Function at 0x14000d700
Capabilities:
Check if file exists
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rbx, r9
mov rsi, r8
mov r12, rdx
mov r13, rcx
mov r15, 0xffffffffffffffff
call fcn.14000f6b0
mov r14, rax
test rax, rax
jne 0x14000d754
call fcn.14003d440
mov dword [rax], 0xc
jmp 0x14000dace
mov rcx, r14
mov qword [rsp + 0x148], rdi
call fcn.14000e170
mov rdi, rax
test rax, rax
jne 0x14000d77f
call fcn.14003d440
mov rcx, r14
mov dword [rax], 0xc
jmp 0x14000dac1
mov rax, qword [rbp + 0x60]
lea rdx, str.sshd.exe
xorps xmm0, xmm0
mov qword [rbp], rax
movups xmmword [rbp - 0x10], xmm0
mov rcx, r13
mov qword [rbp - 0x10], rsi
movups xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x60], 0x68
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 8], rbx
mov dword [rbp - 0x24], 0x100
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x20], xmm0
call fcn.140032368
mov esi, dword [rbp + 0x68]
lea r8, str.FIDO_DEBUG
or esi, 8
lea rdx, [rbp - 0x78]
test rax, rax
lea rcx, [rsp + 0x68]
cmove esi, dword [rbp + 0x68]
xor ebx, ebx
mov qword [rsp + 0x68], rbx
mov qword [rbp - 0x78], rbx
call fcn.14003d32c
lea r8, str.SSH_TEST_ENVIRONMENT
mov qword [rsp + 0x60], rbx
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x70], rbx
lea rcx, [rsp + 0x60]
call fcn.14003d32c
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000d83a
call fcn.140036190
mov rcx, qword [rsp + 0x60]
test eax, eax
mov eax, 1
cmovne ebx, eax
test rcx, rcx
je 0x14000d83a
call fcn.14003d000
test ebx, ebx
jne 0x14000d871
lea rdx, str.ssh_pkcs11_helper.exe
mov rcx, r13
call fcn.140032368
test rax, rax
jne 0x14000d871
mov r13d, esi
cmp qword [rsp + 0x68], rax
jne 0x14000d8b0
mov rcx, qword [rbp + 0x40]
lea rdx, str.ssh_sk_helper.exe
call fcn.140032368
test rax, rax
je 0x14000d8b0
xor ecx, ecx
lea rax, str.Creating_process_with_CREATE_NO_WINDOW
mov qword [rsp + 0x30], rax
lea rdx, str.spawn_child_internal
mov qword [rsp + 0x28], rcx
xor r9d, r9d
lea rcx, str.C:__w1_scontribwin32win32compatw32fd.c
mov dword [rsp + 0x20], 7
mov r8d, 0x43d
call fcn.14001ae20
mov r13d, esi
bts r13d, 0x1b
mov rsi, qword [rbp + 0x70]
lea rax, str.spawning__ls_as_user
mov rbx, rdi
lea rcx, str.spawning__ls_as_subprocess
nop word [rax + rax]
xor r9d, r9d
mov qword [rsp + 0x38], rbx
lea rdx, str.spawn_child_internal
test rsi, rsi
je 0x14000d94e
mov qword [rsp + 0x30], rax
lea rcx, str.C:__w1_scontribwin32win32compatw32fd.c
xor eax, eax
mov r8d, 0x444
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 7
call fcn.14001ae20
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov r8, rbx
lea rax, [rbp - 0x60]
xor edx, edx
mov qword [rsp + 0x48], rax
mov rcx, rsi
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x14000d9b1
mov qword [rsp + 0x30], rcx
xor eax, eax
mov qword [rsp + 0x28], rax
lea rcx, str.C:__w1_scontribwin32win32compatw32fd.c
mov r8d, 0x448
mov dword [rsp + 0x20], 7
call fcn.14001ae20
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp - 0x60]
mov rdx, rbx
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000da7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14000da0e
test r12, r12
je 0x14000d9d0
cmp qword [r12], 0
jne 0x14000da0e
mov rax, qword [rbp + 0x40]
cmp byte [rax], 0x22
je 0x14000da0e
add rbx, 2
mov rax, r15
cmp word [rdi + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14000d9e0
xor ecx, ecx
mov word [rdi + rax*2 - 2], cx
lea rax, [rdi + 2]
cmp rbx, rax
lea rcx, str.spawning__ls_as_subprocess
lea rax, str.spawning__ls_as_user
je 0x14000d8d0
call fcn.14003d440
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
test rsi, rsi
lea r9, [0x14005c8d0]
lea rax, str._s_failed_error:_d
lea r8, [0x14005c8e8]
cmovne r8, r9
lea rdx, str.spawn_child_internal
mov qword [rsp + 0x38], r8
lea rcx, str.C:__w1_scontribwin32win32compatw32fd.c
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor eax, eax
mov r8d, 0x45c
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
call fcn.14001ae20
jmp 0x14000dab6
mov edx, dword [rbp - 0x80]
mov rcx, qword [rsp + 0x70]
call fcn.140010850
cmp eax, r15d
jne 0x14000daa7
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000dab6
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15d, dword [rbp - 0x80]
mov rcx, r14
call fcn.14003d000
mov rcx, rdi
call fcn.14003d000
mov rdi, qword [rsp + 0x148]
lea r11, [rsp + 0x110]
mov eax, r15d
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret