Function at 0x14011fac0
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
movaps xmmword [rsp + 0x130], xmm7
movaps xmmword [rsp + 0x120], xmm6
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x14022b040]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rcx, rdx
call fcn.140131ce8
mov rcx, qword [rbx + 0x48]
mov qword [rbx + 0x48], rax
test rcx, rcx
jne 0x1401203b8
mov r12, qword [r15]
mov rcx, rdi
call fcn.140131ce8
xor ebp, ebp
cmp qword [r12 + 0x98], 0
mov rdi, rax
setne r9b
xorps xmm6, xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0xd0], 0
mov r8, qword [r15]
cmp byte [r8 + 0x19], 1
je 0x14011fdef
xor eax, eax
xor ecx, ecx
xor edx, edx
mov rsi, qword [rsp + 0x1b8]
mov bpl, r9b
shl ebp, 0x13
or ebp, 0x40c
movzx r8d, byte [r8 + 0x18]
xor r9d, r9d
lea r10, [rsp + 0x100]
mov qword [r10 + 0x10], r9
add r12, 0x30
test dl, dl
movzx edx, dl
cmovs rdx, rcx
movaps xmmword [r10], xmm6
lea r11, [rsp + 0xc0]
cmovs r11, rax
test rdx, rdx
cmove r11, rdx
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
mov rdx, r14
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1401203c4
xorps xmm0, xmm0
lea r14, [rsp + 0xe0]
movaps xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
lea rdx, [rsp + 0x100]
mov rcx, r14
call fcn.14003c110
mov rax, qword [r14 + 8]
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x14012038e
mov rdx, qword [rsp + 0xe8]
movaps xmm0, xmmword [0x1401fa990]
lea r14, [rsp + 0xa0]
movaps xmmword [r14], xmm0
xor ebp, ebp
mov rcx, r14
mov r8b, 1
xor r9d, r9d
call fcn.1400412d0
mov al, byte [r14 + 8]
cmp al, 1
jne 0x14011fc80
lea r14, [rsp + 0xa0]
mov rcx, r14
call fcn.1400413b0
mov ebp, eax
xor bpl, 1
mov al, byte [r14 + 8]
test al, 1
je 0x14011fc91
lea rcx, [rsp + 0xa0]
call fcn.1400408b0
test bpl, bpl
je 0x140120398
mov rcx, qword [rsp + 0x1b0]
lea rdx, [rsp + 0xe0]
call fcn.1400415d0
test al, al
je 0x1401203fa
mov rcx, qword [rsp + 0xe0]
call fcn.1400414a0
mov qword [rbx + 0x40], rax
test rax, rax
je 0x14012041c
lea rcx, [0x140000000]
cmp rax, rcx
jne 0x1401203e0
mov rsi, qword [rsp + 0xe0]
mov qword [rsp + 0xe0], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14011fd04
call fcn.1400a2670
mov qword [rsp + 0xa0], rsi
mov rsi, qword [rsp + 0xe8]
mov qword [rsp + 0xe8], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14011fd2f
call fcn.1400a2670
lea rdx, [rsp + 0xa0]
mov qword [rdx + 8], rsi
mov rax, qword [rsp + 0xf0]
mov qword [rdx + 0x10], rax
mov qword [rsp + 0xf0], 0
mov rcx, rbx
call fcn.14003c110
xor ebx, ebx
lea rcx, [rsp + 0xe0]
call fcn.14003db40
cmp byte [rsp + 0xd7], 0
jns 0x14011fd81
mov rcx, qword [rsp + 0xc0]
call fcn.140130d24
test rdi, rdi
je 0x14011fd90
mov rcx, rdi
xor edx, edx
call fcn.140001e10
mov rdi, qword [r15]
mov qword [r15], 0
test rdi, rdi
je 0x14011fdaf
mov rcx, rdi
call fcn.1400411f0
mov rcx, rdi
call fcn.140130d24
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
cmp rcx, qword [0x14022b040]
je 0x14011fdc9
call fcn.1401335a0
int3
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x120]
