Function at 0x1800147fe
Capabilities:
Create process on windows

Disassembly:
push rbp
sub rsp, 0x9a0
lea rbp, [rsp + 0x50]
mov qword [rsp], rax
mov rax, 0x99c
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x1800147ed
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0x130], rsi
mov qword [rbp + 0x128], rbx
mov qword [rbp + 0x960], rcx
mov dword [rbp + 0x968], edx
mov rax, qword [0x1800f4ae8]
xor rax, rbp
mov qword [rbp + 0x948], rax
mov byte [rbp + 0xa8], 0
lea rax, [rbp + 0x140]
mov rdx, qword [rbp + 0x960]
mov ecx, 0x400
mov qword [rbp + 0xf8], rcx
mov rcx, rax
mov rax, qword [rbp + 0xf8]
mov r8, rax
call fcn.180063c00
mov qword [rbp + 0xe0], rax
lea rax, [rbp + 0x140]
add rax, 0x7fe
mov word [rax], 0
lea rax, [rbp + 0x18]
mov edx, 0
mov ecx, 0x18
mov qword [rbp + 0x100], rcx
mov rcx, rax
mov rax, qword [rbp + 0x100]
mov r8, rax
call fcn.180062370
mov qword [rbp + 0xe8], rax
lea rax, [rbp + 0x38]
mov edx, 0
mov ecx, 0x68
mov qword [rbp + 0x108], rcx
mov rcx, rax
mov rax, qword [rbp + 0x108]
mov r8, rax
call fcn.180062370
mov qword [rbp + 0xf0], rax
mov dword [rbp + 0x38], 0x68
mov dword [rbp + 0x74], 1
mov word [rbp + 0x78], 0
mov eax, 0
lea rdx, [rbp + 0x140]
mov ecx, 0
mov ebx, 0
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x8000000
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rsi, [rbp + 0x38]
mov qword [rsp + 0x40], rsi
lea rsi, [rbp + 0x18]
mov qword [rsp + 0x48], rsi
mov rsi, qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov qword [rbp + 0x110], rcx
mov rcx, rax
mov rax, qword [rbp + 0x110]
mov r8, rax
mov r9, rbx
call rsi
mov dword [rbp + 0xac], eax
mov eax, dword [rbp + 0xac]
mov dword [rbp + 0xb0], eax
mov eax, dword [rbp + 0xb0]
test eax, eax
jne 0x1800149cb
mov eax, 0x64
mov dword [rbp + 0xcc], eax
lea rax, reloc.WS2_32.dll_connect
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x948]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 0xcc]
mov rbx, qword [rbp + 0x128]
mov rsi, qword [rbp + 0x130]
lea rsp, [rbp + 0x950]
pop rbp
ret
mov eax, dword [rbp + 0x968]
test eax, eax
je 0x180014b17
mov rax, qword [rbp + 0x18]
mov edx, 0xffffffff
mov rcx, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov qword [rbp + 0x118], rcx
mov rcx, rax
mov rax, qword [rbp + 0x118]
call rax
mov dword [rbp + 0xb4], eax
mov byte [rbp + 0xa8], 1
mov rax, qword [rbp + 0x18]
lea rdx, [rbp + 8]
mov rcx, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov qword [rbp + 0x120], rcx
mov rcx, rax
mov rax, qword [rbp + 0x120]
call rax
mov dword [rbp + 0xbc], eax
mov eax, dword [rbp + 0xbc]
test eax, eax
jne 0x180014ab3
mov rax, qword [rbp + 0x20]
mov rdx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rax
call rdx
mov dword [rbp + 0xc4], eax
mov rax, qword [rbp + 0x18]
mov rdx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rax
call rdx
mov dword [rbp + 0xc8], eax
mov eax, 0x65
mov dword [rbp + 0xd0], eax
lea rax, reloc.WS2_32.dll_connect
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x948]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 0xd0]
mov rbx, qword [rbp + 0x128]
mov rsi, qword [rbp + 0x130]
lea rsp, [rbp + 0x950]
pop rbp
ret
movzx eax, byte [rbp + 0xa8]
test eax, eax
jne 0x180014acd
lea rax, [0x180101e8c]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 8]
mov dword [rbp + 0xd4], eax
lea rax, reloc.WS2_32.dll_connect
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x948]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 0xd4]
mov rbx, qword [rbp + 0x128]
mov rsi, qword [rbp + 0x130]
lea rsp, [rbp + 0x950]
pop rbp
ret
mov rax, qword [rbp + 0x20]
mov rdx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rax
call rdx
mov dword [rbp + 0xb8], eax
mov rax, qword [rbp + 0x18]
mov rdx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rax
call rdx
mov dword [rbp + 0xc0], eax
mov eax, 0
mov dword [rbp + 0xd8], eax
lea rax, reloc.WS2_32.dll_connect
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x948]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 0xd8]
mov rbx, qword [rbp + 0x128]
mov rsi, qword [rbp + 0x130]
lea rsp, [rbp + 0x950]
pop rbp
ret