Function at 0x140168430
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
movaps xmmword [rsp + 0x130], xmm7
movaps xmmword [rsp + 0x120], xmm6
mov r14, r9
mov rdi, r8
mov r12, rdx
mov r15, rcx
mov rax, qword [0x14029b028]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rcx, rdx
call fcn.140185b28
mov rdx, qword [r15 + 0x48]
mov qword [r15 + 0x48], rax
test rdx, rdx
jne 0x140168af9
mov r13, qword [r14]
mov rcx, rdi
call fcn.140185b28
xor edi, edi
cmp qword [r13 + 0xa0], 0
mov rbx, rax
setne r9b
xorps xmm6, xmm6
movaps xmmword [rsp + 0xe0], xmm6
mov qword [rsp + 0xf0], 0
mov rdx, qword [r14]
cmp byte [rdx + 0x21], 0
je 0x14016885b
mov byte [rsp + 0x67], r9b
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], r12
mov qword [rsp + 0x90], r15
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], r14
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x140168b65
xorps xmm7, xmm7
movaps xmmword [rsp + 0xc0], xmm7
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0x78], rax
movzx eax, word [rax]
test ax, ax
jne 0x140168867
lea rdi, [rsp + 0xc0]
mov rcx, rdi
xor edx, edx
call fcn.1401641c0
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0xf0], rax
movaps xmm0, xmmword [rdi]
movaps xmmword [rsp + 0xe0], xmm0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov r14, qword [rsp + 0x70]
mov rdx, qword [r14]
mov r8b, byte [rsp + 0xf7]
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0x68]
mov r15, qword [rsp + 0x90]
mov r12, qword [rsp + 0x88]
mov r13, qword [rsp + 0x80]
xor edi, edi
mov r9b, byte [rsp + 0x67]
mov rsi, qword [rsp + 0x1b8]
mov dil, r9b
shl edi, 0x13
or edi, 0x40c
movzx edx, byte [rdx + 0x20]
xor r9d, r9d
lea r10, [rsp + 0xc0]
mov qword [r10 + 0x10], r9
add r13, 0x38
test r8b, r8b
movzx r8d, r8b
cmovs r8, rcx
movaps xmmword [r10], xmm6
lea r11, [rsp + 0xe0]
cmovs r11, rax
test r8, r8
cmove r11, r8
mov rcx, qword [r15 + 0x18]
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
mov rdx, r12
mov r8, rbx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140168b0d
xorps xmm0, xmm0
lea rdi, [rsp + 0xa0]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
lea rdx, [rsp + 0xc0]
mov rcx, rdi
call fcn.140036510
mov rax, qword [rdi + 8]
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
mov rdx, qword [r15 + 0x20]
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x140168b1f
mov rdx, qword [rsp + 0xa8]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x100]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1402724c0]
movaps xmmword [rdi], xmm0
mov rcx, rdi
mov r8b, 1
xor r9d, r9d
call fcn.140046e10
cmp byte [rdi], 0
je 0x140168ab7
lea rdi, [rsp + 0x108]
mov rcx, rdi
call fcn.140046ee0
mov ebp, eax
cmp byte [rdi - 8], 0
je 0x1401686cf
mov rcx, rdi
call fcn.140013df0
test bpl, bpl
jne 0x140168ab7
mov rdi, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0xa0]
mov rdx, rdi
call fcn.140038b50
test al, al
je 0x140168ad7
lea rdx, [rdi + 8]
mov rcx, qword [rsp + 0xa8]
call fcn.140038b50
test al, al
je 0x140168ad7
mov eax, dword [rsp + 0xb0]
mov dword [rdi + 0x10], eax
mov eax, dword [rsp + 0xb4]
mov dword [rdi + 0x14], eax
mov rcx, qword [rsp + 0xa0]
call fcn.140046fd0
mov qword [r15 + 0x40], rax
test rax, rax
je 0x140168b29
lea rcx, [0x140000000]
cmp rax, rcx
jne 0x140168b4b
mov rsi, qword [rsp + 0xa0]
mov qword [rsp + 0xa0], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140168772
call fcn.1400e8860
mov qword [rsp + 0x100], rsi
mov rsi, qword [rsp + 0xa8]
mov qword [rsp + 0xa8], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14016879d
call fcn.1400e8860
lea rdx, [rsp + 0x100]
mov qword [rdx + 8], rsi
mov rax, qword [rsp + 0xb0]
mov qword [rdx + 0x10], rax
mov qword [rsp + 0xb0], 0
mov rcx, r15
call fcn.140036510
xor edi, edi
lea rcx, [rsp + 0xa0]
call fcn.140045820
cmp byte [rsp + 0xf7], 0