movaps xmm7, xmmword [rsp + 0x130]
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov byte [rsp + 0x67], r9b
call qword [0x14021faf8]
test rax, rax
je 0x1401203d6
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], r15
xorps xmm7, xmm7
movaps xmmword [rsp + 0xa0], xmm7
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0x68], rax
movzx eax, word [rax]
test ax, ax
je 0x14011fe6b
movabs r12, 0x7ffffffffffffff7
lea r15, str.Path
lea rbx, str.Path
mov r13, qword [rsp + 0x68]
jmp 0x140120100
lea r12, [rsp + 0xa0]
mov rcx, r12
xor edx, edx
call fcn.1400fe460
mov rax, qword [r12 + 0x10]
mov qword [rsp + 0xd0], rax
movaps xmm0, xmmword [r12]
movaps xmmword [rsp + 0xc0], xmm0
mov rcx, qword [rsp + 0x68]
call qword [0x14021fa70]
mov dl, byte [rsp + 0xd7]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov r15, qword [rsp + 0x90]
mov r8, qword [r15]
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x70]
xor ebp, ebp
mov r9b, byte [rsp + 0x67]
jmp 0x14011fb62
xor r8d, r8d
lea r9, str.SystemDrive
movzx edx, word [r9]
cmp dx, word [rcx + r8*2]
jne 0x14011ff19
add r9, 2
inc r8
xor edx, edx
cmp rax, r8
jne 0x14011fef4
lea r8, str.SystemDrive
jmp 0x1401200b9
cmp rax, 0xa
jne 0x140120090
jmp 0x14012035f
mov byte [rsp + 0x117], r14b
lea rbp, [rsp + 0x100]
jmp 0x14011ffc7
movzx eax, ax
test eax, eax
je 0x14011ff57
movzx eax, word [r13 + r14*2 + 2]
inc r14
add rdi, 0xfffffffffffffffe
cmp ax, 0x3d
jne 0x14011ff3d
test r14, r14
sete al
test r13, r13
setne cl
or cl, al
je 0x140120374
cmp r14, r12
ja 0x14012037b
cmp r14, 0xa
jbe 0x14011ff28
mov rax, r14
or rax, 3
lea rsi, [rax + 1]
cmp rax, 0xb
mov eax, 0xd
cmove rsi, rax
test rsi, rsi
js 0x140120376
lea rcx, [rsi + rsi]
call fcn.140130ce8
mov rbp, rax
mov qword [rsp + 0x100], rax
lea rax, [r12 + rsi]
add rax, 9
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x108], r14
cmp rbp, r13
ja 0x14011ffdb
mov rax, rbp
sub rax, rdi
cmp rax, r13
ja 0x140120374
test r14, r14
je 0x14011fff1
mov r8, rdi
neg r8
mov rcx, rbp
mov rdx, r13
call fcn.1401671f0
mov word [rbp + r14*2], 0
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xf0], rax
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xe0], xmm0
add rdi, 0xfffffffffffffffe
cmp word [r13 + r14*2], 0
lea r14, [r14 + 1]
jne 0x140120019
movsx rax, byte [rsp + 0xf7]
test rax, rax
cmovs rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xe0]
lea rdx, [rsp + 0xe0]
cmovns rcx, rdx
test rax, rax
js 0x140120374
setne dl
test rcx, rcx
sete r8b
test dl, r8b
jne 0x140120374
cmp rax, 4
je 0x140120148
cmp rax, 0xb
je 0x14011feea
mov r8, rax
cmp rax, 0xa
je 0x1401201a8
cmp rax, 4
je 0x140120176
mov dl, 1
cmp rax, 3
je 0x14012011e
cmp rax, 0xc
je 0x14012020f
mov r8, rbx
cmp rax, 0x19
je 0x1401201d9
sub r8, r15
cmp r8, 0x71
jge 0x140120388
test r8, r8
js 0x14012038b
test dl, dl
je 0x140120250
cmp byte [rsp + 0xf7], 0
jns 0x1401200ee
mov rcx, qword [rsp + 0xe0]
call fcn.140130d24
movzx eax, word [r13 + r14*2]
sub r13, rdi
test ax, ax
je 0x14011fe6b
movaps xmmword [rsp + 0xe0], xmm7
mov qword [rsp + 0xf0], 0
xor edi, edi
