Function at 0x140135800
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
movaps xmmword [rsp + 0x130], xmm7
movaps xmmword [rsp + 0x120], xmm6
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x140260028]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rcx, rdx
call fcn.140147794
mov rdx, qword [rbx + 0x48]
mov qword [rbx + 0x48], rax
test rdx, rdx
jne 0x140136154
mov r12, qword [r15]
mov rcx, rdi
call fcn.140147794
xor ebp, ebp
cmp qword [r12 + 0xa0], 0
mov rdi, rax
setne r9b
xorps xmm6, xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0xd0], 0
mov r8, qword [r15]
cmp byte [r8 + 0x21], 1
je 0x140135b5f
xor eax, eax
xor ecx, ecx
xor edx, edx
mov rsi, qword [rsp + 0x1b8]
mov bpl, r9b
shl ebp, 0x13
or ebp, 0x40c
movzx r8d, byte [r8 + 0x20]
xor r9d, r9d
lea r10, [rsp + 0x100]
mov qword [r10 + 0x10], r9
add r12, 0x38
test dl, dl
movzx edx, dl
cmovs rdx, rcx
movaps xmmword [r10], xmm6
lea r11, [rsp + 0xc0]
cmovs r11, rax
test rdx, rdx
cmove r11, rdx
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
mov rdx, r14
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140136168
xorps xmm0, xmm0
lea r14, [rsp + 0xe0]
movaps xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
lea rdx, [rsp + 0x100]
mov rcx, r14
call fcn.140048db0
mov rax, qword [r14 + 8]
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x140136108
mov rdx, qword [rsp + 0xe8]
movaps xmm0, xmmword [0x14022cb50]
lea r14, [rsp + 0xa0]
movaps xmmword [r14], xmm0
xor ebp, ebp
mov rcx, r14
mov r8b, 1
xor r9d, r9d
call fcn.1400418c0
mov al, byte [r14 + 8]
cmp al, 1
jne 0x1401359c0
lea r14, [rsp + 0xa0]
mov rcx, r14
call fcn.1400419a0
mov ebp, eax
xor bpl, 1
mov al, byte [r14 + 8]
test al, 1
je 0x1401359d1
lea rcx, [rsp + 0xa0]
call fcn.140036280
test bpl, bpl
je 0x140136112
mov r14, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0xe0]
mov rdx, r14
call fcn.140047010
test al, al
je 0x140136132
lea rdx, [r14 + 8]
mov rcx, qword [rsp + 0xe8]
call fcn.140047010
test al, al
je 0x140136132
mov eax, dword [rsp + 0xf0]
mov dword [r14 + 0x10], eax
mov eax, dword [rsp + 0xf4]
mov dword [r14 + 0x14], eax
mov rcx, qword [rsp + 0xe0]
call fcn.140041b90
mov qword [rbx + 0x40], rax
test rax, rax
je 0x14013619e
lea rcx, [0x140000000]
cmp rax, rcx
jne 0x140136184
mov rsi, qword [rsp + 0xe0]
mov qword [rsp + 0xe0], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140135a76
call fcn.1400bbc10
mov qword [rsp + 0xa0], rsi
mov rsi, qword [rsp + 0xe8]
mov qword [rsp + 0xe8], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140135aa1
call fcn.1400bbc10
lea rdx, [rsp + 0xa0]
mov qword [rdx + 8], rsi
mov rax, qword [rsp + 0xf0]
mov qword [rdx + 0x10], rax
mov qword [rsp + 0xf0], 0
mov rcx, rbx
call fcn.140048db0
xor ebx, ebx
lea rcx, [rsp + 0xe0]
call fcn.14003e320
cmp byte [rsp + 0xd7], 0
jns 0x140135af3
mov rcx, qword [rsp + 0xc0]
call fcn.140146640
test rdi, rdi
je 0x140135b0a
lea rcx, fcn.140002230
mov rdx, rdi
xor r8d, r8d
call fcn.140001050
mov rdi, qword [r15]
mov qword [r15], 0
test rdi, rdi
je 0x140135b29
mov rcx, rdi
call fcn.140041a90
