Function at 0x1400fb682
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
jmp 0x14015e810
push rbp
push rsi
push rdi
sub rsp, 0x4c0
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0xbc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140a3b940]
xor rax, rbp
mov qword [rbp + 0x468], rax
lea rcx, [0x140a5f24e]
call fcn.1400fe346
nop
lea rax, str.C:WindowsLogsDPX_setuparr.log
mov qword [rbp + 8], rax
lea rax, [0x14030e498]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 8]
call fcn.1400fc1a9
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14015e883
mov eax, 0xffffffff
jmp 0x14015ecc6
mov rcx, qword [rbp + 0x48]
call fcn.1400fdd83
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jne 0x14015e8b5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x48]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov eax, 0xffffffff
jmp 0x14015ecc6
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x90]
call fcn.1400fc5f0
nop
mov dword [rbp + 0x90], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x118]
call fcn.1400fc5f0
nop
lea rax, [rbp + 0x118]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rbp + 0x144], eax
cmp dword [rbp + 0x144], 0
jne 0x14015e95f
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400f8a13
nop
mov eax, 0xffffffff
jmp 0x14015ecc6
lea rdx, [rbp + 0x164]
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
nop
mov qword [rbp + 0x188], 0
mov qword [rbp + 0x190], 0
cmp dword [rbp + 0x164], 0
je 0x14015ea06
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0x3e8]
call fcn.1400fa79b
lea rcx, [rbp + 0x3b8]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x188]
lea rcx, [rbp + 0x3b8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
cmp qword [rbp + 0x190], 0
je 0x14015e9e9
cmp qword [rbp + 0x188], 0
jne 0x14015ea04
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400f8a13
nop
mov eax, 0xffffffff
jmp 0x14015ecc6
jmp 0x14015ea77
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0x448]
call fcn.1400f974c
lea rcx, [rbp + 0x418]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x188]
lea rcx, [rbp + 0x418]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
cmp qword [rbp + 0x190], 0
je 0x14015ea5c
cmp qword [rbp + 0x188], 0
jne 0x14015ea77
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400f8a13
nop
mov eax, 0xffffffff
jmp 0x14015ecc6
mov rcx, qword [rbp + 0x48]
call fcn.1400fdb80
mov dword [rbp + 0x1b4], eax
cmp dword [rbp + 0x1b4], 0
je 0x14015ea98
cmp dword [rbp + 0x164], 0
je 0x14015eaaa
cmp dword [rbp + 0x1b4], 0
jne 0x14015eab4
cmp dword [rbp + 0x164], 0
je 0x14015eab4
mov eax, 0xffffffff
jmp 0x14015ecc6
cmp dword [rbp + 0x1b4], 0
je 0x14015eace
mov rcx, qword [rbp + 0x48]
call fcn.1400f7555
mov dword [rbp + 0x1d4], eax
jmp 0x14015eadd
mov rcx, qword [rbp + 0x48]
call fcn.1400f8121
mov dword [rbp + 0x1d4], eax
cmp dword [rbp + 0x1d4], 0xffffffff
jne 0x14015eb01
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400f8a13
nop
mov eax, 0xffffffff
jmp 0x14015ecc6
cmp dword [rbp + 0x164], 0
je 0x14015eb25
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x118]
call fcn.1400fbdda
mov dword [rbp + 0x1f4], eax
jmp 0x14015eb3e
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x118]
call fcn.1400fe6bb
mov dword [rbp + 0x1f4], eax
cmp dword [rbp + 0x1f4], 0xffffffff
jne 0x14015eb62
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400f8a13
nop
mov eax, 0xffffffff
jmp 0x14015ecc6
mov eax, dword [rbp + 0x1f4]
cmp dword [rbp + 0x1d4], eax
je 0x14015eb8b
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400f8a13
nop
mov eax, 0xffffffff
jmp 0x14015ecc6
cmp dword [rbp + 0x1b4], 0
je 0x14015eba5
mov rcx, qword [rbp + 0x48]
call fcn.1400fd6c6
mov dword [rbp + 0x214], eax
jmp 0x14015ebb4
mov rcx, qword [rbp + 0x48]
call fcn.1400f9e5e
mov dword [rbp + 0x214], eax
cmp dword [rbp + 0x1b4], 0
je 0x14015ebda
cmp dword [rbp + 0x214], 0
jne 0x14015ebda
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400f9e22
test eax, eax
jne 0x14015ec4c
cmp dword [rbp + 0x1b4], 0
je 0x14015ec00
cmp dword [rbp + 0x214], 0
je 0x14015ec00
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400f8e73
test eax, eax
jne 0x14015ec4c
cmp dword [rbp + 0x1b4], 0
jne 0x14015ec26
cmp dword [rbp + 0x214], 0
jne 0x14015ec26
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400f7cfd
test eax, eax
jne 0x14015ec4c
cmp dword [rbp + 0x1b4], 0
jne 0x14015ec61
cmp dword [rbp + 0x214], 0
je 0x14015ec61
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400fae03
test eax, eax
je 0x14015ec61
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400fa31d
nop
xor eax, eax
jmp 0x14015ecc6
cmp qword [rbp + 0x48], 0
je 0x14015ec7e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x48]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
cmp qword [rbp + 0x120], 0
je 0x14015ec96
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rbp + 0x118], 0
je 0x14015ecc1
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 0xffffffff
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14030b810]
call fcn.1400fcf55
mov rax, rdi
mov rcx, qword [rbp + 0x468]
xor rcx, rbp
call fcn.1400fa791
lea rsp, [rbp + 0x470]
pop rdi
pop rsi
pop rbp
ret