xor r14d, r14d
jmp 0x14011ff51
xor r8d, r8d
lea r9, [0x1402176f2]
movzx r10d, word [r9]
cmp r10w, word [rcx + r8*2]
jne 0x1401200a2
add r9, 2
inc r8
cmp rax, r8
jne 0x140120128
jmp 0x14012030a
xor r8d, r8d
lea rdx, str.Path
movzx edx, word [r8 + rdx]
cmp dx, word [rcx + r8]
jne 0x140120079
add r8, 2
xor edx, edx
cmp r8, 8
jne 0x14012014b
mov r8, r15
jmp 0x1401200b9
xor r8d, r8d
lea rdx, str.TEMP
movzx edx, word [r8 + rdx]
cmp dx, word [rcx + r8]
jne 0x14012009a
add r8, 2
xor edx, edx
cmp r8, 8
jne 0x140120179
lea r8, str.TEMP
jmp 0x1401200b9
xor r9d, r9d
lea rdx, str.SystemRoot
movzx edx, word [r9 + rdx]
cmp dx, word [rcx + r9]
jne 0x140120090
add r9, 2
xor edx, edx
dec r8
jne 0x1401201ab
lea r8, str.SystemRoot
jmp 0x1401200b9
xor r8d, r8d
lea rdx, str.CHROME_CRASHPAD_PIPE_NAME
movzx edx, word [r8 + rdx]
cmp dx, word [rcx + r8]
setne dl
jne 0x140120207
add r8, 2
dec rax
jne 0x1401201dc
lea r8, str.CHROME_CRASHPAD_PIPE_NAME
jmp 0x1401200b9
mov r8, rbx
jmp 0x1401200b9
xor r8d, r8d
lea r9, str.LOCALAPPDATA
movzx r10d, word [r9]
cmp r10w, word [rcx + r8*2]
jne 0x14012023e
add r9, 2
inc r8
cmp rax, r8
jne 0x140120219
xor edx, edx
lea r8, str.LOCALAPPDATA
jmp 0x1401200b9
mov r8, rbx
cmp rax, 0x19
jne 0x1401200b9
jmp 0x14012036a
test r13, r13
setne al
test r14, r14
sete cl
or cl, al
je 0x140120374
movsx rax, byte [rsp + 0xb7]
mov edx, 0xa
mov rbp, rax
test rax, rax
jns 0x140120292
lea rdx, [r12 + 8]
and rdx, qword [rsp + 0xb0]
dec rdx
mov rbp, qword [rsp + 0xa8]
mov rcx, rdx
sub rcx, rbp
cmp rcx, r14
jb 0x140120318
test r14, r14
je 0x1401200d7
lea rsi, [rsp + 0xa0]
test al, al
jns 0x1401202ba
mov rsi, qword [rsp + 0xa0]
test r14, r14
js 0x140120374
lea rcx, [rsi + rbp*2]
cmp rcx, r13
ja 0x1401202db
mov rax, rcx
sub rax, rdi
cmp rax, r13
ja 0x140120374
mov r8, rdi
neg r8
mov rdx, r13
call fcn.1401671f0
lea rax, [r14 + rbp]
cmp byte [rsp + 0xb7], 0
jns 0x14012034e
mov qword [rsp + 0xa8], rax
mov word [rsi + rax*2], 0
jmp 0x1401200d7
xor edx, edx
lea r8, [0x140217680]
jmp 0x1401200b9
mov r8, rbp
sub r8, rdx
add r8, r14
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0xa0]
mov r9, rbp
call fcn.1400d48d0
jmp 0x1401200d7
add ebp, r14d
and bpl, 0x7f
mov byte [rsp + 0xb7], bpl
jmp 0x1401202ff
mov r8d, 0xa
jmp 0x1401201a8
mov eax, 0x19
jmp 0x1401201d9
ud2
call fcn.14016cc10
lea rcx, [rsp + 0x100]
call fcn.14016cbd0
int3
int3
call qword [0x14021fb48]
mov dword [rsi], eax
jmp 0x14012039e
mov dword [rsi], 0x542
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [0x14021ff18]
mov ebx, 0x15
jmp 0x14011fd5d
xor edx, edx
call fcn.140001e10
jmp 0x14011fb1a
call qword [0x14021fb48]
mov dword [rsi], eax
mov ebx, 0x12
jmp 0x14011fd6a
mov ebx, 0x46
jmp 0x14011fd81
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [0x14021ff18]
mov ebx, 0x41
jmp 0x14011fd5d
call qword [0x14021fb48]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [0x14021ff18]
mov ebx, 0x17
jmp 0x14011fd5d
call qword [0x14021fb48]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [0x14021ff18]
mov ebx, 0x2b
jmp 0x14011fd5d