Function at 0x1400711a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0x100
xor esi, esi
mov rdi, rdx
mov qword [rbp + 0x5f], rsi
mov r12d, esi
mov r13d, esi
test rdx, rdx
je 0x14007128d
mov rbx, rdx
mov ecx, edi
and rbx, 0xfffffffffffffff1
xorps xmm1, xmm1
and ecx, 0xf
je 0x140071210
movdqu xmm0, xmmword [rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
je 0x14007120c
mov ebx, ecx
shr rbx, 1
jmp 0x140071257
add rbx, 0x10
movdqu xmm0, xmmword [rbx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
jne 0x140071249
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rbx + 0x10]
add rbx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x6f], ecx
je 0x140071230
sub rbx, rdi
mov eax, ecx
sar rbx, 1
shr rax, 1
add rbx, rax
mov rdx, qword [0x140159180]
add rbx, rbx
lea rcx, [rbx + 0x12]
call fcn.1400601a0
mov r12, rax
mov r8, rbx
mov rdx, rdi
mov qword [rax], rbx
add rax, 0x10
mov qword [r12 + 8], rax
mov word [rbx + rax], si
mov rcx, qword [r12 + 8]
call fcn.1400e6ce0
lea r9, ds:[rbp + 0x5f]
mov rcx, r12
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
call fcn.140072be0
mov rdi, qword [rbp + 0x5f]
mov r14d, 0xffffffff
test rdi, rdi
je 0x1400712b9
cmp qword [rdi], rsi
jne 0x140071331
mov r15, qword ds:[rsp + 0x50]
test r15, r15
jne 0x1400712cf
call fcn.140061980
mov rbx, rax
jmp 0x140071308
mov rdx, qword [0x140159180]
lea rcx, [r15 + 0x12]
call fcn.1400601a0
mov rdx, qword [rsp + 0x58]
mov rbx, rax
mov qword [rax], r15
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + r15], si
test rdx, rdx
je 0x140071308
mov rcx, qword [rbx + 8]
mov r8, r15
call fcn.1400e6ce0
mov rcx, rdi
mov qword [rbp + 0x5f], rbx
mov rdi, rbx
test rcx, rcx
je 0x140071336
add rcx, 0xfffffffffffffff0
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14007132d
call fcn.1400602c0
mov rdi, qword [rbp + 0x5f]
mov r15, qword [rsp + 0x50]
mov rax, qword [0x140156cc0]
mov rdx, qword [0x140159180]
lea rbx, [r15 + rax*2]
lea rcx, [rbx + 0x12]
call fcn.1400601a0
mov rcx, rax
mov qword [rbp + 0x57], rax
mov qword [rax], rbx
add rax, 0x10
mov qword [rcx + 8], rax
mov word [rbx + rax], si
mov rbx, qword [rcx + 8]
mov r8, qword [0x140156cc0]
mov rcx, rbx
mov rdx, qword [0x140156cc8]
call fcn.1400e6ce0
add rbx, qword [0x140156cc0]
mov r8, r15
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.1400e6ce0
mov r8, qword [0x140156cc0]
lea rcx, [r15 + rbx]
mov rdx, qword [0x140156cc8]
call fcn.1400e6ce0
mov rax, qword ds:[rsp + 0x60]
mov r15, qword [rbp + 0x57]
test rax, rax
je 0x14007145f
mov rbx, qword [r15]
mov rdi, r15
add rbx, qword [0x140156ce0]
mov rdx, qword [0x140159180]
add rbx, rax
lea rcx, [rbx + 0x12]
call fcn.1400601a0
mov r15, rax
mov qword [rax], rbx
add rax, 0x10
mov qword [r15 + 8], rax
mov word [rax + rbx], si
mov rbx, qword [r15 + 8]
mov r8, qword [rdi]
mov rcx, rbx
mov rdx, qword [rdi + 8]
call fcn.1400e6ce0
add rbx, qword [rdi]
mov r8, qword [0x140156ce0]
mov rcx, rbx
mov rdx, qword [0x140156ce8]
call fcn.1400e6ce0
add rbx, qword [0x140156ce0]
mov r8, qword ds:[rsp + 0x60]
mov rcx, rbx