mov rcx, rdi
call fcn.140146640
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.140149190
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x120]
movaps xmm7, xmmword [rsp + 0x130]
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov byte [rsp + 0x67], r9b
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x14013617a
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], r15
xorps xmm7, xmm7
movaps xmmword [rsp + 0xa0], xmm7
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0x68], rax
movzx eax, word [rax]
test ax, ax
je 0x140135bdb
movabs r12, 0x7ffffffffffffff7
lea r15, str.Path
lea rbx, str.Path
mov r13, qword [rsp + 0x68]
jmp 0x140135e7a
lea r12, [rsp + 0xa0]
mov rcx, r12
xor edx, edx
call fcn.14012f4c0
mov rax, qword [r12 + 0x10]
mov qword [rsp + 0xd0], rax
movaps xmm0, xmmword [r12]
movaps xmmword [rsp + 0xc0], xmm0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov dl, byte [rsp + 0xd7]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov r15, qword [rsp + 0x90]
mov r8, qword [r15]
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x70]
xor ebp, ebp
mov r9b, byte [rsp + 0x67]
jmp 0x1401358a2
xor r8d, r8d
lea r9, str.SystemDrive
movzx edx, word [r9]
cmp dx, word [rcx + r8*2]
jne 0x140135c89
add r9, 2
inc r8
xor edx, edx
cmp rax, r8
jne 0x140135c64
lea r8, str.SystemDrive
jmp 0x140135e2f
cmp rax, 0xa
jne 0x140135e02
jmp 0x1401360d3
mov byte [rsp + 0x117], dil
lea rbp, [rsp + 0x100]
jmp 0x140135d3a
movzx eax, ax
test eax, eax
je 0x140135cc7
movzx eax, word [r13 + rdi*2 + 2]
inc rdi
add r14, 0xfffffffffffffffe
cmp ax, 0x3d
jne 0x140135cad
test rdi, rdi
sete al
test r13, r13
setne cl
or cl, al
je 0x1401360e8
cmp rdi, r12
ja 0x1401360ef
cmp rdi, 0xa
jbe 0x140135c98
lea rax, [r12 + 5]
and rax, rdi
add rax, 4
mov rsi, rdi
or rsi, 3
cmp rsi, 0xb
cmove rsi, rax
inc rsi
js 0x1401360ea
lea rcx, [rsi + rsi]
call fcn.140146648
mov rbp, rax
mov qword [rsp + 0x100], rax
lea rax, [r12 + rsi]
add rax, 9
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x108], rdi
cmp rbp, r13
ja 0x140135d4e
mov rax, rbp
sub rax, r14
cmp rax, r13
ja 0x1401360e8
test rdi, rdi
je 0x140135d64
mov r8, r14
neg r8
mov rcx, rbp
mov rdx, r13
call fcn.14014ac10
mov word [rbp + rdi*2], 0
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xf0], rax
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xe0], xmm0
add r14, 0xfffffffffffffffe
cmp word [r13 + rdi*2], 0
lea rdi, [rdi + 1]
jne 0x140135d8b
movsx rax, byte [rsp + 0xf7]
test rax, rax
cmovs rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xe0]
lea rdx, [rsp + 0xe0]
cmovns rcx, rdx
test rax, rax
js 0x1401360e8
setne dl
test rcx, rcx
sete r8b
test dl, r8b
jne 0x1401360e8
cmp rax, 4
je 0x140135e98
cmp rax, 0xb
je 0x140135c5a
mov r8, rax
cmp rax, 0xa
je 0x140135ef8
cmp rax, 4
je 0x140135ec6
mov dl, 1
cmp rax, 3
je 0x140135f29
cmp rax, 0xc
je 0x140135f92
mov r8, rbx
cmp rax, 0x19
je 0x140135f5c
sub r8, r15
sar r8, 4
test r8, r8
jle 0x1401360ff
cmp r8, 8
jae 0x1401360fc
test dl, dl
je 0x140135fd3
cmp byte [rsp + 0xf7], 0
jns 0x140135e68
mov rcx, qword [rsp + 0xe0]
