Function at 0x140003120
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
movaps xmmword [rbp - 0x10], xmm6
mov r14, rcx
cmp dword [0x14000f8f8], 0xa
jl 0x140003156
mov eax, dword [0x14000f8f4]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400031d3
mov eax, 0x10
call fcn.14000acd0
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call fcn.14000acd0
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.14000acd0
sub rsp, rax
mov rsi, rsp
mov eax, 0x70
call fcn.14000acd0
sub rsp, rax
mov rbx, rsp
mov eax, 0x20
call fcn.14000acd0
sub rsp, rax
mov r12, rsp
sub rsp, 0x20
mov rcx, rdi
mov rdx, rsi
call fcn.140003460
add rsp, 0x20
cmp dword [0x14000f8f8], 0xa
jl 0x140003205
mov ecx, dword [0x14000f8f4]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x140003205
mov eax, 0x10
call fcn.14000acd0
sub rsp, rax
mov rcx, rsp
mov eax, 0x10
call fcn.14000acd0
sub rsp, rax
mov rdx, rsp
sub rsp, 0x20
call fcn.140003460
add rsp, 0x20
jmp 0x140003156
test eax, eax
je 0x14000325a
cmp dword [rsi], 0
je 0x140003216
mov dword [rdi], 0
jmp 0x14000325a
sub rsp, 0x20
nop word [rax + rax]
mov rcx, r15
call fcn.140003740
add rsp, 0x20
cmp dword [0x14000f8f8], 0xa
jl 0x140003254
mov ecx, dword [0x14000f8f4]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x140003254
sub rsp, 0x20
mov rcx, r15
call fcn.140003740
jmp 0x140003220
mov dword [rdi], eax
test eax, eax
je 0x140003271
mov eax, dword [rdi]
movaps xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov qword [rbp - 0x18], r14
mov r14, qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov rsi, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
xorps xmm6, xmm6
mov r13, qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
nop dword [rax]
sub rsp, 0x20
mov rcx, rbx
call r14
mov rcx, qword [rbp - 0x18]
call fcn.140003000
mov rcx, rax
call rsi
add rsp, 0x20
mov rcx, qword [r15]
sub rsp, 0x60
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], rbx
movups xmmword [rsp + 0x38], xmm6
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor edx, edx
mov r8, rax
xor r9d, r9d
call r13
add rsp, 0x60
cmp dword [0x14000f8f8], 0xa
jl 0x14000337c
mov ecx, dword [0x14000f8f4]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x14000337c
sub rsp, 0x20
mov rcx, rbx
mov r14, qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call r14
mov rcx, qword [rbp - 0x18]
call fcn.140003000
mov rcx, rax
mov rsi, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
call rsi
add rsp, 0x20
mov rcx, qword [r15]
sub rsp, 0x60
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], rbx
movups xmmword [rsp + 0x38], xmm6
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor edx, edx
mov r8, rax
xor r9d, r9d
mov r13, qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
call r13
add rsp, 0x60
jmp 0x140003290
test eax, eax
jne 0x1400033f8
mov esi, dword [rdi]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
cmp dword [0x14000f8f8], 0xa
jl 0x1400033e1
mov eax, dword [0x14000f8f4]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400033e1
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
sub rsp, 0x20
call rbx
add rsp, 0x20
mov esi, eax
sub rsp, 0x20
call rbx
add rsp, 0x20
cmp dword [0x14000f8f8], 0xa
jl 0x1400033e1
mov eax, dword [0x14000f8f4]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400033b1
mov dword [rdi], esi
mov rcx, qword [r15]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov rcx, qword [r12]
sub rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
add rsp, 0x20
mov rcx, qword [r12 + 8]
sub rsp, 0x20
call rsi
add rsp, 0x20
cmp dword [0x14000f8f8], 0xa
jl 0x1400033e3
mov eax, dword [0x14000f8f4]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400033e3
mov rcx, qword [r12]
sub rsp, 0x20
call rsi
add rsp, 0x20
mov rcx, qword [r12 + 8]
sub rsp, 0x20
call rsi
add rsp, 0x20
mov rcx, qword [r12]
sub rsp, 0x20
jmp 0x140003407