Function at 0x140001110
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Resume thread
Suspend thread
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor edi, edi
mov dword [rbp - 9], 0x25331257
mov eax, edi
mov dword [rbp - 5], 0x361a2036
mov cl, 0x57
mov dword [rbp - 1], 0x2f32792f
mov word [rbp + 3], 0x32
nop dword [rax]
xor byte [rbp + rax - 8], cl
inc rax
cmp rax, 0xc
jae 0x140001163
movzx ecx, byte [rbp - 9]
jmp 0x140001150
lea rax, [0x140005768]
mov byte [rbp + 4], dil
mov qword [rsp + 0x48], rax
lea rcx, [rbp - 8]
lea rax, [0x140005050]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rdi
xor edx, edx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x100430
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140001227
movdqa xmm0, xmmword [0x1400033e0]
mov dword [rbp + 7], 0x72702065
mov dword [rbp + 0xb], 0x7365636f
mov word [rbp + 0xf], 0x2e73
mov byte [rbp + 0x11], dil
movdqa xmm1, xmmword [str.te_v13.1.0.1152_EEdrawMax_Ultima_bFailed_to_obtai]
lea r8, [rbp + 0x18]
movdqu xmmword [rbp - 9], xmm0
lea rdx, [rbp - 8]
mov r9d, 0x30
movdqa xmm0, xmmword [0x1400033b0]
xor ecx, ecx
movdqu xmmword [rbp + 0x17], xmm0
mov byte [rbp + 0x47], dil
movdqa xmm0, xmmword [0x1400033f0]
movdqu xmmword [rbp + 0x37], xmm0
movdqu xmmword [rbp + 0x27], xmm1
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
mov rdi, qword [rsp + 0xc8]
add rsp, 0xb0
pop rbp
ret
mov rcx, qword [0x140005768]
mov edx, 0xc8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x140005770]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov al, 0x23
mov dword [rbp - 9], 0x660023
mov rcx, rdi
mov dword [rbp - 5], 0x510047
mov dword [rbp - 1], 0x540042
mov dword [rbp + 3], 0x42006e
mov dword [rbp + 7], 0xd005b
mov dword [rbp + 0xb], 0x5b0046
mov dword [rbp + 0xf], 0x46
nop dword [rax]
movsx eax, al
xor word [rbp + rcx*2 - 7], ax
inc rcx
cmp rcx, 0xc
jae 0x140001297
movzx eax, byte [rbp - 9]
jmp 0x140001280
lea rcx, [rbp - 7]
mov word [rbp + 0x11], di
call section..text
cmp qword [0x140005780], rdi
jne 0x1400012e8
mov rcx, qword [0x140005768]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movdqa xmm0, xmmword [0x1400033c0]
mov dword [rbp + 7], 0x6f6d206e
mov dword [rbp + 0xb], 0x656c7564
mov dword [rbp + 0xf], 0x73616220
mov word [rbp + 0x13], 0x2e65
mov byte [rbp + 0x15], dil
jmp 0x1400011cb
mov ecx, 5
mov qword [rsp + 0xc0], rbx
call fcn.140001508
mov rdx, qword [0x140005780]
mov r9d, 5
mov rcx, qword [0x140005768]
add rdx, 0xb3e120
mov r8, rax
mov qword [rsp + 0x20], rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000144a
lea rdx, [0x140005048]
mov rcx, rbx
sub rdx, rbx
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
cmp byte [rcx], al
jne 0x140001442
inc rcx
mov rax, rcx
sub rax, rbx
cmp rax, 5
jb 0x140001340
mov rcx, rbx
call fcn.140001500
mov rdx, qword [0x140005780]
lea r8, [0x1400050c0]
mov rcx, qword [0x140005768]
add rdx, 0x341510
mov r9d, 7
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x140005780]
lea r8, [0x140005040]
mov rcx, qword [0x140005768]
add rdx, 0x461c77
mov r9d, 7
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x140005780]
lea r8, [0x1400050b8]
mov rcx, qword [0x140005768]
add rdx, 0x5fa7de
mov r9d, 6
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x140005780]
lea r8, [0x1400050c8]
mov rcx, qword [0x140005768]
add rdx, 0x5fa9c4
mov r9d, 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140005770]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [0x140005768]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140005770]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400014b2
mov rcx, rbx
call fcn.140001500
mov rcx, qword [0x140005768]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movdqa xmm0, xmmword [0x1400033d0]
lea r8, [rbp + 0x18]
movdqa xmm1, xmmword [str.te_v13.1.0.1152_EEdrawMax_Ultima_bFailed_to_obtai]
lea rdx, [rbp - 8]
movdqu xmmword [rbp - 9], xmm0
mov r9d, 0x30
xor ecx, ecx
movdqa xmm0, xmmword [0x1400033b0]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], 0x2e
movdqa xmm0, xmmword [0x1400033f0]
movdqu xmmword [rbp + 0x37], xmm0
mov byte [rbp + 0x47], dil
movdqu xmmword [rbp + 0x27], xmm1
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
mov rbx, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0xc8]
add rsp, 0xb0
pop rbp
ret