call fcn.140146640
movzx eax, word [r13 + rdi*2]
sub r13, r14
test ax, ax
je 0x140135bdb
movaps xmmword [rsp + 0xe0], xmm7
mov qword [rsp + 0xf0], 0
xor r14d, r14d
xor edi, edi
jmp 0x140135cc1
xor r8d, r8d
lea rdx, str.Path
movzx edx, word [r8 + rdx]
cmp dx, word [rcx + r8]
jne 0x140135deb
add r8, 2
xor edx, edx
cmp r8, 8
jne 0x140135e9b
mov r8, r15
jmp 0x140135e2f
xor r8d, r8d
lea rdx, str.TEMP
movzx edx, word [r8 + rdx]
cmp dx, word [rcx + r8]
jne 0x140135e0c
add r8, 2
xor edx, edx
cmp r8, 8
jne 0x140135ec9
lea r8, str.TEMP
jmp 0x140135e2f
xor r9d, r9d
lea rdx, str.SystemRoot
movzx edx, word [r9 + rdx]
cmp dx, word [rcx + r9]
jne 0x140135e02
add r9, 2
xor edx, edx
dec r8
jne 0x140135efb
lea r8, str.SystemRoot
jmp 0x140135e2f
xor r8d, r8d
lea r9, [0x140249c12]
movzx r10d, word [r9]
cmp r10w, word [rcx + r8*2]
jne 0x140135e18
add r9, 2
inc r8
cmp rax, r8
jne 0x140135f33
xor edx, edx
lea r8, [0x140249ba0]
jmp 0x140135e2f
xor r8d, r8d
lea rdx, str.CHROME_CRASHPAD_PIPE_NAME
movzx edx, word [r8 + rdx]
cmp dx, word [rcx + r8]
setne dl
jne 0x140135f8a
add r8, 2
dec rax
jne 0x140135f5f
lea r8, str.CHROME_CRASHPAD_PIPE_NAME
jmp 0x140135e2f
mov r8, rbx
jmp 0x140135e2f
xor r8d, r8d
lea r9, str.LOCALAPPDATA
movzx r10d, word [r9]
cmp r10w, word [rcx + r8*2]
jne 0x140135fc1
add r9, 2
inc r8
cmp rax, r8
jne 0x140135f9c
xor edx, edx
lea r8, str.VT__
jmp 0x140135e2f
mov r8, rbx
cmp rax, 0x19
jne 0x140135e2f
jmp 0x1401360de
test r13, r13
setne al
test rdi, rdi
sete cl
or cl, al
je 0x1401360e8
movsx rax, byte [rsp + 0xb7]
mov edx, 0xa
mov rbp, rax
test rax, rax
jns 0x140136015
lea rdx, [r12 + 8]
and rdx, qword [rsp + 0xb0]
dec rdx
mov rbp, qword [rsp + 0xa8]
mov rcx, rdx
sub rcx, rbp
cmp rcx, rdi
jb 0x14013608d
test rdi, rdi
je 0x140135e51
lea rsi, [rsp + 0xa0]
test al, al
jns 0x14013603d
mov rsi, qword [rsp + 0xa0]
test rdi, rdi
js 0x1401360e8
lea rcx, [rsi + rbp*2]
cmp rcx, r13
ja 0x14013605e
mov rax, rcx
sub rax, r14
cmp rax, r13
ja 0x1401360e8
mov r8, r14
neg r8
mov rdx, r13
call fcn.14014ac10
lea rax, [rdi + rbp]
cmp byte [rsp + 0xb7], 0
jns 0x1401360c3
mov qword [rsp + 0xa8], rax
mov word [rsi + rax*2], 0
jmp 0x140135e51
mov r8, rbp
sub r8, rdx
add r8, rdi
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0xa0]
mov r9, rbp
call fcn.14000afa0
jmp 0x140135e51
add ebp, edi
and bpl, 0x7f
mov byte [rsp + 0xb7], bpl
jmp 0x140136082
mov r8d, 0xa
jmp 0x140135ef8
mov eax, 0x19
jmp 0x140135f5c
ud2
call fcn.140187a10
lea rcx, [rsp + 0x100]
call fcn.1401879d0
int3
jns 0x140135e49
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
jmp 0x140136118
mov dword [rsi], 0x542
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x15
jmp 0x140135acf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x17
jmp 0x140135acf
lea rcx, fcn.140002230
xor r8d, r8d
call fcn.140001050
jmp 0x14013585a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov ebx, 0x12
jmp 0x140135adc
mov ebx, 0x46
jmp 0x140135af3
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x41
jmp 0x140135acf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x2b
jmp 0x140135acf