Function at 0x14008cf10
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
movaps xmmword [rsp + 0x130], xmm7
movaps xmmword [rsp + 0x120], xmm6
mov r15, r9
mov rdi, r8
mov r13, rdx
mov r12, rcx
mov rax, qword [0x140131028]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rcx, rdx
call fcn.1400956a0
mov rdx, qword [r12 + 0x48]
mov qword [r12 + 0x48], rax
test rdx, rdx
jne 0x14008d6bc
mov rbp, qword [r15]
mov rcx, rdi
call fcn.1400956a0
xor r14d, r14d
cmp qword [rbp + 0xa0], 0
mov rbx, rax
setne dil
xorps xmm6, xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0xd0], 0
mov rdx, qword [r15]
cmp byte [rdx + 0x21], 0
je 0x14008d034
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x14008d600
mov rsi, rax
xorps xmm7, xmm7
movaps xmmword [rsp + 0xa0], xmm7
mov qword [rsp + 0xb0], 0
movzx eax, word [rax]
test ax, ax
je 0x14008d56b
mov byte [rsp + 0x67], dil
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], r15
lea r12, [rsp + 0x100]
mov rbp, rsi
lea rsi, [rsp + 0xe0]
lea r15, str.Path
lea rbx, str.Path
mov qword [rsp + 0x68], rbp
jmp 0x14008d130
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x14008d259
movzx eax, ax
test eax, eax
je 0x14008d05a
movzx eax, word [r13 + rdi*2 + 2]
inc rdi
add rbp, 2
cmp ax, 0x3d
jne 0x14008d040
mov rcx, r12
mov rdx, r13
mov r8, rdi
call fcn.140020da0
cmp byte [rsp + 0xf7], 0
js 0x14008d652
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xf0], rax
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xe0], xmm0
inc rdi
cmp word [rbp], 0
lea rbp, [rbp + 2]
jne 0x14008d096
movzx eax, byte [rsp + 0xf7]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs rcx, qword [rsp + 0xe8]
mov r8, qword [rsp + 0xe0]
cmovns r8, rsi
test rcx, rcx
js 0x14008d664
test r8, r8
jne 0x14008d0df
test rcx, rcx
jne 0x14008d690
mov rdx, r15
cmp qword [rdx + 8], rcx
je 0x14008d14e
add rdx, 0x10
cmp rdx, rbx
jne 0x14008d0e2
mov rdx, rbx
sub rdx, r15
test rdx, rdx
jle 0x14008d649
cmp rdx, 0xc1
jae 0x14008d646
cmp rdx, 0xc0
jne 0x14008d16f
test al, al
jns 0x14008d127
mov rcx, qword [rsp + 0xe0]
call fcn.140094ae4
movzx eax, word [rbp]
test ax, ax
je 0x14008d18b
mov r13, rbp
movaps xmmword [rsp + 0xe0], xmm7
mov qword [rsp + 0xf0], 0
xor edi, edi
jmp 0x14008d054
test rcx, rcx
je 0x14008d0f4
mov r9, qword [rdx]
xor r10d, r10d
movzx r11d, word [r9 + r10*2]
cmp r11w, word [r8 + r10*2]
jne 0x14008d0e8
inc r10
cmp rcx, r10
jne 0x14008d159
jmp 0x14008d0f4
lea rcx, [rsp + 0xa0]
mov rdx, r13
mov r8, rdi
call fcn.140020eb0
mov al, byte [rsp + 0xf7]
jmp 0x14008d116
mov al, byte [rsp + 0xb7]
test al, al
jns 0x14008d521
movabs rdi, 0x7fffffffffffffff
and rdi, qword [rsp + 0xb0]
dec rdi
mov rax, qword [rsp + 0xa8]
cmp rax, rdi
mov r15, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
mov r13, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
je 0x14008d574
mov rcx, qword [rsp + 0xa0]
lea rdx, [rax + 1]
mov qword [rsp + 0xa8], rdx
mov dil, byte [rsp + 0x67]
mov dword [rcx + rax*2], 0
cmp byte [rsp + 0xd7], 0
js 0x14008d6d0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xd0], rax
movaps xmm0, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0xc0], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rdx, qword [r15]
mov r8b, byte [rsp + 0xd7]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0x1b8]
mov r14b, dil
shl r14d, 0x13
or r14d, 0x40c
movzx edx, byte [rdx + 0x20]
xor r9d, r9d
lea r10, [rsp + 0xe0]
mov qword [r10 + 0x10], r9
add rbp, 0x38
mov r11d, r8d
and r11b, 0x7f
test r8b, r8b
movzx r8d, r11b
cmovs r8, rcx
movaps xmmword [r10], xmm6
lea r11, [rsp + 0xc0]
cmovs r11, rax
test r8, r8
cmove r11, r8
mov rcx, qword [r12 + 0x18]
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
mov rdx, r13
mov r8, rbx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x14008d5ee
xorps xmm0, xmm0
lea rdi, [rsp + 0xa0]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
lea rdx, [rsp + 0xe0]
mov rcx, rdi
