Function at 0x140094d90
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
movaps xmmword [rsp + 0x130], xmm7
movaps xmmword [rsp + 0x120], xmm6
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x14013b028]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rcx, rdx
call fcn.1400a095c
mov rdx, qword [rbx + 0x48]
mov qword [rbx + 0x48], rax
test rdx, rdx
jne 0x1400954f3
mov r13, qword [r15]
mov rcx, rdi
call fcn.1400a095c
xor ebp, ebp
cmp qword [r13 + 0xa0], 0
mov rdi, rax
setne r12b
xorps xmm6, xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0xd0], 0
mov r8, qword [r15]
cmp byte [r8 + 0x21], 0
je 0x140094eb0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x1400954e6
mov rsi, rax
xorps xmm7, xmm7
movaps xmmword [rsp + 0xa0], xmm7
mov qword [rsp + 0xb0], 0
movzx eax, word [rax]
test ax, ax
je 0x1400953f2
mov byte [rsp + 0x67], r12b
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x90], r15
lea r12, [rsp + 0x100]
mov rbp, rsi
lea rsi, [rsp + 0xe0]
lea r15, str.Path
mov ebx, 0xc0
mov qword [rsp + 0x68], rbp
jmp 0x140095382
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x140094fcb
cmp al, 0xa
mov rdi, qword [rsp + 0x80]
mov r14, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov ebp, 0
mov r12b, byte [rsp + 0x67]
mov rsi, qword [rsp + 0x68]
je 0x1400953f9
movzx eax, al
mov edx, eax
inc dl
and dl, 0x7f
lea rcx, [rsp + 0xa0]
mov byte [rcx + 0x17], dl
jmp 0x140094f71
mov al, byte [rsp + 0xb7]
test al, al
mov r15, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x88]
jns 0x140094ebb
movabs r12, 0x7fffffffffffffff
and r12, qword [rsp + 0xb0]
dec r12
mov rax, qword [rsp + 0xa8]
cmp rax, r12
mov rdi, qword [rsp + 0x80]
mov r14, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov ebp, 0
mov rsi, qword [rsp + 0x68]
je 0x1400953ff
mov rcx, qword [rsp + 0xa0]
lea rdx, [rax + 1]
mov qword [rsp + 0xa8], rdx
mov r12b, byte [rsp + 0x67]
mov dword [rcx + rax*2], 0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xc8], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov dl, byte [rsp + 0xd7]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov r8, qword [r15]
mov rsi, qword [rsp + 0x1b8]
mov bpl, r12b
shl ebp, 0x13
or ebp, 0x40c
movzx r8d, byte [r8 + 0x20]
xor r9d, r9d
lea r10, [rsp + 0x100]
mov qword [r10 + 0x10], r9
add r13, 0x38
mov r11d, edx
and r11b, 0x7f
test dl, dl
movzx edx, r11b
cmovs rdx, rcx
movaps xmmword [r10], xmm6
lea r11, [rsp + 0xc0]
cmovs r11, rax
test rdx, rdx
cmove r11, rdx
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
mov rdx, r14
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140095507
xorps xmm0, xmm0
lea r14, [rsp + 0xe0]
movaps xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
lea rdx, [rsp + 0x100]
mov rcx, r14
call fcn.14001ade0
mov rax, qword [r14 + 8]
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x14009549a
mov rdx, qword [rsp + 0xe8]
movaps xmm0, xmmword [0x14011bb10]
lea r14, [rsp + 0xa0]
movaps xmmword [r14], xmm0
mov rcx, r14
mov r8b, 1
xor r9d, r9d
call fcn.140022ad0
cmp byte [r14 + 8], 0
je 0x1400954a4
lea r14, [rsp + 0xa0]
mov rcx, r14
call fcn.140022bb0
mov ebp, eax
cmp byte [r14 + 8], 0
je 0x1400950fe
lea rcx, [rsp + 0xa0]
call fcn.140024010
test bpl, bpl
jne 0x1400954a4
mov r14, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0xe0]
mov rdx, r14
call fcn.14001c590
test al, al
je 0x1400954c4
lea rdx, [r14 + 8]
mov rcx, qword [rsp + 0xe8]
call fcn.14001c590
test al, al
je 0x1400954c4
mov eax, dword [rsp + 0xf0]
mov dword [r14 + 0x10], eax
mov eax, dword [rsp + 0xf4]
mov dword [r14 + 0x14], eax
mov rcx, qword [rsp + 0xe0]
call fcn.140022da0
mov qword [rbx + 0x40], rax
test rax, rax
je 0x140095533
lea rcx, [0x140000000]
cmp rax, rcx
