Function at 0x1400011a0
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
movups xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov edi, dword [0x140cc9dec]
mov esi, dword [0x140cc9df0]
sub rsp, 0x20
call fcn.140590aa0
add rsp, 0x20
cdqe
lea rcx, [0x140774868]
mov eax, dword [rcx + rax*4]
xor eax, edi
mov ebx, eax
imul ebx, edi
sub rsp, 0x20
call fcn.140590b10
add rsp, 0x20
cdqe
lea rcx, [0x140774874]
and ebx, dword [rcx + rax*4]
sub rsp, 0x20
call fcn.140590b80
add rsp, 0x20
mov eax, dword [0x14091745c]
mov ecx, dword [0x140917460]
shrd ecx, eax, 0x12
xor ecx, 0x725a2e8f
cmp ebx, ecx
sete bl
sub rsp, 0x20
call fcn.140590bf0
add rsp, 0x20
cdqe
lea rcx, [0x140774880]
cmp esi, dword [rcx + rax*4]
setl r9b
mov eax, dword [0x140917464]
mov ecx, dword [0x140917468]
shrd ecx, eax, 0x1c
or r9b, bl
xor ecx, 0xf408809b
shl rcx, 5
mov eax, dword [0x14091746c]
mov edx, dword [0x140917470]
shrd edx, eax, 0xe
xor edx, 0x2fa8ff10
mov eax, edx
imul rdx, rax, 0x68
add rdx, 0xf
imul eax, dword [0x140917474], 0x63207b9b
imul r8d, dword [0x140917478], 0xd2d60c8b
and rdx, 0xfffffffffffffff0
add eax, r8d
add eax, 0x9bf904ca
lea rax, [rax + rax*2]
lea r8, [rax*8 + 0xf]
and r8, 0xfffffffffffffff0
nop dword [rax]
mov rax, rcx
call fcn.1407647f0
sub rsp, rax
mov r15, rsp
mov rax, rdx
call fcn.1407647f0
sub rsp, rax
mov r11, rsp
mov rax, r8
call fcn.1407647f0
sub rsp, rax
mov rbx, rsp
test r9b, r9b
je 0x1400012c0
mov r12, r11
sub rsp, 0x20
call fcn.140590c80
call fcn.140590cf0
call fcn.140590d60
call fcn.140590df0
add rsp, 0x20
mov edi, dword [0x140cc9df4]
mov esi, dword [0x140cc9df8]
sub rsp, 0x20
call fcn.140590e80
add rsp, 0x20
cdqe
lea rcx, [0x1407748b0]
mov eax, dword [rcx + rax*4]
xor eax, edi
mov r14d, eax
imul r14d, edi
sub rsp, 0x20
call fcn.140590f00
add rsp, 0x20
cdqe
lea rcx, [0x1407748bc]
and r14d, dword [rcx + rax*4]
sub rsp, 0x20
call fcn.140590f70
add rsp, 0x20
mov eax, dword [0x140917484]
mov ecx, dword [0x140917488]
shrd ecx, eax, 9
xor ecx, 0x6bcd9d53
cmp r14d, ecx
sete dil
sub rsp, 0x20
call fcn.140590fe0
add rsp, 0x20
cdqe
lea rcx, [0x1407748c8]
cmp esi, dword [rcx + rax*4]
setl sil
or sil, dil
jne 0x1400013c0
sub rsp, 0x20
call fcn.140591070
call fcn.140591100
call fcn.140591170
call fcn.140591200
add rsp, 0x20
jmp 0x140001401
sub rsp, 0x20
call fcn.140591290
call fcn.140591310
call fcn.1405913a0
call fcn.140591430
call fcn.1405914b0
call fcn.140591540
call fcn.1405915b0
call fcn.140591640
add rsp, 0x20
xorps xmm0, xmm0
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x10], xmm0
test sil, sil
jne 0x140001430
sub rsp, 0x20
call fcn.1405916b0
call fcn.140591730
call fcn.1405917a0
call fcn.140591810
call fcn.1405918a0
add rsp, 0x20
xorps xmm0, xmm0
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x10], xmm0
jmp 0x1400013c0
mov qword [rbp - 0x28], r12
sub rsp, 0x20
call fcn.140591930
call fcn.1405919b0
call fcn.140591a20
call fcn.140591ab0
call fcn.140591b20
call fcn.140591ba0
call fcn.140591c10
call fcn.140591ca0
lea rsi, [0x140cc9b38]
lea rdx, str.FKCH_Z
mov rcx, rsi
call fcn.14038ca70
add rsp, 0x20
movabs rax, 0xf4bd4ae5a9d33adc
imul rax, qword [0x1409174c8]
movabs rcx, 0xbabc687ab74fdb99
imul rcx, qword [0x1409174d0]
add rcx, rax
movabs r8, 0xa91f55b69dbd12d6
add r8, rcx
nop
sub rsp, 0x20
mov rcx, r15
mov rdx, rsi
call fcn.140370200
add rsp, 0x20
nop
sub rsp, 0x20
call fcn.1407662cc
add rsp, 0x20
mov rax, qword [rax]
mov rsi, qword [rax]
sub rsp, 0x20
call fcn.140592590
call fcn.140592610
call fcn.1405926a0
call fcn.140592730
call fcn.1405927b0
call fcn.140592830
call fcn.1405928b0
call fcn.140592920
add rsp, 0x20
nop
sub rsp, 0x20
mov rcx, r15
mov rdx, rsi
mov qword [rbp - 0x20], r15
call fcn.140372000
add rsp, 0x20
nop
mov r14d, dword [0x140cc9dfc]
mov edi, dword [0x140cc9e00]
sub rsp, 0x20
call fcn.1405929a0
add rsp, 0x20
cdqe
lea rcx, [0x140774a84]
mov eax, dword [rcx + rax*4]
xor eax, r14d
mov r15d, eax
imul r15d, r14d
sub rsp, 0x20
call fcn.140592a20
add rsp, 0x20
cdqe
lea rcx, [0x140774a90]
and r15d, dword [rcx + rax*4]
sub rsp, 0x20
call fcn.140592aa0
add rsp, 0x20
mov r14d, dword [0x140917508]
mov r12d, dword [0x14091750c]
sub rsp, 0x20
call fcn.140592b20
add rsp, 0x20
cdqe
lea rcx, [0x140774a9c]
cmp edi, dword [rcx + rax*4]
jl 0x140001681
shld r14d, r12d, 6
xor r14d, 0xdda00efc
cmp r15d, r14d
je 0x140001681
lea r12, [0x140774ac0]
nop
nop
sub rsp, 0x20
mov rcx, qword [rbp - 0x20]
mov rdx, rsi
call fcn.140372000
add rsp, 0x20
nop
nop
sub rsp, 0x20
mov rcx, qword [rbp - 0x20]
mov rdx, rsi
call fcn.140372000
add rsp, 0x20
nop
mov edi, dword [0x140cc9dfc]
mov r15d, dword [0x140cc9e00]
sub rsp, 0x20
call fcn.140592ba0
add rsp, 0x20
cdqe
lea rcx, [0x140774aa8]
mov eax, dword [rcx + rax*4]
xor eax, edi
mov r13d, eax
imul r13d, edi
sub rsp, 0x20
call fcn.140592c10
add rsp, 0x20
cdqe
lea rcx, [0x140774ab4]
and r13d, dword [rcx + rax*4]
sub rsp, 0x20
call fcn.140592c90
add rsp, 0x20
imul r14d, dword [0x140917510], 0xfb798d2c
imul edi, dword [0x140917514], 0xb59bb9d4
sub rsp, 0x20
call fcn.140592d20
add rsp, 0x20
cdqe
cmp r15d, dword [r12 + rax*4]
jl 0x140001681
mov eax, edi
mov ecx, r14d
add eax, ecx
add eax, 0xcefcfc94
cmp r13d, eax
jne 0x1400015c0
sub rsp, 0x20
call fcn.140592da0
call fcn.140592e20
call fcn.140592ea0
call fcn.140592f30
call fcn.140592fc0
call fcn.140593030
call fcn.1405930b0
call fcn.140593130
lea rsi, [0x140cc9b5c]
lea rdx, [0x14077406b]
mov rcx, rsi
call fcn.1403a0290
add rsp, 0x20
nop
sub rsp, 0x20
mov rcx, qword [rbp - 0x20]
mov rdx, rsi
call fcn.140372000
add rsp, 0x20
nop
mov edi, dword [0x140cc9dfc]
mov esi, dword [0x140cc9e00]
sub rsp, 0x20
call fcn.1405931b0
add rsp, 0x20
cdqe
lea rcx, [0x140774b14]
mov eax, dword [rcx + rax*4]
xor eax, edi
mov r14d, eax
imul r14d, edi
sub rsp, 0x20
call fcn.140593230
add rsp, 0x20
cdqe
lea rcx, [0x140774b20]
mov edi, r14d
and edi, dword [rcx + rax*4]
sub rsp, 0x20
call fcn.1405932b0
add rsp, 0x20
imul r14d, dword [0x140917528], 0xf05fa243
imul r15d, dword [0x14091752c], 0x13c8a0a
sub rsp, 0x20
call fcn.140593330
add rsp, 0x20
cdqe
lea rcx, [0x140774b2c]
cmp esi, dword [rcx + rax*4]