call fcn.1400157d0
mov rax, qword [rdi + 8]
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
mov rdx, qword [r12 + 0x20]
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x14008d5c2
mov rdx, qword [rsp + 0xa8]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x100]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x140115d80]
movaps xmmword [rdi], xmm0
mov rcx, rdi
mov r8b, 1
xor r9d, r9d
call fcn.140020f90
cmp byte [rdi], 0
je 0x14008d5a2
lea rdi, [rsp + 0x108]
mov rcx, rdi
call fcn.140021060
mov ebp, eax
cmp byte [rdi - 8], 0
je 0x14008d394
mov rcx, rdi
call fcn.140022ab0
test bpl, bpl
jne 0x14008d5a2
mov rdi, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0xa0]
mov rdx, rdi
call fcn.140015b50
test al, al
je 0x14008d5cc
lea rdx, [rdi + 8]
mov rcx, qword [rsp + 0xa8]
call fcn.140015b50
test al, al
je 0x14008d5cc
mov eax, dword [rsp + 0xb0]
mov dword [rdi + 0x10], eax
mov eax, dword [rsp + 0xb4]
mov dword [rdi + 0x14], eax
mov rcx, qword [rsp + 0xa0]
call fcn.140021250
mov qword [r12 + 0x40], rax
test rax, rax
je 0x14008d624
lea rcx, [0x140000000]
cmp rax, rcx
jne 0x14008d60a
mov rsi, qword [rsp + 0xa0]
mov qword [rsp + 0xa0], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14008d438
call fcn.1400604b0
mov qword [rsp + 0x100], rsi
mov rsi, qword [rsp + 0xa8]
mov qword [rsp + 0xa8], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14008d463
call fcn.1400604b0
lea rdx, [rsp + 0x100]
mov qword [rdx + 8], rsi
mov rax, qword [rsp + 0xb0]
mov qword [rdx + 0x10], rax
mov qword [rsp + 0xb0], 0
mov rcx, r12
call fcn.1400157d0
xor edi, edi
lea rcx, [rsp + 0xa0]
call fcn.14001f790
cmp byte [rsp + 0xd7], 0
jns 0x14008d4b5
mov rcx, qword [rsp + 0xc0]
call fcn.140094ae4
test rbx, rbx
je 0x14008d4cc
lea rcx, fcn.140066790
mov rdx, rbx
xor r8d, r8d
call fcn.140068d10
mov rbx, qword [r15]
mov qword [r15], 0
test rbx, rbx
je 0x14008d4eb
mov rcx, rbx
call fcn.140021150
mov rcx, rbx
call fcn.140094ae4
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.140096c60
mov eax, edi
movaps xmm6, xmmword [rsp + 0x120]
movaps xmm7, xmmword [rsp + 0x130]
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp al, 0xa
mov r15, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
mov r13, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov dil, byte [rsp + 0x67]
mov rsi, qword [rsp + 0x68]
je 0x14008d56f
movzx eax, al
mov edx, eax
inc dl
and dl, 0x7f
lea rcx, [rsp + 0xa0]
mov byte [rcx + 0x17], dl
jmp 0x14008d200
xor eax, eax
jmp 0x14008d551
mov edi, 0xa
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rdi
lea rcx, [rsp + 0xa0]
mov r8d, 1
mov rdx, rdi
mov r9, rdi
call fcn.140013370
mov rax, rdi
jmp 0x14008d1e7
mov dword [rsi], 0x542
mov rcx, qword [rsp + 0xa0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, 0x15
jmp 0x14008d491
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
jmp 0x14008d5a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xa0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, 0x17
jmp 0x14008d491
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov edi, 0x12
jmp 0x14008d49e
mov edi, 0x46
jmp 0x14008d4b5
mov rcx, qword [rsp + 0xa0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, 0x41
jmp 0x14008d491
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xa0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, 0x2b
jmp 0x14008d491
int3
jns 0x14008d16f
int3
mov rcx, qword [rsp + 0xe0]
call fcn.140094ae4
jmp 0x14008d076
lea rax, str.string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len___static_cast_size_type__numeric_limits_difference_type_::max___
mov r8d, 0x13a
call fcn.1400c85f0
lea rax, str.string_view::string_view__CharT___size_t_:_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len__0____s___nullptr
mov r8d, 0x13c
call fcn.1400c85f0
lea rcx, fcn.140066790
xor r8d, r8d
call fcn.140068d10
jmp 0x14008cf6c
mov rcx, qword [rsp + 0xc0]
call fcn.140094ae4
jmp 0x14008d215