Function at 0x1400752c0
Capabilities:
Create process on windows
Query environment variable
Resume thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x3d8
movaps xmmword [rsp + 0x3c0], xmm6
mov r15, r8
mov r12, rdx
mov r13, rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x3b8], rax
lea rcx, [rsp + 0x220]
mov r8d, 0x190
mov dl, 0xaa
call fcn.140159120
cmp byte [r12 + 0x17], 0
mov rax, r12
jns 0x14007531a
mov rax, qword [r12]
xor ecx, ecx
movzx edx, word [rax + rcx*2]
mov word [rsp + rcx*2 + 0x220], dx
test dx, dx
je 0x140075343
inc rcx
cmp rcx, 0xc8
jne 0x14007531c
mov word [rsp + 0x3ae], 0
lea rcx, [rsp + 0x220]
call fcn.1400bf590
cmp byte [r15 + 0x21], 0
jne 0x140075a04
movabs rbx, 0xaaaaaaaaaaaaaaaa
mov bpl, byte [0x140354cd0]
xor esi, esi
test bpl, 0x19
je 0x1400753d5
lea rdi, [rsp + 0x110]
mov rcx, rdi
call fcn.1400e35f0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rdx, [0x140354cd0]
lea r8, str.LaunchProcess
mov cl, 0x58
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x78], r8
xor r9d, r9d
call fcn.1401bfdf0
mov qword [rsp + 0x70], rax
jmp 0x1400753e6
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
xor eax, eax
mov qword [rsp + 0x68], rax
lea rdi, [rsp + 0x1a0]
mov qword [rdi + 0x10], rbx
movaps xmm6, xmmword [0x1402fccc0]
movaps xmmword [rdi], xmm6
lea rdx, str.LaunchProcess
lea r8, str....._baseprocesslaunch_win.cc
lea rbx, [rsp + 0x110]
mov rcx, rbx
mov r9d, 0x121
call fcn.1400c6940
lea r8, [0x14036280c]
mov rcx, rdi
mov rdx, rbx
call fcn.140194d70
xorps xmm0, xmm0
movaps xmmword [rsp + 0x210], xmm0
mov dword [rsp + 0x18c], 0
movaps xmmword [rbx], xmm0
movaps xmmword [rbx + 0x60], xmm0
movaps xmmword [rbx + 0x50], xmm0
movaps xmmword [rbx + 0x40], xmm0
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x70], 0
mov dword [rbx + 8], 0x70
cmp byte [r15 + 0x7a], 0
je 0x140075487
call fcn.140137920
xor esi, esi
cmp eax, 0x10
setge sil
movzx eax, byte [r15 + 0x7b]
add esi, eax
mov rcx, qword [r15 + 0x28]
xor r8d, r8d
cmp rcx, qword [r15 + 0x30]
setne r8b
add r8d, esi
movzx edx, byte [r15 + 0x7c]
add edx, r8d
je 0x140075d1d
lea rcx, [rsp + 0x110]
call fcn.140076120
test al, al
je 0x140075957
mov al, byte [r15 + 0x7b]
mov esi, 0x80000
mov dword [rsp + 0x10c], 2
test al, al
jne 0x140075dab
cmp byte [r15 + 0x7a], 0
je 0x140075538
call fcn.140137920
cmp eax, 0x10
jl 0x140075538
or byte [rsp + 0x21b], 0x20
mov rcx, qword [rsp + 0x180]
test rcx, rcx
je 0x1400758f9
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], 0x10
lea r9, [rsp + 0x210]
mov r8d, 0x20007
xor edx, edx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x1400758f9
mov byte [rsp + 0x5f], bpl
mov qword [rsp + 0x60], r13
cmp byte [r15 + 0x7c], 0
jne 0x140075e48
cmp dword [r15 + 0x24], 1
sete bpl
mov r13, qword [r15 + 0x28]
mov r14, qword [r15 + 0x30]
cmp r13, r14
je 0x140075601
mov rax, r14
sub rax, r13
mov ecx, 0xfffffff8
cmp rax, rcx
ja 0x1400759b1
mov rbp, qword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea rdi, [0x140304344]
lea rbx, [rsp + 0x100]
mov rcx, qword [r13]
mov edx, 1
mov r8d, 1
call rbp
test eax, eax
je 0x140075d6a
add r13, 8
cmp r13, r14
jne 0x140075591
mov r9, qword [r15 + 0x28]
mov rax, qword [r15 + 0x30]
cmp rax, r9
je 0x140075d24
mov rcx, qword [rsp + 0x180]
test rcx, rcx
je 0x14007592c
sub eax, r9d
and eax, 0xfffffff8