jns 0x1401687ef
mov rcx, qword [rsp + 0xe0]
call fcn.14018482c
test rbx, rbx
je 0x140168806
lea rcx, fcn.1400eef30
mov rdx, rbx
xor r8d, r8d
call fcn.1400eaf80
mov rbx, qword [r14]
mov qword [r14], 0
test rbx, rbx
je 0x140168825
mov rcx, rbx
call fcn.140046d40
mov rcx, rbx
call fcn.14018482c
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.1401874c0
mov eax, edi
movaps xmm6, xmmword [rsp + 0x120]
movaps xmm7, xmmword [rsp + 0x130]
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x1401685a0
lea r12, [rsp + 0x100]
lea rsi, str.SystemRoot
lea r15, str.CHROME_CRASHPAD_PIPE_NAME
lea r13, str.SystemDrive
mov rbp, qword [rsp + 0x78]
mov rbx, rbp
movaps xmmword [rsp + 0x100], xmm7
mov qword [rsp + 0x110], 0
xor edi, edi
nop word cs:[rax + rax]
test ax, ax
je 0x1401688cb
movzx eax, ax
cmp eax, 0x3d
je 0x1401688cb
movzx eax, word [rbx + rdi*2 + 2]
inc rdi
add rbp, 2
jmp 0x1401688b0
mov rcx, r12
mov rdx, rbx
mov r8, rdi
call fcn.140046c90
nop dword [rax]
inc rdi
cmp word [rbp], 0
lea rbp, [rbp + 2]
jne 0x1401688e0
movzx r14d, byte [rsp + 0x117]
test r14b, r14b
mov rax, r14
cmovs rax, qword [rsp + 0x108]
mov rdx, qword [rsp + 0x100]
mov rcx, r12
cmovs rcx, rdx
cmp rax, 4
jne 0x140168957
cmp word [rcx], 0x50
jne 0x140168957
test r14b, r14b
mov r8, r12
cmovs r8, rdx
cmp word [r8 + 2], 0x61
jne 0x140168957
test r14b, r14b
mov r8, r12
cmovs r8, rdx
cmp word [r8 + 4], 0x74
jne 0x140168957
test r14b, r14b
mov r8, r12
cmovs r8, rdx
cmp word [r8 + 6], 0x68
je 0x1401689b5
mov r8, rax
cmp rax, 0xa
je 0x140168991
cmp rax, 0xb
jne 0x1401689cd
xor r8d, r8d
mov r9, r13
movzx r10d, word [r9]
cmp r10w, word [rcx + r8*2]
jne 0x140168985
add r9, 2
inc r8
cmp rax, r8
jne 0x14016896c
jmp 0x1401689b5
mov r8d, 0xa
cmp rax, 0xa
jne 0x1401689cd
xor r9d, r9d
nop word cs:[rax + rax]
movzx r10d, word [r9 + rsi]
cmp r10w, word [rcx + r9]
jne 0x1401689cd
add r9, 2
dec r8
jne 0x1401689a0
lea rcx, [rsp + 0xc0]
mov rdx, rbx
mov r8, rdi
call fcn.14001f400
jmp 0x140168a6a
cmp rax, 4
jne 0x140168a0b
cmp word [rcx], 0x54
jne 0x140168a0b
test r14b, r14b
mov r8, r12
cmovs r8, rdx
cmp word [r8 + 2], 0x45
jne 0x140168a0b
test r14b, r14b
mov r8, r12
cmovs r8, rdx
cmp word [r8 + 4], 0x4d
jne 0x140168a0b
test r14b, r14b
cmovns rdx, r12
cmp word [rdx + 6], 0x50
je 0x1401689b5
cmp rax, 3
je 0x140168a8e
cmp rax, 0xc
je 0x140168a3a
cmp rax, 0x19
jne 0x140168a6a
xor edx, edx
nop
movzx r8d, word [rdx + r15]
cmp r8w, word [rcx + rdx]
jne 0x140168a6a
add rdx, 2
dec rax
jne 0x140168a20
jmp 0x1401689b5
xor edx, edx
lea r8, str.LOCALAPPDATA
movzx r9d, word [r8]
cmp r9w, word [rcx + rdx*2]
jne 0x140168a5f
add r8, 2
inc rdx
cmp rax, rdx
jne 0x140168a43
jmp 0x1401689b5
cmp rax, 0x19
mov eax, 0x19
je 0x140168a1d
test r14b, r14b
jns 0x140168a7c
mov rcx, qword [rsp + 0x100]
call fcn.14018482c
movzx eax, word [rbp]
test ax, ax
jne 0x140168889
jmp 0x140168528
xor edx, edx
lea r8, [0x140286766]
movzx r9d, word [r8]
cmp r9w, word [rcx + rdx*2]
jne 0x140168a11
add r8, 2
inc rdx
cmp rax, rdx
jne 0x140168a97
jmp 0x1401689b5
mov dword [rsi], 0x542
mov rcx, qword [rsp + 0xa0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, 0x15
jmp 0x1401687cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xa0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, 0x17
jmp 0x1401687cb
lea rcx, fcn.1400eef30
xor r8d, r8d
call fcn.1400eaf80
jmp 0x14016848a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov edi, 0x12
jmp 0x1401687d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
jmp 0x140168abd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xa0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, 0x2b
jmp 0x1401687cb
mov rcx, qword [rsp + 0xa0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, 0x41
jmp 0x1401687cb
mov edi, 0x46
mov r14, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
jmp 0x1401687ef