Function at 0x14006eba0
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xf8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rcx + 8]
lea r15, [rax*4 + 2]
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r14, [0x1400c67c0]
nop word cs:[rax + rax]
mov ecx, dword [r14 + r12*4 + 0x10]
cmp ecx, eax
je 0x14006ec27
mov ecx, dword [r14 + r12*4 + 0x14]
cmp ecx, eax
je 0x14006ec18
mov ecx, dword [r14 + r12*4 + 0x18]
cmp ecx, eax
je 0x14006ec1d
mov ecx, dword [r14 + r12*4 + 0x1c]
cmp ecx, eax
je 0x14006ec23
add r12, 4
cmp r12, 0x80
jne 0x14006ebe0
mov eax, 0xffffffff
jmp 0x14006ec2a
inc r12
jmp 0x14006ec27
add r12, 2
jmp 0x14006ec27
add r12, 3
mov eax, r12d
shl rax, 4
mov rcx, qword [rax + r14 + 0x218]
mov r8, qword [rax + r14 + 0x210]
add r8, rcx
add r15, rcx
mov qword [rax + r14 + 0x218], r15
lea rcx, [rsp + 0x50]
mov rdx, rbx
call fcn.1400030a0
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsp + 0x90], ymm0
vmovups ymmword [rsp + 0xd0], ymm0
vmovups ymmword [rsp + 0xb0], ymm0
mov qword [rsp + 0xf0], 0
mov dword [rsp + 0x90], 0x68
lea rax, [0x1400b19d4]
mov qword [rsp + 0xa0], rax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14006ecdf
mov rax, qword [rsp + 0x58]
mov word [rcx + rax], 0
mov qword [rsp + 0xa8], rcx
vxorps xmm0, xmm0, xmm0
vmovaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdx, qword [rdi + 8]
test rdx, rdx
jne 0x14006ecfb
mov word [rcx + rax], 0
jmp 0x14006ed48
vxorps xmm0, xmm0, xmm0
vmovaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x14006ed48
lea rbx, [rdx*4 + 2]
xor r15d, r15d
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop
mov ecx, dword [r14 + r15*4 + 0x10]
cmp ecx, eax
je 0x14006ed8b
mov ecx, dword [r14 + r15*4 + 0x14]
cmp ecx, eax
je 0x14006ed7c
mov ecx, dword [r14 + r15*4 + 0x18]
cmp ecx, eax
je 0x14006ed81
mov ecx, dword [r14 + r15*4 + 0x1c]
cmp ecx, eax
je 0x14006ed87
add r15, 4
cmp r15, 0x80
jne 0x14006ed10
mov eax, 0xffffffff
jmp 0x14006ed8e
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
vmovups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor edx, edx
jmp 0x14006ee21
inc r15
jmp 0x14006ed8b
add r15, 2
jmp 0x14006ed8b
add r15, 3
mov eax, r15d
shl rax, 4
mov rcx, qword [rax + r14 + 0x218]
mov r8, qword [rax + r14 + 0x210]
add r8, rcx
add rbx, rcx
mov qword [rax + r14 + 0x218], rbx
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.1400030a0
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14006eddb
mov rax, qword [rsp + 0x88]
mov word [rdx + rax], 0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14006edf0
mov rax, qword [rsp + 0x58]
mov word [rcx + rax], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r8d, r8d
xor r9d, r9d
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test rsi, rsi
je 0x14006ee3d
mov rcx, qword [rsp + 0x60]
mov qword [rsi], rcx
add rsp, 0xf8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret