Function at 0x1400014b0
Capabilities:
Create process on windows
Inject apc
Resume thread

Disassembly:
push rsi
sub rsp, 0x130
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], 0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0x120], 0
mov dword [rsp + 0xfc], 0x104
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
lea rcx, [0x140098308]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x14000165d
mov rcx, qword [rsp + 0xa0]
mov dword [rsp + 0x20], 4
mov r8d, 0x2cd
xor edx, edx
mov r9d, 0x3000
call sub.kernel32.dll_VirtualAllocEx
test rax, rax
je 0x1400016c4
mov rsi, rax
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x20], 0
lea r8, [0x140098030]
mov r9d, 0x2cd
mov rdx, rax
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
je 0x14000172b
mov dword [rsp + 0x9c], 4
mov rcx, qword [rsp + 0xa0]
lea rax, [rsp + 0x9c]
mov qword [rsp + 0x20], rax
mov r8d, 0x2cd
mov rdx, rsi
mov r9d, 0x10
call sub.kernel32.dll_VirtualProtectEx
test eax, eax
je 0x140001792
mov rdx, qword [rsp + 0xa8]
mov rcx, rsi
xor r8d, r8d
call sub.kernel32.dll_QueueUserAPC
test eax, eax
je 0x1400017f9
mov rcx, qword [rsp + 0xa8]
call sub.kernel32.dll_ResumeThread
test eax, eax
je 0x140001860
mov rcx, qword [rsp + 0xa0]
call sub.kernel32.dll_CloseHandle
test eax, eax
je 0x1400018c7
mov rcx, qword [rsp + 0xa8]
call sub.kernel32.dll_CloseHandle
test eax, eax
je 0x14000192e
add rsp, 0x130
pop rsi
ret
call sub.kernel32.dll_GetLastError
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x58], rax
lea rax, [sym.core::fmt::num::imp::__impl_core::fmt::Display_for_u32_::fmt::hcbb0834f8e4b9915]
mov qword [rsp + 0x60], rax
lea rax, str.___CreateProcessA_failed:
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
mov qword [rsp + 0x88], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rdx, str.src_main.rsC:WindowsSystem32calc.exe
lea rcx, [rsp + 0x68]
call sym.core::panicking::panic_fmt::h5c281a947deef874
call sub.kernel32.dll_GetLastError
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x58], rax
lea rax, [sym.core::fmt::num::imp::__impl_core::fmt::Display_for_u32_::fmt::hcbb0834f8e4b9915]
mov qword [rsp + 0x60], rax
lea rax, str.___VirtualAllocEx_failed:___
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
mov qword [rsp + 0x88], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rdx, str.src_main.rsC:WindowsSystem32calc.exe
lea rcx, [rsp + 0x68]
call sym.core::panicking::panic_fmt::h5c281a947deef874
call sub.kernel32.dll_GetLastError
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x58], rax
lea rax, [sym.core::fmt::num::imp::__impl_core::fmt::Display_for_u32_::fmt::hcbb0834f8e4b9915]
mov qword [rsp + 0x60], rax
lea rax, str.___WriteProcessMemory_failed:
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
mov qword [rsp + 0x88], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rdx, str.src_main.rsC:WindowsSystem32calc.exe
lea rcx, [rsp + 0x68]
call sym.core::panicking::panic_fmt::h5c281a947deef874
call sub.kernel32.dll_GetLastError
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x58], rax
lea rax, [sym.core::fmt::num::imp::__impl_core::fmt::Display_for_u32_::fmt::hcbb0834f8e4b9915]
mov qword [rsp + 0x60], rax
lea rax, str.___VirtualProtectEx_failed:
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
mov qword [rsp + 0x88], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rdx, str.src_main.rsC:WindowsSystem32calc.exe
lea rcx, [rsp + 0x68]
call sym.core::panicking::panic_fmt::h5c281a947deef874
call sub.kernel32.dll_GetLastError
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x58], rax
lea rax, [sym.core::fmt::num::imp::__impl_core::fmt::Display_for_u32_::fmt::hcbb0834f8e4b9915]
mov qword [rsp + 0x60], rax
lea rax, str.___QueueUserAPC_failed:_x
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
mov qword [rsp + 0x88], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rdx, str.src_main.rsC:WindowsSystem32calc.exe
lea rcx, [rsp + 0x68]
call sym.core::panicking::panic_fmt::h5c281a947deef874
call sub.kernel32.dll_GetLastError
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x58], rax
lea rax, [sym.core::fmt::num::imp::__impl_core::fmt::Display_for_u32_::fmt::hcbb0834f8e4b9915]
mov qword [rsp + 0x60], rax
lea rax, str.___ResumeThread_failed:__t_
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
mov qword [rsp + 0x88], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rdx, str.src_main.rsC:WindowsSystem32calc.exe
lea rcx, [rsp + 0x68]
call sym.core::panicking::panic_fmt::h5c281a947deef874
call sub.kernel32.dll_GetLastError
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x58], rax
lea rax, [sym.core::fmt::num::imp::__impl_core::fmt::Display_for_u32_::fmt::hcbb0834f8e4b9915]
mov qword [rsp + 0x60], rax
lea rax, str.___CloseHandle_failed:
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
mov qword [rsp + 0x88], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rdx, str.src_main.rsC:WindowsSystem32calc.exe
lea rcx, [rsp + 0x68]
call sym.core::panicking::panic_fmt::h5c281a947deef874
call sub.kernel32.dll_GetLastError
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x58], rax
lea rax, [sym.core::fmt::num::imp::__impl_core::fmt::Display_for_u32_::fmt::hcbb0834f8e4b9915]
mov qword [rsp + 0x60], rax
lea rax, str.___CloseHandle_failed:
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
mov qword [rsp + 0x88], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rdx, str.src_main.rsC:WindowsSystem32calc.exe
lea rcx, [rsp + 0x68]
call sym.core::panicking::panic_fmt::h5c281a947deef874
int3