Function at 0x140092e60
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
movaps xmmword [rsp + 0x130], xmm7
movaps xmmword [rsp + 0x120], xmm6
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x14013b040]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rcx, rdx
call fcn.14009dee4
mov rdx, qword [rbx + 0x48]
mov qword [rbx + 0x48], rax
test rdx, rdx
jne 0x14009359a
mov r13, qword [r15]
mov rcx, rdi
call fcn.14009dee4
xor ebp, ebp
cmp qword [r13 + 0xa0], 0
mov rdi, rax
setne r12b
xorps xmm6, xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0xd0], 0
mov r8, qword [r15]
cmp byte [r8 + 0x21], 1
je 0x1400931be
xor eax, eax
xor ecx, ecx
xor edx, edx
mov rsi, qword [rsp + 0x1b8]
mov bpl, r12b
shl ebp, 0x13
or ebp, 0x40c
movzx r8d, byte [r8 + 0x20]
xor r9d, r9d
lea r10, [rsp + 0x100]
mov qword [r10 + 0x10], r9
add r13, 0x38
test dl, dl
movzx edx, dl
cmovs rdx, rcx
movaps xmmword [r10], xmm6
lea r11, [rsp + 0xc0]
cmovs r11, rax
test rdx, rdx
cmove r11, rdx
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
mov rdx, r14
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1400935ae
xorps xmm0, xmm0
lea r14, [rsp + 0xe0]
movaps xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
lea rdx, [rsp + 0x100]
mov rcx, r14
call fcn.140029a10
mov rax, qword [r14 + 8]
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x14009354e
mov rdx, qword [rsp + 0xe8]
movaps xmm0, xmmword [0x14011c0c0]
lea r14, [rsp + 0xa0]
movaps xmmword [r14], xmm0
xor ebp, ebp
mov rcx, r14
mov r8b, 1
xor r9d, r9d
call fcn.14001df60
mov al, byte [r14 + 8]
cmp al, 1
jne 0x14009301f
lea r14, [rsp + 0xa0]
mov rcx, r14
call fcn.14001e040
mov ebp, eax
xor bpl, 1
mov al, byte [r14 + 8]
test al, 1
je 0x140093030
lea rcx, [rsp + 0xa0]
call fcn.14001fcf0
test bpl, bpl
je 0x140093558
mov r14, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0xe0]
mov rdx, r14
call fcn.140028360
test al, al
je 0x140093578
lea rdx, [r14 + 8]
mov rcx, qword [rsp + 0xe8]
call fcn.140028360
test al, al
je 0x140093578
mov eax, dword [rsp + 0xf0]
mov dword [r14 + 0x10], eax
mov eax, dword [rsp + 0xf4]
mov dword [r14 + 0x14], eax
mov rcx, qword [rsp + 0xe0]
call fcn.14001e240
mov qword [rbx + 0x40], rax
test rax, rax
je 0x1400935e4
lea rcx, [0x140000000]
cmp rax, rcx
jne 0x1400935ca
mov rsi, qword [rsp + 0xe0]
mov qword [rsp + 0xe0], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400930d5
call fcn.140057820
mov qword [rsp + 0xa0], rsi
mov rsi, qword [rsp + 0xe8]
mov qword [rsp + 0xe8], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140093100
call fcn.140057820
lea rdx, [rsp + 0xa0]
mov qword [rdx + 8], rsi
mov rax, qword [rsp + 0xf0]
mov qword [rdx + 0x10], rax
mov qword [rsp + 0xf0], 0
mov rcx, rbx
call fcn.140029a10
xor ebx, ebx
lea rcx, [rsp + 0xe0]
call fcn.14001c8a0
cmp byte [rsp + 0xd7], 0
jns 0x140093152
mov rcx, qword [rsp + 0xc0]
call fcn.14009d26c
test rdi, rdi
je 0x140093169
lea rcx, fcn.140067cf0
mov rdx, rdi
xor r8d, r8d
call fcn.140066550
mov rdi, qword [r15]
mov qword [r15], 0
test rdi, rdi
je 0x140093188
mov rcx, rdi
call fcn.14001e130
mov rcx, rdi
call fcn.14009d26c
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.14009f1f0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x120]
movaps xmm7, xmmword [rsp + 0x130]
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x1400935c0
mov rsi, rax
xorps xmm7, xmm7
movaps xmmword [rsp + 0xa0], xmm7
mov qword [rsp + 0xb0], 0
movzx eax, word [rax]
test ax, ax
je 0x14009323f
mov byte [rsp + 0x67], r12b
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], r15
lea r12, [rsp + 0x100]
mov rbp, rsi
lea rsi, str.Path
lea rbx, str.Path
mov r15d, 0xd0
mov qword [rsp + 0x68], rbp
