Function at 0x140001cd0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x240
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
movabs rax, 0x1c49574fb8464f74
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x11d92bee2f6ab2e3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xa128804754dc1424
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x529b2298216bf8fa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs r14, 0x732d3926ef1a7537
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rsi, 0x74ad58977c36c194
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rdi, 0xd247e82422af4849
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rbx, 0x529b22fd590ed68e
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x120]
vmovdqa ymmword [rbp + 0x20], ymm1
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x88]
vzeroupper
call fcn.1400027f0
nop
movabs rax, 0x732d3926ef1a7515
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movdqa xmm0, xmmword [rbp + 0x40]
xorps xmm0, xmmword [rbp + 0x160]
movdqa xmmword [rbp + 0x40], xmm0
movabs rax, 0x464a479b721644
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0x11d939f20e55eeb4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0xbc2e850441dc6769
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rax, 0x72f44fd2796ba2fb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
movabs rax, 0xa490d4a425d6462a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0xccaef16f221feeeb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0x6505e18eaf77e1f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
movabs rcx, 0x46fed1c1315968d2
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
movabs rax, 0xd2e3f4ca51f9661b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rax, 0xb881d11b51708688
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x6505e18ead55e6d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
vmovdqu ymm0, ymmword [rbp + 0x120]
vpxor ymm1, ymm0, ymmword [rbp + 0x180]
vmovdqa ymmword [rbp + 0x120], ymm1
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0x140], ymm1
lea rax, [rbp + 0x120]
mov rbx, 0xffffffffffffffff
mov rdi, rbx
vzeroupper
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x140001fe0
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r13, qword [rbp + 0x98]
sub rax, r13
cmp rax, rdi
jb 0x14000232c
lea rax, [rbp + 0x88]
mov r15, qword [rbp + 0x88]
cmp qword [rbp + 0xa0], 0x10
cmovae rax, r15
mov qword [rbp], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
lea r12, [rdi + r13]
mov esi, 0xf
lea r14, [rbp + 0x20]
cmp r12, rsi
jbe 0x1400020c2
mov rsi, r12
or rsi, 0xf
cmp rsi, rcx
jbe 0x140002084
mov rsi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400035b0
test rax, rax
je 0x1400021b7
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400020be
mov eax, 0x16
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1400020ac
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002332
jmp 0x140002065
test rcx, rcx
je 0x1400020bb
call fcn.1400035b0
mov r14, rax
jmp 0x1400020be
xor r14d, r14d
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], rsi
mov r8, rdi
lea rdx, [rbp + 0x120]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [r14 + rdi]
mov r8, r13
mov rdx, qword [rbp]
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + r12], 0
lea rax, [rbp + 0x40]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400020f5
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x140002142
lea rax, [rbx + rcx]
mov qword [rbp + 0x30], rax
lea rdi, [rbp + 0x20]
cmp rdx, 0x10
cmovae rdi, qword [rbp + 0x20]
add rdi, rcx
mov r8, rbx
lea rdx, [rbp + 0x40]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
lea rax, [rbp + 0x20]
jmp 0x140002157
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x40]
mov rdx, rbx
lea rcx, [rbp + 0x20]
call fcn.140002a90
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x78], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1400021c3
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400021be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400021be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035ec
mov dword [rbp + 0xb0], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
movups xmmword [rbp + 0xc8], xmm0
movups xmmword [rbp + 0xd8], xmm0
movups xmmword [rbp + 0xe8], xmm0
movups xmmword [rbp + 0xf8], xmm0
movups xmmword [rbp + 0x108], xmm0
mov dword [rbp + 0xec], 1
mov word [rbp + 0xf0], bx
lea rdx, [rbp + 0x68]
cmp qword [rbp + 0x80], 0x10
cmovae rdx, qword [rbp + 0x68]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x80]
cmp rdx, 0x10
jb 0x1400022aa
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400022a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400022a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035ec
movdqa xmm0, xmmword [0x140005500]
movdqu xmmword [rbp + 0x78], xmm0
mov byte [rbp + 0x68], 0
mov rax, qword [rbp + 0xa0]
cmp rax, 0x10
jb 0x1400022fc
lea rdx, [rax + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400022f4
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400022f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.1400035ec
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140003590
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400013c0
nop
call fcn.140001320
int3