdup]
mov qword [rsp + 0x60], rax
xor esi, esi
cmp qword [r13 + 0x70], 0
setne sil
shl esi, 0x13
or esi, 0x40c
cmp qword [rdi + 0x30], 0
je 0x14003002f
call fcn.14000e1f0
lea ecx, [rsi + 0x1000000]
cmp eax, 5
cmovge ecx, esi
mov esi, ecx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov r12, rax
lea r15, [rsp + 0xb8]
mov rcx, r15
mov rdx, rax
mov r8, r14
call fcn.1400174e0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
cmp qword [r15 + 0x18], 8
jb 0x140030066
mov r15, qword [rsp + 0xb8]
xor eax, eax
lea rdx, [rsp + 0x90]
mov qword [rdx + 0x10], rax
xorps xmm6, xmm6
movaps xmmword [rdx], xmm6
add r13, 8
movzx r8d, bpl
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov r13, qword [rsp + 0x60]
mov r8, r13
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140030308
lea rcx, [rsp + 0x70]
movaps xmmword [rcx], xmm6
mov qword [rcx + 0x10], 0
lea rdx, [rsp + 0x90]
call fcn.14000f1f0
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x1400300fd
mov rdx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x140030322
mov rbx, qword [rdi + 0x20]
lea rax, [rbx + 1]
cmp rax, 2
jb 0x140030216
mov qword [rsp + 0x68], 0
mov rcx, qword [rsp + 0x70]
lea r8, [rsp + 0xd8]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400301e2
mov rdx, qword [rsp + 0xd8]
lea r14, [rsp + 0xa8]
mov qword [r14], 0
mov rcx, r14
call fcn.14000b5e0
mov r14, qword [r14]
mov ecx, 0x4c
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x3c], xmm0
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x20], rax
mov rcx, r14
mov edx, 0x1f
mov r8, r15
mov r9d, 0x4c
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400301b1
mov r12, qword [r15]
test r12, r12
jne 0x14003042c
xor r14d, r14d
xor esi, esi
mov edx, 0x4c
mov rcx, r15
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
lea rcx, [rsp + 0xa8]
call fcn.14000b6f0
test sil, sil
jne 0x140030349
test r14, r14
jne 0x14003046b
mov rax, qword [rsp + 0x78]
lea rcx, [rsp + 0xd8]
mov qword [rcx], rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x1400303a7
lea rcx, [rdi + 0x20]
call fcn.14000b6f0
lea rcx, [rsp + 0x68]
call fcn.14000b6f0
mov rcx, qword [rsp + 0x1f8]
lea rdx, [rsp + 0x70]
call fcn.140030480
test al, al
je 0x1400303d8
mov rcx, qword [rsp + 0x70]
call fcn.14002e560
mov qword [rdi + 0x48], rax
test rax, rax
je 0x1400303ff
lea rcx, [rsp + 0x70]
lea rbx, [rsp + 0xd8]
mov rdx, rbx
call fcn.140017c20
mov rcx, rdi
mov rdx, rbx
call fcn.14000f1f0
xor edi, edi
lea rcx, [rsp + 0x70]
call fcn.140017cb0
mov rax, qword [rsp + 0xd0]
cmp rax, 8
jb 0x1400302c1
mov rcx, qword [rsp + 0xb8]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400302bc
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140030426
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
test r13, r13
je 0x1400302cf
mov rcx, r13
call qword [sym.imp.mozglue.dll_free]
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14002ba20
mov eax, edi
movaps xmm6, xmmword [rsp + 0x170]
add rsp, 0x188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.mozglue.dll_free]
jmp 0x14002ffeb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x208]
mov dword [rcx], eax
mov edi, 0x12
jmp 0x140030273
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x208]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, 0x14
jmp 0x140030269
lea r8, [rdi + 0x58]
lea r15, [rsp + 0xd8]
mov rcx, r15
mov rdx, r14
call fcn.14004cdb0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8, r15
xor r9d, r9d
call fcn.14004b1d0
mov ebp, eax
mov rcx, r15
call fcn.14004d0f0
mov rcx, r14
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64_
test ebp, ebp
jne 0x14003039d
mov rbx, qword [rsp + 0x68]
mov r13, qword [rsp + 0x60]
jmp 0x1400301e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x208]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rcx, [rsp + 0x68]
call fcn.14000b6f0
mov edi, 0x15
jmp 0x140030269
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x208]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, 0x17
jmp 0x140030269
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x208]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, 0x2b
jmp 0x140030269
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov ecx, 0x44
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
mov dword [rax + 0x40], 0
mov ecx, 0x44
mov rdx, rax
mov r8, r12
call qword [sym.imp.ADVAPI32.dll_CopySid]
mov sil, 1
jmp 0x1400301b6
mov rcx, r14
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x1400301e2