Function at 0x140092d40
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
movaps xmmword [rsp + 0x130], xmm7
movaps xmmword [rsp + 0x120], xmm6
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rbp, rcx
mov rax, qword [0x140139028]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rcx, rdx
call fcn.1400a03f4
mov rdx, qword [rbp + 0x48]
mov qword [rbp + 0x48], rax
test rdx, rdx
jne 0x140093575
mov rbx, qword [r15]
mov rcx, rdi
call fcn.1400a03f4
cmp qword [rbx + 0xa0], 0
mov r13, rax
setne r9b
xorps xmm6, xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0xd0], 0
mov r8, qword [r15]
cmp byte [r8 + 0x21], 0
je 0x14009308d
mov byte [rsp + 0x5f], r9b
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x14009356b
mov qword [rsp + 0x68], rbx
xorps xmm7, xmm7
movaps xmmword [rsp + 0xa0], xmm7
mov qword [rsp + 0xb0], 0
mov rcx, rax
movzx eax, word [rax]
test ax, ax
mov qword [rsp + 0x90], rcx
je 0x14009306e
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], r15
movabs rdx, 0x7ffffffffffffff7
lea rbx, str.Path
lea r8, [rsp + 0xa0]
mov qword [rsp + 0x60], r8
mov r13, rcx
jmp 0x140092ffb
movzx eax, word [r15 + rbp*2 + 2]
inc rbp
add r12, 0xfffffffffffffffe
add r13, 2
test ax, ax
je 0x140092e7e
movzx eax, ax
cmp eax, 0x3d
jne 0x140092e60
test r15, r15
jne 0x140092e8c
test rbp, rbp
jne 0x140093513
cmp rbp, rdx
ja 0x1400934f6
cmp rbp, 0xa
jbe 0x1400934ff
lea rax, [rdx + 5]
and rax, rbp
add rax, 4
mov rsi, rbp
or rsi, 3
cmp rsi, 0xb
cmove rsi, rax
inc rsi
js 0x1400934f9
mov r14, rdx
lea rcx, [rsi + rsi]
call fcn.14009f7f4
mov rdi, rax
mov qword [rsp + 0x100], rax
lea rax, [r14 + 9]
or rax, rsi
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x108], rbp
cmp rdi, r15
ja 0x140092f04
mov rax, rdi
sub rax, r12
cmp rax, r15
ja 0x140093516
test rbp, rbp
je 0x140092f1a
neg r12
mov rcx, rdi
mov rdx, r15
mov r8, r12
call fcn.1400a3450
mov word [rdi + rbp*2], 0
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xf0], rax
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xe0], xmm0
inc rbp
cmp word [r13], 0
lea r13, [r13 + 2]
jne 0x140092f40
movzx eax, byte [rsp + 0xf7]
test al, al
mov rcx, rax
cmovs rcx, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0xe0]
lea r8, [rsp + 0xe0]
cmovns rdx, r8
test rcx, rcx
mov edi, 0xc0
js 0x1400934fc
je 0x140092f92
test rdx, rdx
je 0x140093519
xor r9d, r9d
cmp qword [r9 + rbx + 8], rcx
je 0x140093023
add r9, 0x10
cmp r9, rdi
jne 0x140092f95
lea r8, [rbx + rdi]
mov rcx, r8
sub rcx, rbx
sar rcx, 4
test rcx, rcx
jle 0x14009301c
cmp rcx, 0xd
jae 0x140093510
lea rcx, str.Path
cmp r8, rcx
jne 0x14009304f
test al, al
jns 0x140092fe3
mov rcx, qword [rsp + 0xe0]
call fcn.14009f888
movzx eax, word [r13]
test ax, ax
movabs rdx, 0x7ffffffffffffff7
je 0x140093098
mov r15, r13
movaps xmmword [rsp + 0xe0], xmm7
mov qword [rsp + 0xf0], 0
xor r12d, r12d
xor ebp, ebp
jmp 0x140092e71
jns 0x140092fc6
jmp 0x14009351c
lea r8, [rbx + r9]
test rcx, rcx
je 0x140092fad
mov r10, qword [r8]
xor r11d, r11d
movzx esi, word [r10 + r11*2]
cmp si, word [rdx + r11*2]
jne 0x140092fa0
inc r11
cmp rcx, r11
jne 0x140093032
jmp 0x140092fad
lea rcx, [rsp + 0xa0]
mov rdx, r15
mov r8, rbp
call fcn.140092b50
mov al, byte [rsp + 0xf7]
jmp 0x140092fd2
xor eax, eax
movzx edi, al
mov eax, edi
inc al
and al, 0x7f
lea r12, [rsp + 0xa0]
mov byte [r12 + 0x17], al
mov rbx, qword [rsp + 0x68]
jmp 0x1400930fe
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x140093163
mov al, byte [rsp + 0xb7]
test al, al
jns 0x1400935d7
lea rax, [rdx + 8]
and rax, qword [rsp + 0xb0]
lea rdi, [rax - 1]
mov rcx, qword [rsp + 0xa8]
cmp rcx, rdi
mov r15, qword [rsp + 0x88]
mov r13, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
je 0x140093419
mov r12, qword [rsp + 0xa0]
mov rdi, rcx
lea rax, [rdi + 1]
mov qword [rsp + 0xa8], rax
mov dword [r12 + rdi*2], 0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xc8], rax
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov dl, byte [rsp + 0xd7]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov r8, qword [r15]
mov r9b, byte [rsp + 0x5f]
mov rsi, qword [rsp + 0x1b8]
xor edi, edi
mov dil, r9b
shl edi, 0x13
or edi, 0x40c
movzx r8d, byte [r8 + 0x20]
xor r9d, r9d
lea r10, [rsp + 0x100]
mov qword [r10 + 0x10], r9
add rbx, 0x38