mov rdx, qword [rsp + 0x68]
call fcn.1400e6ce0
lea rcx, [rdi - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14007145b
call fcn.1400602c0
mov rdi, qword [rbp + 0x5f]
nop
test r12, r12
je 0x140071480
lea rcx, [r12 - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14007147c
call fcn.1400602c0
mov rdi, qword [rbp + 0x5f]
test rdi, rdi
je 0x1400714f0
mov rcx, qword [rdi + 8]
call fcn.140077180
test al, al
jne 0x1400714d7
mov rcx, qword ds:[rdi + 8]
lea rdx, str..exe
call fcn.140073300
test rax, rax
je 0x140071537
mov rcx, rdi
mov qword [rbp + 0x5f], rax
mov rdi, rax
test rcx, rcx
je 0x1400714d7
add rcx, 0xfffffffffffffff0
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400714d3
call fcn.1400602c0
mov rdi, qword [rbp + 0x5f]
test rdi, rdi
je 0x1400714f0
nop dword [rax]
cmp qword [rdi], rsi
je 0x1400714f0
mov rcx, rdi
call fcn.1400708c0
mov r13, rax
lfence
lfence
lfence
mov rcx, qword [rbp + 0x67]
test rcx, rcx
jne 0x14007152c
xorps xmm0, xmm0
mov dword [rbp - 0x69], 0x68
xor eax, eax
movups xmmword [rbp - 0x65], xmm0
mov dword [rbp - 5], eax
movups xmmword [rbp - 0x55], xmm0
movups xmmword [rbp - 0x45], xmm0
movups xmmword [rbp - 0x35], xmm0
movups xmmword [rbp - 0x25], xmm0
movups xmmword [rbp - 0x15], xmm0
test r13, r13
je 0x14007155d
mov r8, qword [r13 + 8]
jmp 0x140071560
mov qword ds:[rbp + 0x5f], rsi
test rdi, rdi
je 0x1400714f0
lea rcx, [rdi - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400714f0
call fcn.1400602c0
jmp 0x1400714f0
mov r8, rsi
test r15, r15
je 0x14007156b
mov rdx, qword [r15 + 8]
jmp 0x14007156e
mov rdx, rsi
mov rbx, qword [rbp + 0x5f]
test rbx, rbx
je 0x14007157d
mov r10, qword [rbx + 8]
jmp 0x140071580
mov r10, rsi
test rcx, rcx
lea rax, [rbp - 0x69]
cmovne rax, rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x48], rcx
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov rcx, r10
mov qword [rsp + 0x38], r8
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x4080010
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400715f4
cmp dword [0x140155b08], 0xffffffff
jae 0x1400715e5
mov rax, qword gs:[0x30]
mov rbx, qword [rbp + 0x5f]
mov eax, dword [rax + 0x68]
jmp 0x1400715eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140083420
mov esi, eax
test rbx, rbx
je 0x14007160f
lea rcx, [rbx - 0x10]
mov edx, r14d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14007160f
call fcn.1400602c0
test r15, r15
je 0x14007162a
lea rcx, [r15 - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14007162a
call fcn.1400602c0
test r13, r13
je 0x140071645
lea rcx, [r13 - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x140071645
nop
call fcn.1400602c0
test esi, esi
js 0x14007165f
mov rcx, qword [rbp + 0x87]
test rcx, rcx
je 0x14007165f
mov rax, qword [rsp + 0x70]
mov qword [rcx], rax
jmp 0x14007166f
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14007166f
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14007167f
call qword [sym.imp.ntdll.dll_NtClose]
mov rbx, qword [rsp + 0x140]
mov eax, esi
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret