Function at 0x140089340
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
movaps xmmword [rsp + 0x130], xmm7
movaps xmmword [rsp + 0x120], xmm6
mov r15, r9
mov rdi, r8
mov r13, rdx
mov r12, rcx
mov rax, qword [0x14012f028]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rcx, rdx
call fcn.1400949b4
mov rdx, qword [r12 + 0x48]
mov qword [r12 + 0x48], rax
test rdx, rdx
jne 0x140089ae1
mov rbp, qword [r15]
mov rcx, rdi
call fcn.1400949b4
xor r14d, r14d
cmp qword [rbp + 0xa0], 0
mov rbx, rax
setne dil
xorps xmm6, xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0xd0], 0
mov r8, qword [r15]
cmp byte [r8 + 0x21], 0
je 0x140089465
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x140089a25
mov rsi, rax
xorps xmm7, xmm7
movaps xmmword [rsp + 0xa0], xmm7
mov qword [rsp + 0xb0], 0
movzx eax, word [rax]
test ax, ax
je 0x140089990
mov byte [rsp + 0x67], dil
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x88], r12
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x90], r15
lea r12, [rsp + 0x100]
mov rbp, rsi
lea rsi, [rsp + 0xe0]
lea r15, str.Path
lea rbx, str.Path
mov qword [rsp + 0x68], rbp
jmp 0x14008956a
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x140089694
movzx eax, ax
test eax, eax
je 0x14008948a
movzx eax, word [r13 + rdi*2 + 2]
inc rdi
add rbp, 2
cmp ax, 0x3d
jne 0x140089470
mov rcx, r12
mov rdx, r13
mov r8, rdi
call fcn.1400c7650
cmp byte [rsp + 0xf7], 0
js 0x140089a77
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xf0], rax
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xe0], xmm0
nop word cs:[rax + rax]
inc rdi
cmp word [rbp], 0
lea rbp, [rbp + 2]
jne 0x1400894d0
movzx eax, byte [rsp + 0xf7]
mov ecx, eax
and ecx, 0x7f
test al, al
cmovs rcx, qword [rsp + 0xe8]
mov r8, qword [rsp + 0xe0]
cmovns r8, rsi
test rcx, rcx
js 0x140089a89
test r8, r8
jne 0x140089519
test rcx, rcx
jne 0x140089ab5
mov rdx, r15
cmp qword [rdx + 8], rcx
je 0x140089588
add rdx, 0x10
cmp rdx, rbx
jne 0x14008951c
mov rdx, rbx
sub rdx, r15
test rdx, rdx
jle 0x140089a6e
cmp rdx, 0xc1
jae 0x140089a6b
cmp rdx, 0xc0
jne 0x1400895a9
test al, al
jns 0x140089561
mov rcx, qword [rsp + 0xe0]
call fcn.140093dd0
movzx eax, word [rbp]
test ax, ax
je 0x1400895c5
mov r13, rbp
movaps xmmword [rsp + 0xe0], xmm7
mov qword [rsp + 0xf0], 0
xor edi, edi
jmp 0x140089484
test rcx, rcx
je 0x14008952e
mov r9, qword [rdx]
xor r10d, r10d
movzx r11d, word [r9 + r10*2]
cmp r11w, word [r8 + r10*2]
jne 0x140089522
inc r10
cmp rcx, r10
jne 0x140089593
jmp 0x14008952e
lea rcx, [rsp + 0xa0]
mov rdx, r13
mov r8, rdi
call fcn.140020250
mov al, byte [rsp + 0xf7]
jmp 0x140089550
mov al, byte [rsp + 0xb7]
test al, al
mov r15, qword [rsp + 0x90]
mov r12, qword [rsp + 0x88]
jns 0x140089956
movabs rdi, 0x7fffffffffffffff
and rdi, qword [rsp + 0xb0]
dec rdi
mov rax, qword [rsp + 0xa8]
cmp rax, rdi
mov rbx, qword [rsp + 0x80]
mov r13, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
je 0x140089999
mov rcx, qword [rsp + 0xa0]
lea rdx, [rax + 1]
mov qword [rsp + 0xa8], rdx
mov dil, byte [rsp + 0x67]
mov dword [rcx + rax*2], 0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xc8], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov dl, byte [rsp + 0xd7]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov r8, qword [r15]
mov rsi, qword [rsp + 0x1b8]
mov r14b, dil
shl r14d, 0x13
or r14d, 0x40c
movzx r8d, byte [r8 + 0x20]
xor r9d, r9d
lea r10, [rsp + 0x100]
mov qword [r10 + 0x10], r9
add rbp, 0x38
mov r11d, edx
and r11b, 0x7f
test dl, dl
movzx edx, r11b
cmovs rdx, rcx
movaps xmmword [r10], xmm6
lea r11, [rsp + 0xc0]
cmovs r11, rax
test rdx, rdx
cmove r11, rdx
mov rcx, qword [r12 + 0x18]
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
mov rdx, r13
mov r8, rbx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140089a13
xorps xmm0, xmm0
lea rdi, [rsp + 0xe0]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
lea rdx, [rsp + 0x100]
mov rcx, rdi
call fcn.140013cd0
mov rax, qword [rdi + 8]
lea rcx, [rsp + 0x98]
mov qword [rcx], rax
mov rdx, qword [r12 + 0x20]
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
je 0x1400899e7
mov rdx, qword [rsp + 0xe8]
movaps xmm0, xmmword [0x140114ca0]
lea rdi, [rsp + 0xa0]
movaps xmmword [rdi], xmm0
mov rcx, rdi
mov r8b, 1
xor r9d, r9d
call fcn.140020330
cmp byte [rdi + 8], 0
je 0x1400899c7
lea r14, [rsp + 0xa0]
mov rcx, r14
call fcn.140020410
mov edi, eax
cmp byte [r14 + 8], 0
je 0x1400897c9
lea rcx, [rsp + 0xa0]
call fcn.140021e80
test dil, dil
jne 0x1400899c7
mov rdi, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0xe0]
mov rdx, rdi
call fcn.1400149f0
test al, al
je 0x1400899f1
lea rdx, [rdi + 8]
mov rcx, qword [rsp + 0xe8]
call fcn.1400149f0
test al, al
je 0x1400899f1
mov eax, dword [rsp + 0xf0]
mov dword [rdi + 0x10], eax
mov eax, dword [rsp + 0xf4]
mov dword [rdi + 0x14], eax
mov rcx, qword [rsp + 0xe0]
call fcn.140020600
mov qword [r12 + 0x40], rax
test rax, rax
je 0x140089a49
lea rcx, [0x140000000]
cmp rax, rcx
jne 0x140089a2f
mov rsi, qword [rsp + 0xe0]
mov qword [rsp + 0xe0], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x14008986d
call fcn.14005d0d0
mov qword [rsp + 0xa0], rsi
mov rsi, qword [rsp + 0xe8]
mov qword [rsp + 0xe8], 0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140089898
call fcn.14005d0d0
lea rdx, [rsp + 0xa0]
mov qword [rdx + 8], rsi
mov rax, qword [rsp + 0xf0]
mov qword [rdx + 0x10], rax
mov qword [rsp + 0xf0], 0
mov rcx, r12
call fcn.140013cd0
xor edi, edi
lea rcx, [rsp + 0xe0]
call fcn.14001e6e0
cmp byte [rsp + 0xd7], 0
jns 0x1400898ea
mov rcx, qword [rsp + 0xc0]
call fcn.140093dd0
test rbx, rbx
je 0x140089901
lea rcx, fcn.140062f70
mov rdx, rbx
xor r8d, r8d
call fcn.140064cd0
mov rbx, qword [r15]
mov qword [r15], 0
test rbx, rbx
je 0x140089920
mov rcx, rbx
call fcn.140020500
mov rcx, rbx
call fcn.140093dd0
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.140095f80
mov eax, edi
movaps xmm6, xmmword [rsp + 0x120]
movaps xmm7, xmmword [rsp + 0x130]
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp al, 0xa
mov rbx, qword [rsp + 0x80]
mov r13, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov dil, byte [rsp + 0x67]
mov rsi, qword [rsp + 0x68]
je 0x140089994
movzx eax, al
mov edx, eax
inc dl
and dl, 0x7f
lea rcx, [rsp + 0xa0]
mov byte [rcx + 0x17], dl
jmp 0x14008963a
xor eax, eax
jmp 0x140089976
mov edi, 0xa
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rdi
lea rcx, [rsp + 0xa0]
mov r8d, 1
mov rdx, rdi
mov r9, rdi
call fcn.140085300
mov rax, rdi
jmp 0x140089621
mov dword [rsi], 0x542
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, 0x15
jmp 0x1400898c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
jmp 0x1400899cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, 0x17
jmp 0x1400898c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov edi, 0x12
jmp 0x1400898d3
mov edi, 0x46
jmp 0x1400898ea
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, 0x41
jmp 0x1400898c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, 0x2b
jmp 0x1400898c6
int3
jns 0x1400895a9
int3
mov rcx, qword [rsp + 0xe0]
call fcn.140093dd0
jmp 0x1400894a6
lea rax, str.string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len___static_cast_size_type__numeric_limits_difference_type_::max___
mov r8d, 0x13a
call fcn.1400c7b30
lea rax, str.string_view::string_view__CharT___size_t_:_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len__0____s___nullptr
mov r8d, 0x13c
call fcn.1400c7b30
lea rcx, fcn.140062f70
xor r8d, r8d
call fcn.140064cd0
jmp 0x14008939c