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rax
mov r8d, 0x20002
xor edx, edx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
mov bpl, 1
test eax, eax
je 0x14007592c
cmp byte [r15 + 0x22], 0
jne 0x140075d27
cmp byte [r15 + 0x50], 0
jne 0x140075d34
mov eax, dword [rsp + 0x154]
mov ecx, eax
or ecx, 1
mov dword [rsp + 0x154], ecx
mov edx, dword [r15 + 0x40]
test edx, edx
jne 0x140075e06
xor ecx, ecx
cmp byte [r15 + 0x20], 0
sete cl
mov word [rsp + 0x158], cx
mov rcx, qword [r15 + 0x60]
mov rdx, qword [r15 + 0x68]
mov r8, qword [r15 + 0x70]
test rcx, rcx
jne 0x140075ccf
test rdx, rdx
jne 0x140075ccf
test r8, r8
jne 0x140075ccf
cmp byte [r15 + 0x78], 0
lea r14d, [rsi + 0x1000000]
cmove r14d, esi
xorps xmm0, xmm0
movaps xmmword [rsp + 0xe0], xmm0
mov qword [rsp + 0xf0], 0
movzx eax, byte [r15 + 0x1f]
test al, al
js 0x1400756a8
lea rsi, [r15 + 8]
and eax, 0x7f
jmp 0x1400756b0
mov rax, qword [r15 + 0x10]
mov rsi, qword [r15 + 8]
test rax, rax
cmove rsi, rax
movabs rbx, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xd0], rbx
movaps xmmword [rsp + 0xc0], xmm6
cmp byte [r12 + 0x17], 0
jns 0x140075992
mov rdx, qword [r12]
mov r8, qword [r12 + 8]
lea rcx, [rsp + 0xc0]
call fcn.1400ca766
cmp byte [r15 + 0x7d], 0
jne 0x140075d48
xor r12d, r12d
lea r13, [rsp + 0x118]
mov rdx, qword [r15 + 0x48]
test rdx, rdx
jne 0x140075c49
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1c0], xmm0
mov qword [rsp + 0x1d0], 0
mov al, byte [r15 + 0x98]
test al, al
jne 0x140075a80
cmp qword [r15 + 0x90], 0
jne 0x140075a80
xor eax, eax
movzx ecx, bpl
cmp byte [rsp + 0xd7], 0
js 0x140075764
lea rdx, [rsp + 0xc0]
jmp 0x14007576c
mov rdx, qword [rsp + 0xc0]
lea r8, [rsp + 0xe0]
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ecx
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140075a93
cmp byte [rsp + 0x1d7], 0
js 0x14007591a
mov r13, qword [rsp + 0x60]
mov bpl, byte [rsp + 0x5f]
xorps xmm0, xmm0
lea rcx, [rsp + 0xa0]
movaps xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
lea rdx, [rsp + 0xe0]
call fcn.140076b70
test r12, r12
je 0x1400757f2
cmp byte [r15 + 0x7d], 0
jne 0x1400759dc
mov rcx, qword [r15 + 0x58]
test rcx, rcx
jne 0x1400758de
cmp byte [r15 + 0x79], 0
jne 0x140075978
cmp byte [r15], 0
jne 0x140075eb8
mov dword [rsp + 0xb0], 0
mov rdi, qword [rsp + 0xa0]
mov qword [rsp + 0xa0], 0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140075842
call fcn.1400bcc80
mov rcx, r13
mov rdx, rdi
call fcn.140146f20
lea rcx, [rsp + 0xa0]
call fcn.140076060
cmp byte [rsp + 0xd7], 0
jns 0x140075871
mov rcx, qword [rsp + 0xc0]
call fcn.140153bcc
lea rcx, [rsp + 0x110]
call fcn.140076020
lea rcx, [rsp + 0x1a0]
call fcn.1400fafa0
test bpl, 0x19
je 0x1400758af
mov rax, qword [rsp + 0x68]
cmp byte [rax], 0
je 0x1400758af
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
call fcn.1401c7be0
mov rcx, qword [rsp + 0x3b8]
xor rcx, rsp
call fcn.140156fe0
mov rax, r13
movaps xmm6, xmmword [rsp + 0x3c0]
add rsp, 0x3d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x1400757ff
jmp 0x140075f25
mov qword [r13], 0
mov byte [r13 + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
jne 0x140075871
jmp 0x140075ff1
mov rcx, qword [rsp + 0x1c0]
call fcn.140153bcc
jmp 0x1400757b5
mov r13, qword [rsp + 0x60]
mov qword [r13], 0
mov byte [r13 + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