jne 0x140095519
mov rsi, qword [rsp + 0xe0]
mov qword [rsp + 0xe0], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400951a3
call fcn.140069530
mov qword [rsp + 0xa0], rsi
mov rsi, qword [rsp + 0xe8]
mov qword [rsp + 0xe8], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400951ce
call fcn.140069530
lea rdx, [rsp + 0xa0]
mov qword [rdx + 8], rsi
mov rax, qword [rsp + 0xf0]
mov qword [rdx + 0x10], rax
mov qword [rsp + 0xf0], 0
mov rcx, rbx
call fcn.14001ade0
xor ebx, ebx
lea rcx, [rsp + 0xe0]
call fcn.140020d20
cmp byte [rsp + 0xd7], 0
jns 0x140095220
mov rcx, qword [rsp + 0xc0]
call fcn.14009fde8
test rdi, rdi
je 0x140095237
lea rcx, fcn.14005e720
mov rdx, rdi
xor r8d, r8d
call fcn.1400648c0
mov rdi, qword [r15]
mov qword [r15], 0
test rdi, rdi
je 0x140095256
mov rcx, rdi
call fcn.140022ca0
mov rcx, rdi
call fcn.14009fde8
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.1400a1ff0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x120]
movaps xmm7, xmmword [rsp + 0x130]
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx eax, ax
test eax, eax
je 0x1400952a6
movzx eax, word [r14 + r13*2 + 2]
inc r13
add rbp, 2
cmp ax, 0x3d
jne 0x14009528c
mov rcx, r12
mov rdx, r14
mov r8, r13
call fcn.1400d47b0
cmp byte [rsp + 0xf7], 0
js 0x140095430
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xf0], rax
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xe0], xmm0
inc r13
cmp word [rbp], 0
lea rbp, [rbp + 2]
jne 0x1400952e2
movzx eax, byte [rsp + 0xf7]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs rcx, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0xe0]
cmovns rdx, rsi
test rcx, rcx
js 0x140095442
test rdx, rdx
jne 0x14009532b
test rcx, rcx
jne 0x14009546e
xor r9d, r9d
cmp qword [r9 + r15 + 8], rcx
je 0x1400953a1
add r9, 0x10
cmp r9, rbx
jne 0x14009532e
lea r8, [r15 + rbx]
sub r8, r15
mov rcx, r8
sar rcx, 4
test rcx, rcx
jle 0x1400953cd
cmp rcx, 0xd
jae 0x14009542d
cmp r8, 0xc0
jne 0x1400953d3
test al, al
jns 0x140095375
mov rcx, qword [rsp + 0xe0]
call fcn.14009fde8
movzx eax, word [rbp]
test ax, ax
je 0x140094efb
mov r14, rbp
movaps xmmword [rsp + 0xe0], xmm7
mov qword [rsp + 0xf0], 0
xor r13d, r13d
jmp 0x1400952a0
lea r8, [r15 + r9]
test rcx, rcx
je 0x140095342
mov r10, qword [r8]
xor r11d, r11d
movzx edi, word [r10 + r11*2]
cmp di, word [rdx + r11*2]
jne 0x140095335
inc r11
cmp rcx, r11
jne 0x1400953b0
jmp 0x140095342
js 0x1400954f0
lea rcx, [rsp + 0xa0]
mov rdx, r14
mov r8, r13
call fcn.1400229f0
mov al, byte [rsp + 0xf7]
jmp 0x140095364
xor eax, eax
jmp 0x140094ee4
mov r12d, 0xa
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], r12
lea rcx, [rsp + 0xa0]
mov r8d, 1
mov rdx, r12
mov r9, r12
call fcn.140090440
mov rax, r12
jmp 0x140094f58
int3
mov rcx, qword [rsp + 0xe0]
call fcn.14009fde8
jmp 0x1400952c2
lea rax, str.string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len___static_cast_size_type__numeric_limits_difference_type_::max___
mov r8d, 0x13a
call fcn.1400d6560
lea rax, str.string_view::string_view__CharT___size_t_:_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len__0____s___nullptr
mov r8d, 0x13c
call fcn.1400d6560
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
jmp 0x1400954aa
mov dword [rsi], 0x542
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x15
jmp 0x1400951fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x17
jmp 0x1400951fc
mov ebx, 0x46
jmp 0x140095220
int3
lea rcx, fcn.14005e720
xor r8d, r8d
call fcn.1400648c0
jmp 0x140094dea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov ebx, 0x12
jmp 0x140095209
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x41
jmp 0x1400951fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x2b
jmp 0x1400951fc