test dl, dl
movzx edx, dl
cmovs rdx, rcx
movaps xmmword [r10], xmm6
lea r11, [rsp + 0xc0]
cmovs r11, rax
test rdx, rdx
cmove r11, rdx
mov rcx, qword [rbp + 0x18]
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
mov rdx, r14
mov r8, r13
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140093589
xorps xmm0, xmm0
lea rdi, [rsp + 0xe0]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
lea rdx, [rsp + 0x100]
mov rcx, rdi
call fcn.140019ce0
mov rax, qword [rdi + 8]
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
mov rdx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x14009351f
mov rdx, qword [rsp + 0xe8]
movaps xmm0, xmmword [0x140118af0]
lea rdi, [rsp + 0xa0]
movaps xmmword [rdi], xmm0
mov rcx, rdi
mov r8b, 1
xor r9d, r9d
call fcn.140021bb0
cmp byte [rdi + 8], 0
je 0x140093529
lea r14, [rsp + 0xa0]
mov rcx, r14
call fcn.140021c90
mov edi, eax
cmp byte [r14 + 8], 0
je 0x14009328d
lea rcx, [rsp + 0xa0]
call fcn.14001f4b0
test dil, dil
jne 0x140093529
mov rdi, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0xe0]
mov rdx, rdi
call fcn.14001a060
test al, al
je 0x140093549
lea rdx, [rdi + 8]
mov rcx, qword [rsp + 0xe8]
call fcn.14001a060
test al, al
je 0x140093549
mov eax, dword [rsp + 0xf0]
mov dword [rdi + 0x10], eax
mov eax, dword [rsp + 0xf4]
mov dword [rdi + 0x14], eax
mov rcx, qword [rsp + 0xe0]
call fcn.140021e80
mov qword [rbp + 0x40], rax
test rax, rax
je 0x1400935b5
lea rcx, [0x140000000]
cmp rax, rcx
jne 0x14009359b
mov rsi, qword [rsp + 0xe0]
mov qword [rsp + 0xe0], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140093330
call fcn.14005e8a0
mov qword [rsp + 0xa0], rsi
mov rsi, qword [rsp + 0xe8]
mov qword [rsp + 0xe8], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14009335b
call fcn.14005e8a0
lea rdx, [rsp + 0xa0]
mov qword [rdx + 8], rsi
mov rax, qword [rsp + 0xf0]
mov qword [rdx + 0x10], rax
mov qword [rsp + 0xf0], 0
mov rcx, rbp
call fcn.140019ce0
xor ebx, ebx
lea rcx, [rsp + 0xe0]
call fcn.14001c740
cmp byte [rsp + 0xd7], 0
jns 0x1400933ad
mov rcx, qword [rsp + 0xc0]
call fcn.14009f888
test r13, r13
je 0x1400933c4
lea rcx, fcn.140063060
mov rdx, r13
xor r8d, r8d
call fcn.140061980
mov rdi, qword [r15]
mov qword [r15], 0
test rdi, rdi
je 0x1400933e3
mov rcx, rdi
call fcn.140021d80
mov rcx, rdi
call fcn.14009f888
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.1400a19c0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x120]
movaps xmm7, xmmword [rsp + 0x130]
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rdx + 1]
cmp rax, rcx
je 0x140093603
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x60], rax
movabs rax, 0x3ffffffffffffff2
mov rbx, rdx
cmp rdi, rax
ja 0x14009347e
lea rbx, [rdi + rdi]
lea rax, [rdi + 1]
cmp rax, rbx
cmova rbx, rax
cmp rbx, 0xb
jb 0x1400934ef
lea rax, [rdx + 5]
and rax, rbx
add rax, 4
or rbx, 3
cmp rbx, 0xb
cmove rbx, rax
inc rbx
js 0x140093606
lea rcx, [rbx + rbx]
call fcn.14009f7f4
mov r12, rax
test rdi, rdi
jne 0x1400934c4
mov rcx, qword [rsp + 0x60]
call fcn.14009f888
mov qword [rsp + 0xa0], r12
movabs rax, 0x7ffffffffffffff7
add rax, 9
or rbx, rax
mov qword [rsp + 0xb0], rbx
mov rbx, qword [rsp + 0x68]
jmp 0x1400930f2
mov rdx, qword [rsp + 0x60]
cmp rdx, r12
jb 0x1400934db
lea rax, [r12 + rdi*2]
cmp rax, rdx
ja 0x140093609
lea r8, [rdi + rdi]
mov rcx, r12
call fcn.1400a3450
cmp rdi, 0xa
je 0x140093499
jmp 0x14009348f
mov ebx, 0xb
jmp 0x14009347e
int3
int3
int3
lea rdi, [rsp + 0x100]
mov byte [rdi + 0x17], bpl
jmp 0x140092ef0
int3
int3
int3
int3
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
jmp 0x14009352f
mov dword [rsi], 0x542
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x15
jmp 0x140093389
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x17
jmp 0x140093389
mov ebx, 0x46
jmp 0x1400933ad
lea rcx, fcn.140063060
xor r8d, r8d
call fcn.140061980
jmp 0x140092d9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov ebx, 0x12
jmp 0x140093396
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x41
jmp 0x140093389
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x2b
jmp 0x140093389
mov edi, 0xa
cmp al, 0xa
mov r15, qword [rsp + 0x88]
mov r13, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
je 0x140093445
jmp 0x140093070
int3
int3
int3