Function at 0x1413dcc20
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rdi
sub rsp, 0x2b0
xor eax, eax
test eax, eax
je 0x1413dce40
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
out 0xe9, al
jl 0x1413dcc46
add byte [rax], al
mov edx, ebx
mov eax, esi
call fcn.1413d8668
call qword [rax]
add byte [rbx - 0x1739742d], cl
sbb byte [rdx + 0x10ffffff], bh
sete al
jmp 0x1413dcc59
pop rbx
mov esp, ebp
pop rbp
ret
xor eax, eax
test eax, eax
je 0x1413dd057
nop
nop
nop
nop
nop
nop
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
and al, 0xdd
add dl, r9b
pop rax
add byte [rax], al
add byte [rbx + rdx*2], al
insb byte [rdi], dx
add al, byte [rax]
add ah, byte [rax - 0x2b3becc]
invalid
xor eax, eax
test eax, eax
je 0x1413dd26e
call fcn.1413dba90
test eax, eax
jne 0x1413ddb7a
xor eax, eax
test eax, eax
je 0x1413dd492
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
enter 0x458b, 8
movzx eax, byte [rax - 0x13]
movzx eax, word [rax*2 + 0x6ce29c]
pushfq
adc byte [rax], al
add dword [rax], eax
add eax, 0x65646e49
js 0x1413dd2af
add byte [rdx], al
mov eax, 0x2786564
add byte [rax], al
add byte [rdx], al
add byte [rcx + 0x44005617], cl
add ah, dh
add al, byte [rax]
add byte [rax], r13b
insb byte [rdi], dx
insb byte [rdi], dx
add byte [rcx], dl
insb byte [rdi], dx
insb byte [rdi], dx
outsd dx, dword [rsi]
invalid
mov r8d, 0x208
lea rdx, [rsp + 0xa0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
test eax, eax
je 0x1413dd6bf
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add byte [rax], al
add dword [rax], eax
add byte [rax + rdx + 0x40040], bl
add byte [rax], al
or dword [rsi + 0x52], eax
pop rbx
ret
mov dword [rsp + 0x30], 0x70
lea rax, [rsp + 0x34]
mov rdi, rax
xor eax, eax
mov ecx, 0x6c
rep stosb byte [rdi], al
mov eax, 0x72
mov word [rsp + 0x20], ax
mov eax, 0x75
mov word [rsp + 0x22], ax
mov eax, 0x6e
mov word [rsp + 0x24], ax
mov eax, 0x61
mov word [rsp + 0x26], ax
mov eax, 0x73
mov word [rsp + 0x28], ax
xor eax, eax
mov word [rsp + 0x2a], ax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x60], 1
xor eax, eax
test eax, eax
je 0x1413dd950
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
loope 0x1413dd751
inc dword [rax + rax*8 + 0x458b2674]
rcl byte [rax - 0x73], 0x45
mov word [rbx - 0x5fff3fab], cs
xchg dword [rax], edx
pop rax
test al, al
je 0x1413dd77c
mov eax, dword [rbp - 0x40]
push rax
lea eax, [rbp - 0x74]
mov edx, dword [rbp - 0x40]
add byte [rax + 0x58005087], ah
add byte [rax], al
add byte [rax], cl
outsd dx, dword [rsi]
outsb dx, byte [rsi]
je 0x1413dd7e2
ret
mov eax, ebx
call fcn.1413e2c48
add byte [rbp - 0x74e98b40], al
invalid
pop rdx
add ah, dl
add byte gs:[r11 + r8*2 + 0x5b], r14b
add byte [rax + 0x48], al
pop rbx
add byte [rax], al
or al, 0x49
outsb dx, byte [rsi]
jae 0x1413dd86a
invalid
add byte [rax], al
or byte [rax], al
add cl, byte [rax]
mov dword fs:[rax], esp
mov eax, dword [rbp - 4]
mov eax, dword [rax + 0xc]
call 0x1413f1ddc
mov esi, eax
mov eax, dword [rax + 0x18]
mov edx, dword [rbp - 4]
mov edx, dword [rdx + 0x40]
sub eax, dword [rdx + 0x1c]
shr eax, 0xc
add bh, bh
invalid
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x2b0
pop rdi
ret