jl 0x140001880
mov eax, r15d
mov ecx, r14d
add eax, ecx
add eax, 0xea3aa028
cmp edi, eax
je 0x140001880
lea rsi, [0x140cc9b5c]
lea rdi, [0x14077406b]
nop dword [rax]
sub rsp, 0x20
mov rcx, rsi
mov rdx, rdi
call fcn.1403a0290
add rsp, 0x20
nop
sub rsp, 0x20
mov rcx, qword [rbp - 0x20]
mov rdx, rsi
call fcn.140372000
add rsp, 0x20
nop
sub rsp, 0x20
mov rcx, rsi
mov rdx, rdi
call fcn.1403a0290
add rsp, 0x20
nop
sub rsp, 0x20
mov rcx, qword [rbp - 0x20]
mov rdx, rsi
call fcn.140372000
add rsp, 0x20
nop
mov r14d, dword [0x140cc9dfc]
mov r13d, dword [0x140cc9e00]
sub rsp, 0x20
call fcn.1405933c0
add rsp, 0x20
cdqe
lea rcx, [0x140774b38]
mov r15d, dword [rcx + rax*4]
xor r15d, r14d
imul r15d, r14d
sub rsp, 0x20
call fcn.140593430
add rsp, 0x20
cdqe
lea rcx, [0x140774b44]
and r15d, dword [rcx + rax*4]
sub rsp, 0x20
call fcn.1405934b0
add rsp, 0x20
imul r14d, dword [0x140917530], 0xdb43aa65
imul r12d, dword [0x140917534], 0xb73b4c2a
sub rsp, 0x20
call fcn.140593530
add rsp, 0x20
cdqe
lea rcx, str._n_n_nhhh
cmp r13d, dword [rcx + rax*4]
jl 0x140001880
mov eax, r12d
mov ecx, r14d
add eax, ecx
add eax, 0xa862ddb4
cmp r15d, eax
jne 0x140001790
xorps xmm6, xmm6
mov r12, qword [rbp - 0x28]
movups xmmword [r12 + 0x50], xmm6
movups xmmword [r12 + 0x40], xmm6
movups xmmword [r12 + 0x30], xmm6
movups xmmword [r12 + 0x20], xmm6
movups xmmword [r12 + 0x10], xmm6
movups xmmword [r12], xmm6
mov qword [r12 + 0x60], 0
sub rsp, 0x20
call fcn.1405935c0
add rsp, 0x20
cdqe
lea rcx, [0x140774b5c]
mov eax, dword [rcx + rax*4]
mov dword [r12], eax
movups xmmword [rbx], xmm6
mov qword [rbx + 0x10], 0
mov edi, dword [0x140cc9dec]
mov esi, dword [0x140cc9df0]
sub rsp, 0x20
call fcn.140593640
add rsp, 0x20
cdqe
lea rcx, [0x140774b68]
mov eax, dword [rcx + rax*4]
xor eax, edi
mov r14d, eax
imul r14d, edi
sub rsp, 0x20
call fcn.1405936c0
add rsp, 0x20
cdqe
lea rcx, [0x140774b74]
and r14d, dword [rcx + rax*4]
sub rsp, 0x20
call fcn.140593740
add rsp, 0x20
mov eax, dword [0x140917538]
mov ecx, dword [0x14091753c]
shrd ecx, eax, 0x1e
xor ecx, 0x58e2cc54
cmp r14d, ecx
sete r14b
sub rsp, 0x20
call fcn.1405937b0
add rsp, 0x20
cdqe
lea rcx, [0x140774b80]
cmp esi, dword [rcx + rax*4]
setl dil
or dil, r14b
mov r14, qword [rbp - 0x20]
mov r15, qword [r14 + 0x18]
jne 0x1400019f5
sub rsp, 0x20
call fcn.140593830
call fcn.1405938c0
call fcn.140593950
call fcn.1405939e0
call fcn.140593a60
call fcn.140593ad0
add rsp, 0x20
jmp 0x14000199f
sub rsp, 0x20
call fcn.1405945a0
call fcn.140594620
call fcn.1405946a0
call fcn.140594720
call fcn.1405947a0
call fcn.140594820
call fcn.1405948b0
add rsp, 0x20
cdqe
lea rcx, [0x140774cd0]
cmp r15, qword [rcx + rax*8]
jbe 0x1400019f5
sub rsp, 0x20
call fcn.140594930
call fcn.1405949b0
call fcn.140594a20
call fcn.140594a90
add rsp, 0x20
sub rsp, 0x20
call fcn.140593b40
call fcn.140593bc0
call fcn.140593c30
call fcn.140593cb0
call fcn.140593d40
call fcn.140593dc0
call fcn.140593e40
call fcn.140593eb0
call fcn.140593f50
call fcn.140593fc0
call fcn.140594050
call fcn.1405940c0
call fcn.140594150