mov bpl, byte [rsp + 0x5f]
jne 0x140075871
jmp 0x140075ff4
mov qword [r13], 0
mov byte [r13 + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
jne 0x140075871
jmp 0x140075ff7
mov rcx, qword [rsp + 0xa0]
call fcn.14013f5e0
mov ecx, eax
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
jmp 0x14007580a
mov rax, qword [r12 + 0x10]
mov qword [rsp + 0xd0], rax
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0xc0], xmm0
jmp 0x1400756f3
mov r13, qword [rsp + 0x60]
mov qword [r13], 0
mov byte [r13 + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
mov bpl, byte [rsp + 0x5f]
jne 0x140075871
jmp 0x140075ffa
mov ecx, dword [rsp + 0xb0]
mov edx, 4
mov rax, r12
call qword [0x14037e008]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1400757f2
movzx eax, byte [r12 + 0x17]
test al, al
js 0x140075a13
and eax, 0x7f
jmp 0x140075a1c
mov rax, qword [r12 + 8]
mov r12, qword [r12]
mov bl, byte [r15]
mov dil, byte [r15 + 0x20]
mov qword [rsp + 0x190], r12
mov qword [rsp + 0x198], rax
test rax, rax
js 0x14007600f
test r12, r12
jne 0x140075a4a
test rax, rax
jne 0x140076012
lea r14, [rsp + 0x110]
lea rdx, [rsp + 0x190]
mov rcx, r14
call fcn.14014fa70
mov rcx, r13
mov rdx, r14
mov r8d, edi
mov r9d, ebx
call fcn.14023cfc0
mov rcx, r14
call fcn.14013fe20
jmp 0x1400758af
test al, al
jne 0x140075ad8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
jne 0x140075b52
mov rax, qword [rsp + 0x60]
mov qword [rax], 0
mov byte [rax + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x140076009
cmp byte [rsp + 0x1d7], 0
jns 0x140075ac9
mov rcx, qword [rsp + 0x1c0]
call fcn.140153bcc
mov r13, qword [rsp + 0x60]
mov bpl, byte [rsp + 0x5f]
jmp 0x14007585a
lea r8, [r15 + 0x80]
lea rdx, [0x1403102d6]
lea rcx, [rsp + 0x80]
call fcn.140255560
cmp byte [rsp + 0x1d7], 0
jns 0x140075b0a
mov rcx, qword [rsp + 0x1c0]
call fcn.140153bcc
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x1d0], rax
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x1c0], xmm0
cmp byte [rsp + 0x1d7], 0
js 0x140075b3e
lea rax, [rsp + 0x1c0]
jmp 0x140075b46
mov rax, qword [rsp + 0x1c0]
or r14d, 0x400
jmp 0x14007574c
mov rdi, rax
lea r8, [r15 + 0x80]
lea rcx, [rsp + 0x80]
mov rdx, rax
call fcn.140255560
cmp byte [rsp + 0x1d7], 0
jns 0x140075b83
mov rcx, qword [rsp + 0x1c0]
call fcn.140153bcc
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x1d0], rax
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x1c0], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140075b2a
movzx edx, bpl
cmp byte [rsp + 0xd7], 0
js 0x140075bc9
lea r8, [rsp + 0xc0]
jmp 0x140075bd1
mov r8, qword [rsp + 0xc0]
mov rcx, qword [r15 + 0x48]
lea r9, [rsp + 0xe0]
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], 0
xor edx, edx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
mov rcx, qword [rsp + 0x1c0]
call sub.USERENV.dll_DestroyEnvironmentBlock
test edi, edi
jne 0x1400757b5
mov rax, qword [rsp + 0x60]
mov qword [rax], 0
mov byte [rax + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
jne 0x140075ac9
jmp 0x14007600c
lea rcx, [rsp + 0x1c0]
mov qword [rcx], 0
xor r8d, r8d
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x140075c25
or r14d, 0x400
cmp byte [r15 + 0x7e], 0
mov rax, qword [rsp + 0x1c0]
je 0x140075bb1
cmp byte [rsp + 0xd7], 0
js 0x140075c92
lea r9, [rsp + 0xc0]
jmp 0x140075c9a
mov r9, qword [rsp + 0xc0]
mov rcx, qword [r15 + 0x48]
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
jmp 0x140075c0e
mov r9, qword [r15 + 0x28]
cmp r9, qword [r15 + 0x30]
jne 0x140075cf4
test rcx, rcx
je 0x140076000
test rdx, rdx
je 0x140076003
test r8, r8
je 0x140076006
or eax, 0x101
mov dword [rsp + 0x154], eax
mov qword [rsp + 0x168], rcx
mov qword [rsp + 0x170], rdx
mov qword [rsp + 0x178], r8
jmp 0x14007566f
xor esi, esi
jmp 0x1400754cc
int3
or byte [rsp + 0x154], 0x80
jmp 0x14007560c
lea rax, [0x140304342]
mov qword [rsp + 0x128], rax
jmp 0x140075617
call fcn.1402554f0
test rax, rax
jne 0x140075d5e
or r14d, 0x8000
jmp 0x1400756fe
mov r12, rax
or r14d, 4
jmp 0x140075701
lea rcx, [rsp + 0x1c0]
lea rdx, str.LaunchProcess
lea r8, str....._baseprocesslaunch_win.cc
mov r9d, 0x17c
call fcn.1400c6940
mov rcx, rbx
mov rdx, rdi
lea r8, [rsp + 0x1c0]
call fcn.140245db0
mov rcx, rbx
call fcn.140245e80
jmp 0x1400755aa
mov rcx, qword [rsp + 0x180]
test rcx, rcx
je 0x140075de7
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], 4
lea r9, [rsp + 0x10c]
mov r8d, 0x20012
xor edx, edx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x1400754df
mov qword [r13], 0
mov byte [r13 + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
jne 0x140075871
int3
mov cx, 0xa
add edx, 0xfffffffe
cmp edx, 3
ja case.default.0x140075e24
lea rcx, [0x1403102fc]
movsxd rdx, dword [rcx + rdx*4]
add rdx, rcx
jmp rdx
mov cx, 1
jmp case.default.0x140075e24
mov cx, 2
jmp case.default.0x140075e24
mov cx, 7
jmp case.default.0x140075e24
xor ecx, ecx
jmp case.default.0x140075e24
mov dword [rsp + 0x18c], 1
mov rcx, qword [rsp + 0x180]
test rcx, rcx
je 0x140075e8f
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], 4
lea r9, [rsp + 0x18c]
mov r8d, 0x2001c
xor edx, edx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x14007554d
mov r13, qword [rsp + 0x60]
mov qword [r13], 0
mov byte [r13 + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
mov bpl, byte [rsp + 0x5f]
jne 0x140075871
int3
lea rdi, [rsp + 0x1c0]
mov qword [rdi + 0x40], rbx
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.LaunchProcess
lea r8, str....._baseprocesslaunch_win.cc
lea rbx, [rsp + 0x80]
mov rcx, rbx
mov r9d, 0x21f
call fcn.1400c6940
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.140066fa0
mov rcx, qword [rsp + 0xa0]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call fcn.140067230
jmp 0x140075814
movaps xmmword [rsp + 0x1c0], xmm6
mov dword [rsp + 0xb0], 0
mov rdi, qword [rsp + 0xa0]
mov qword [rsp + 0xa0], 0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140075f5b
call fcn.1400bcc80
lea rbx, [rsp + 0x1c0]
mov rcx, rbx
mov rdx, rdi
call fcn.140146f20
mov rcx, rbx
mov edx, 1
mov r8b, 1
call fcn.14023ceb0
mov rax, qword [rsp + 0x60]
mov qword [rax], 0
mov byte [rax + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
je 0x140075ffd
mov rax, qword [rsp + 0x1c0]
inc rax
cmp rax, 2
jae 0x140075fb9
mov r13, qword [rsp + 0x60]
mov bpl, byte [rsp + 0x5f]
jmp 0x14007584d
call fcn.1400bcc80
mov rdi, qword [rsp + 0x1c0]
mov rcx, qword [0x140362b78]
test rcx, rcx
je 0x140075fe3
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [0x14037e008]
jmp 0x140075faa
call fcn.140053470
mov rcx, qword [0x140362b78]
jmp 0x140075fd2
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3