jmp 0x14009346c
xor eax, eax
jmp 0x14009327c
cmp al, 0xa
mov r15, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r14, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov ebp, 0
mov r12b, byte [rsp + 0x67]
mov rsi, qword [rsp + 0x68]
je 0x1400934d6
movzx eax, al
mov edx, eax
inc dl
and dl, 0x7f
lea rcx, [rsp + 0xa0]
mov byte [rcx + 0x17], dl
jmp 0x140093309
mov al, byte [rsp + 0xb7]
test al, al
jns 0x140093243
movabs r12, 0x7fffffffffffffff
and r12, qword [rsp + 0xb0]
dec r12
mov rax, qword [rsp + 0xa8]
cmp rax, r12
mov r15, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r14, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov ebp, 0
mov rsi, qword [rsp + 0x68]
je 0x1400934dc
mov rcx, qword [rsp + 0xa0]
lea rdx, [rax + 1]
mov qword [rsp + 0xa8], rdx
mov r12b, byte [rsp + 0x67]
mov dword [rcx + rax*2], 0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xc8], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov dl, byte [rsp + 0xd7]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov r8, qword [r15]
jmp 0x140092f01
movzx eax, ax
test eax, eax
je 0x140093382
movzx eax, word [rdi + r13*2 + 2]
inc r13
add rbp, 2
cmp ax, 0x3d
jne 0x140093368
mov rcx, r12
mov rdx, rdi
mov r8, r13
call fcn.14001de60
cmp byte [rsp + 0xf7], 0
js 0x140093529
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xf0], rax
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xe0], xmm0
inc r13
cmp word [rbp], 0
lea rbp, [rbp + 2]
jne 0x1400933be
movsx rax, byte [rsp + 0xf7]
test rax, rax
mov rcx, qword [rsp + 0xe8]
cmovns rcx, rax
mov rdx, qword [rsp + 0xe0]
lea r8, [rsp + 0xe0]
cmovns rdx, r8
test rcx, rcx
js 0x140093516
setne r8b
test rdx, rdx
sete r9b
test r8b, r9b
jne 0x14009353b
xor r9d, r9d
cmp qword [r9 + rsi + 8], rcx
je 0x14009348b
add r9, 0x10
cmp r9, r15
jne 0x140093418
lea r8, [rsi + r15]
mov rcx, r8
sub rcx, rsi
sar rcx, 4
test rcx, rcx
jle 0x14009350d
cmp rcx, 0xe
jae 0x14009350a
cmp r8, rbx
jne 0x1400934b7
test al, al
jns 0x14009345f
mov rcx, qword [rsp + 0xe0]
call fcn.14009d26c
movzx eax, word [rbp]
test ax, ax
je 0x140093293
mov rdi, rbp
movaps xmmword [rsp + 0xe0], xmm7
mov qword [rsp + 0xf0], 0
xor r13d, r13d
jmp 0x14009337c
lea r8, [rsi + r9]
test rcx, rcx
je 0x14009342c
mov r10, qword [r8]
xor r11d, r11d
movzx r14d, word [r10 + r11*2]
cmp r14w, word [rdx + r11*2]
jne 0x14009341f
inc r11
cmp rcx, r11
jne 0x14009349a
jmp 0x14009342c
lea rcx, [rsp + 0xa0]
mov rdx, rdi
mov r8, r13
call fcn.140093610
mov al, byte [rsp + 0xf7]
jmp 0x14009344e
mov r12d, 0xa
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], r12
lea rcx, [rsp + 0xa0]
mov r8d, 1
mov rdx, r12
mov r9, r12
call fcn.140091100
mov rax, r12
jmp 0x1400932f0
int3
jns 0x140093449
int3
lea rcx, [0x14011c264]
lea rdx, str....._third_partylibc_srcinclude_string_view:318:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
call fcn.1400d1300
mov rcx, qword [rsp + 0xe0]
call fcn.14009d26c
jmp 0x14009339e
lea rcx, [0x14011c264]
lea rdx, str....._third_partylibc_srcinclude_string_view:320:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
call fcn.1400d1300
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
jmp 0x14009355e
mov dword [rsi], 0x542
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x15
jmp 0x14009312e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x17
jmp 0x14009312e
lea rcx, fcn.140067cf0
xor r8d, r8d
call fcn.140066550
jmp 0x140092eba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov ebx, 0x12
jmp 0x14009313b
mov ebx, 0x46
jmp 0x140093152
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x41
jmp 0x14009312e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x2b
jmp 0x14009312e