Function at 0x1400155c0
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x178
movaps xmmword [rsp + 0x160], xmm6
mov byte [rsp + 0x5f], r8b
mov rdi, rdx
mov rdx, rcx
mov rax, qword [0x140035010]
xor rax, rsp
mov qword [rsp + 0x158], rax
lea rsi, [rsp + 0x110]
mov rcx, rsi
call fcn.140019e70
mov rcx, rsi
call fcn.140026e80
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 7
mov word [rax], 0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x140015c43
lea rbp, [rcx + 2]
lea rax, [rsp + 0x60]
mov qword [rax + 0x10], rbp
mov rbp, rax
cmp rdx, 8
jb 0x14001566b
mov rbp, qword [rsp + 0x60]
mov dword [rbp + rcx*2], 0x200022
mov word [rbp + rcx*2 + 4], 0
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x140], xmm1
movaps xmmword [rsp + 0x130], xmm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 7
mov word [rax], 0
mov rax, qword [rsp + 0x78]
cmp rax, 8
jb 0x1400156d0
mov rcx, qword [rsp + 0x60]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x140015c67
call fcn.140020668
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], 0
mov rax, qword [rsp + 0x128]
cmp rax, 8
jb 0x140015719
mov rcx, qword [rsp + 0x110]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x140015c8a
call fcn.140020668
mov r14, qword [rdi]
mov r15, qword [rdi + 8]
cmp r14, r15
je 0x140015aff
xorps xmm6, xmm6
lea rdi, [rsp + 0xd0]
lea rbp, [rsp + 0xf0]
lea rax, [rsp + 0x70]
movups xmmword [rax], xmm6
cmp qword [r14 + 0x18], 0x10
mov rbx, r14
jb 0x140015751
mov rbx, qword [r14]
mov r12, qword [r14 + 0x10]
cmp r12, 0xf
ja 0x140015a0b
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x60], xmm0
mov r13d, 0xf
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r13
mov rcx, rdi
lea rdx, [rsp + 0x60]
call fcn.140019e70
mov rcx, rdi
call fcn.140026e80
lea rcx, [rsp + 0x100]
movups xmmword [rcx], xmm6
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x100], xmm1
movaps xmmword [rsp + 0xf0], xmm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 7
mov word [rax], 0
mov rax, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x108]
mov rdx, rcx
sub rdx, rax
cmp rdx, 2
jb 0x1400159b2
lea rdx, [rax + 2]
mov qword [rsp + 0x100], rdx
mov rdx, rbp
cmp rcx, 8
jb 0x140015800
mov rdx, qword [rsp + 0xf0]
mov dword [rdx + rax*2], 0x200022
mov word [rdx + rax*2 + 4], 0
mov rax, rbp
lea rcx, [rsp + 0x120]
movups xmmword [rcx], xmm6
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x120], xmm1
movaps xmmword [rsp + 0x110], xmm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 7
mov word [rax], 0
mov r8, qword [rsp + 0x120]
cmp qword [rsp + 0x128], 8
lea r9, [rsp + 0x110]
jb 0x14001586b
mov r9, qword [rsp + 0x110]
mov rax, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x148]
mov rdx, rcx
sub rdx, rax
cmp rdx, r8
jb 0x1400159d4
lea rbx, [rax + r8]
mov qword [rsp + 0x140], rbx
lea rsi, [rsp + 0x130]
cmp rcx, 8
jb 0x1400158ac
mov rsi, qword [rsp + 0x130]
lea rcx, [rsi + rax*2]
add r8, r8
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rsi + rbx*2], 0
mov rax, qword [rsp + 0x128]
cmp rax, 8
jb 0x1400158f1
mov rcx, qword [rsp + 0x110]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x140015a66
call fcn.140020668
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 7
mov word [rsp + 0x110], 0
mov rax, qword [rsp + 0x108]
cmp rax, 8
jb 0x140015943
mov rcx, qword [rsp + 0xf0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x140015a8d
call fcn.140020668
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 7
mov word [rsp + 0xf0], 0
mov rax, qword [rsp + 0xe8]
cmp rax, 8
jb 0x140015995
mov rcx, qword [rsp + 0xd0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x140015ab4
call fcn.140020668
mov rax, qword [rsp + 0x78]
cmp rax, 0x10
jae 0x1400159ee
add r14, 0x20
cmp r14, r15
jne 0x14001573c
jmp 0x140015aff
mov qword [rsp + 0x20], 2
mov edx, 2
mov rcx, rbp
lea r9, [0x140030fd4]
call fcn.1400242f0
jmp 0x140015811
mov qword [rsp + 0x20], r8
lea rcx, [rsp + 0x130]
mov rdx, r8
call fcn.1400242f0
jmp 0x1400158c1
mov rcx, qword [rsp + 0x60]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140015adb
call fcn.140020668
jmp 0x1400159a0
mov r13, r12
or r13, 0xf
movabs rax, 0x7fffffffffffffff
cmp r13, rax
cmovae r13, rax
cmp r13, 0xfff
jae 0x140015a3a
lea rcx, [r13 + 1]
call fcn.140020678
mov rcx, rax
jmp 0x140015a4f
lea rcx, [r13 + 0x28]
call fcn.140020678
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x60], rcx
lea r8, [r12 + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14001576d
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140015cd0
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbx
jmp 0x1400158ec
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140015cd0
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbx
jmp 0x14001593e
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140015cd0
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbx
jmp 0x140015990
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140015cd0
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x140015a04
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
xor eax, eax
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x60], 0x68
mov qword [rsp + 0x120], rax
movaps xmmword [rsp + 0x110], xmm0
cmp qword [rsp + 0x148], 8
jb 0x140015b63
mov rdx, qword [rsp + 0x130]
jmp 0x140015b6b
lea rdx, [rsp + 0x130]
lea rax, [rsp + 0x110]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000020
mov dword [rsp + 0x20], 0
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test eax, eax
je 0x140015be0
cmp byte [rsp + 0x5f], 0
je 0x140015bc5
mov rcx, qword [rsp + 0x110]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x110]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0x118]
call rdi
mov rax, qword [rsp + 0x148]
cmp rax, 8
jb 0x140015c10
mov rcx, qword [rsp + 0x130]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x140015cad
call fcn.140020668
test esi, esi
setne bl
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.140021700
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x160]
add rsp, 0x178
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x20], 2
lea r9, [0x140030fd4]
lea rcx, [rsp + 0x60]
mov edx, 2
call fcn.1400242f0
jmp 0x14001567a
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140015cd0
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
jmp 0x1400156cb
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140015cd0
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
jmp 0x140015714
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140015cd0
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
jmp 0x140015c0b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3