add rsp, 0x20
cdqe
lea rcx, [0x140774c40]
mov rsi, r14
cmp r15, qword [rcx + rax*8]
jbe 0x140001a53
mov rsi, qword [r14]
test dil, dil
je 0x14000199f
xorps xmm6, xmm6
mov rdi, qword [sym.imp.KERNEL32.dll_CreateProcessA]
nop word cs:[rax + rax]
mov eax, dword [0x140917558]
mov ecx, dword [0x14091755c]
shrd ecx, eax, 0xc
imul eax, dword [0x140917560], 0x7b806001
imul edx, dword [0x140917564], 0xa90fe8a1
xor ecx, 0xcd562b20
add eax, edx
add eax, 0xde11f393
sub rsp, 0x50
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], r12
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
xor ecx, ecx
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call rdi
add rsp, 0x50
mov r14d, dword [0x140cc9dec]
mov r13d, dword [0x140cc9df0]
sub rsp, 0x20
call fcn.1405941d0
add rsp, 0x20
cdqe
lea rcx, [0x140774c58]
mov eax, dword [rcx + rax*4]
xor eax, r14d
mov r15d, eax
imul r15d, r14d
sub rsp, 0x20
call fcn.140594240
add rsp, 0x20
cdqe
mov r14d, r15d
lea rcx, [0x140774c64]
and r14d, dword [rcx + rax*4]
sub rsp, 0x20
call fcn.1405942d0
add rsp, 0x20
imul r15d, dword [0x140917568], 0x33ddb0e5
imul r12d, dword [0x14091756c], 0x4e5aa9c2
sub rsp, 0x20
call fcn.140594340
add rsp, 0x20
cdqe
lea rcx, [0x140774c70]
cmp r13d, dword [rcx + rax*4]
jl 0x140001be0
mov eax, r12d
mov ecx, r15d
add eax, ecx
add eax, 0x9ca3956c
cmp r14d, eax
je 0x140001be0
imul eax, dword [0x140917598], 0x36029651
imul ecx, dword [0x14091759c], 0xab2eb1b1
imul edx, dword [0x1409175a0], 0xd6f72aa2
imul r8d, dword [0x1409175a4], 0xa3b7f4f2
add eax, ecx
add eax, 0xfe687a8c
mov ecx, r8d
add ecx, edx
add ecx, 0x1deaa7a2
sub rsp, 0x50
mov qword [rsp + 0x48], rbx
mov r12, qword [rbp - 0x28]
mov qword [rsp + 0x40], r12
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
xor ecx, ecx
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call rdi
add rsp, 0x50
jmp 0x140001a70
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r15, str._n_n_n_n_n_n_n_n_n_n_n_n
mov rdi, qword [rbp - 0x20]
nop word cs:[rax + rax]
mov rcx, qword [rbx]
sub rsp, 0x20
call rsi
add rsp, 0x20
mov rcx, qword [rbx + 8]
sub rsp, 0x20
call rsi
mov rcx, rdi
call fcn.140001d70
add rsp, 0x20
mov edi, dword [0x140cc9dec]
mov r14d, dword [0x140cc9df0]
sub rsp, 0x20
call fcn.1405943d0
add rsp, 0x20
cdqe
lea rcx, [0x140774c7c]
mov eax, dword [rcx + rax*4]
xor eax, edi
mov r12d, eax
imul r12d, edi
sub rsp, 0x20
call fcn.140594430
add rsp, 0x20
cdqe
lea rcx, [0x140774c88]
and r12d, dword [rcx + rax*4]
sub rsp, 0x20
call fcn.1405944b0
add rsp, 0x20
imul r13d, dword [0x140917570], 0x73793075
imul edi, dword [0x140917574], 0xa505721c
sub rsp, 0x20
call fcn.140594520
add rsp, 0x20
cdqe
cmp r14d, dword [r15 + rax*4]
jl 0x140001ce0
mov eax, edi
mov ecx, r13d
add eax, ecx
add eax, 0xf9810948
cmp r12d, eax
je 0x140001ce0
mov rcx, qword [rbx]
sub rsp, 0x20
call rsi
add rsp, 0x20
mov rcx, qword [rbx + 8]
sub rsp, 0x20
call rsi
mov rdi, qword [rbp - 0x20]
mov rcx, rdi
call fcn.140001d70
add rsp, 0x20
jmp 0x140001c00
movups xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret