Function at 0x1400094b8
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rbp
push rbx
sub rsp, 0x108
lea rbp, [rsp + 0x80]
mov rax, qword [0x1401170b8]
mov rcx, rax
call sub.gdiplus.dll_GdiplusShutdown
lea rax, [rbp - 0x10]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rax, [rbp - 0x30]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rax, [rbp + 0x60]
mov rcx, rax
call fcn.140006d3d
lea rax, [rbp + 0x60]
mov rcx, rax
call fcn.14003d160
mov rdx, rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
lea rax, [rbp + 0x60]
mov rcx, rax
call fcn.1400b9710
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
mov rbx, rax
lea rax, [rbp + 0x60]
mov rcx, rax
call fcn.1400b9710
mov rax, rbx
mov rcx, rax
call fcn.1400173f0
nop
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1b8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x160], rcx
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.1400b8c00
movabs rax, 0xa56fb7d169009bec
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0x20], rax
movabs rax, 0x7abced40e075a6c
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x28], rax
nop
movabs rdi, 0xd60ac58e1d65fcc3
mov qword [rbp + 0x128], rdi
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x128]
mov qword [rbp - 0x40], rax
movabs rsi, 0x7abcefb7a753b18
mov qword [rbp + 0x120], rsi
mov rax, qword [rbp + 0x120]
mov qword [rbp + 0x120], rax
mov rax, qword [rbp + 0x120]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x40]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x118]
vmovdqa xmm0, xmmword [rax]
lea rax, [rbp + 0x20]
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
vmovdqa xmm1, xmmword [rax]
vmovdqa xmmword [rbp + 0x100], xmm1
vmovdqa xmmword [rbp + 0xf0], xmm0
vmovdqa xmm1, xmmword [rbp + 0x100]
vmovdqa xmm0, xmmword [rbp + 0xf0]
vpxor xmm0, xmm1, xmm0
lea rax, [rbp + 0x20]
mov qword [rbp + 0xe8], rax
vmovdqa xmmword [rbp + 0xd0], xmm0
mov rax, qword [rbp + 0xe8]
vmovdqa xmm0, xmmword [rbp + 0xd0]
vmovdqa xmmword [rax], xmm0
nop
lea rdx, [rbp + 0x20]
mov rax, rbp
mov rcx, qword [rbp + 0x160]
mov r8, rcx
mov rcx, rax
call fcn.1400d6b50
lea rdx, [rbp - 0x20]
mov rax, rbp
mov r9d, 0x3c
mov r8, rdx
mov rdx, rax
lea rax, [0x1401170e0]
mov rcx, rax
call fcn.140002c3c
cmp eax, 0xe8
sete bl
mov rax, rbp
mov rcx, rax
call fcn.1400b9710
test bl, bl
je 0x14000986e
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.14003d180
xor eax, 1
test al, al
je 0x14000986e
movabs rax, 0xd60ac58e1d1699ba
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x58]
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x58]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x50], rsi
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x50], rax
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x38], rax
nop
mov qword [rbp + 0xb8], rdi
mov rax, qword [rbp + 0xb8]
mov qword [rbp + 0xb8], rax
mov rax, qword [rbp + 0xb8]
mov qword [rbp - 0x60], rax
mov qword [rbp + 0xb0], rsi
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0xb0], rax
mov rax, qword [rbp + 0xb0]
mov qword [rbp - 0x58], rax
lea rax, [rbp - 0x60]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
vmovdqa xmm0, xmmword [rax]
lea rax, [rbp + 0x30]
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
vmovdqa xmm1, xmmword [rax]
vmovdqa xmmword [rbp + 0x90], xmm1
vmovdqa xmmword [rbp + 0x80], xmm0
vmovdqa xmm1, xmmword [rbp + 0x90]
vmovdqa xmm0, xmmword [rbp + 0x80]
vpxor xmm0, xmm1, xmm0
lea rax, [rbp + 0x30]
mov qword [rbp + 0x78], rax
vmovdqa xmmword [rbp + 0x60], xmm0
mov rax, qword [rbp + 0x78]
vmovdqa xmm0, xmmword [rbp + 0x60]
vmovdqa xmmword [rax], xmm0
nop
lea rdx, [rbp + 0x30]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.1400d6100
test al, al
je 0x14000986e
call fcn.1400094b8
mov dword [rbp + 0x4c], 0x3c
lea rdx, [rbp + 0x4c]
lea rax, [rbp + 0x40]
mov rcx, rax
call fcn.1400b10d0
lea rax, [rbp + 0x40]
mov rcx, rax
call fcn.14008f520
jmp 0x1400095ea