Function at 0x140001000
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov eax, 0x21b8
call fcn.140028090
sub rsp, rax
mov rax, qword [0x140051008]
xor rax, rsp
mov qword [rsp + 0x21a0], rax
call fcn.140006280
test eax, eax
jne 0x140001045
mov eax, 1
mov rcx, qword [rsp + 0x21a0]
xor rcx, rsp
call fcn.1400022c0
add rsp, 0x21b8
ret
mov qword [rsp + 0x21d0], rsi
mov qword [rsp + 0x21d8], rdi
mov qword [rsp + 0x21b0], r14
call fcn.140005420
mov rcx, rax
call fcn.140005460
xor edx, edx
mov ecx, 0x20004
mov rsi, rax
call fcn.140005c00
mov edx, 3
mov ecx, 0x22002
call fcn.140005c00
mov edx, 3
mov ecx, 0x22003
call fcn.140005c00
mov edx, dword [rsi + 8]
mov ecx, 0x21001
call fcn.140005c00
mov edx, dword [rsi + 0xc]
mov ecx, 0x21002
call fcn.140005c00
mov edx, dword [rsi + 0x10]
mov ecx, 0x21003
call fcn.140005c00
mov edx, 8
mov ecx, 0x21004
call fcn.140005c00
mov edx, 0x18
mov ecx, 0x21005
call fcn.140005c00
mov edx, 8
mov ecx, 0x21006
call fcn.140005c00
xor r14d, r14d
lea r8, str.glText
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov edx, 0x1e0
mov ecx, 0x280
call fcn.140005680
mov rdi, rax
call fcn.1400020e0
test eax, eax
je 0x1400013ec
mov rcx, rdi
mov qword [rsp + 0x21c0], rbx
call fcn.140003c20
mov ecx, 1
call fcn.140003cc0
call fcn.140001c40
test eax, eax
je 0x140001372
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, 0x12c
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov edx, 0xfffffed4
sub edx, ebx
movsxd rdx, edx
add rax, rdx
mov r9, rax
shr r9, 0x20
mov r8d, r9d
xor r8d, eax
sub r8d, r9d
cmp r8d, 0x64
jg 0x140001372
xor edx, edx
mov qword [rsp + 0x21c8], rbp
mov ecx, 0x20004
call fcn.140005c00
mov edx, 3
mov ecx, 0x22002
call fcn.140005c00
mov edx, 3
mov ecx, 0x22003
call fcn.140005c00
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rbp, rax
mov ebx, 0xa
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x1f4
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Beep]
sub rbx, 1
jne 0x1400011c4
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, ebp
mov rbp, qword [rsp + 0x21c8]
cmp eax, 0x2710
jl 0x14000141c
lea rcx, [rsp + 0x50]
call fcn.1400016d0
mov rdx, rax
lea rcx, [rsp + 0x1140]
mov r8d, 0x1052
call fcn.14000f1f0
mov edx, dword [rsi + 8]
mov ecx, 0x21001
call fcn.140005c00
mov edx, dword [rsi + 0xc]
mov ecx, 0x21002
call fcn.140005c00
mov edx, dword [rsi + 0x10]
mov ecx, 0x21003
call fcn.140005c00
lea edx, [rbx + 0x65]
lea rcx, [rsp + 0x1256]
call fcn.140002160
lea edx, [rbx + 0x66]
lea rcx, [rsp + 0x135a]
call fcn.140002160
lea edx, [rbx + 0x67]
lea rcx, [rsp + 0x1562]
call fcn.140002160
lea edx, [rbx + 0x68]
lea rcx, [rsp + 0x145e]
call fcn.140002160
mov rcx, rdi
call fcn.140003c20
lea ecx, [rbx + 1]
call fcn.140003cc0
xorps xmm0, xmm0
lea rcx, [rsp + 0x1256]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x1130], rax
xor r8d, r8d
mov qword [rsp + 0x10b8], rax
xor edx, edx
lea rax, [rsp + 0x10a8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x10d0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r14d
movups xmmword [rsp + 0x10d0], xmm0
movups xmmword [rsp + 0x10e0], xmm0
movups xmmword [rsp + 0x10f0], xmm0
movups xmmword [rsp + 0x1100], xmm0
movups xmmword [rsp + 0x1110], xmm0
movups xmmword [rsp + 0x1120], xmm0
movups xmmword [rsp + 0x10a8], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14000134b
mov rcx, qword [rsp + 0x10a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x10b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsi + 8]
mov ecx, 0x21001
call fcn.140005c00
mov edx, dword [rsi + 0xc]
mov ecx, 0x21002
call fcn.140005c00
mov edx, dword [rsi + 0x10]
mov ecx, 0x21003
call fcn.140005c00
mov rcx, rdi
call fcn.140005f10
test eax, eax
je 0x1400013d2
nop
call fcn.140004570
lea r8, [rsp + 0x10c0]
mov rcx, rdi
lea rdx, [rsp + 0x10c4]
call fcn.140005bb0
mov edx, 0x100
mov rcx, rdi
call fcn.1400044f0
test eax, eax
je 0x1400013bb
mov edx, 1
mov rcx, rdi
call fcn.140005be0
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call fcn.140005f10
test eax, eax
jne 0x140001380
mov rcx, rdi
call fcn.140005ad0
call fcn.140006350
mov rbx, qword [rsp + 0x21c0]
mov eax, 1
mov rsi, qword [rsp + 0x21d0]
mov rdi, qword [rsp + 0x21d8]
mov r14, qword [rsp + 0x21b0]
mov rcx, qword [rsp + 0x21a0]
xor rcx, rsp
call fcn.1400022c0
add rsp, 0x21b8
ret
call fcn.140002260
call fcn.140002200
call fcn.1400020e0
lea rcx, [rsp + 0x50]
call fcn.1400016d0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]