Function at 0x140015860
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x14012a210]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov r14d, r9d
movzx esi, r8b
mov rdi, rdx
mov rbx, rcx
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x30], rdx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
mov dword [rbp], 0x68
mov eax, 5
mov word [rbp + 0x40], ax
mov rcx, qword [rcx + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 1
jb 0x140015d5c
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400158fc
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 1
lea r9, [0x1401001c0]
lea rcx, [rbp - 0x70]
call fcn.140012680
nop
mov r8d, 1
lea rdx, [0x1401001c0]
lea rcx, [rbp - 0x70]
call fcn.140012440
xor r15d, r15d
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea r8d, [r15 + 1]
lea rdx, [0x1401001bc]
lea rcx, [rsp + 0x70]
call fcn.140012440
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400159b8
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rsp + 0x50]
call fcn.140012440
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140015a27
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015a22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015d62
call fcn.1400a59a4
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140015a7c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015a77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015d68
call fcn.1400a59a4
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r15w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x140015ace
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015ac9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015d6e
call fcn.1400a59a4
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140015c01
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140015b5b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015b56
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015d74
call fcn.1400a59a4
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r15w
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140015bab
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140015ba6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140015d50
mov rcx, r8
call fcn.1400a59a4
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140015bfa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140015bf5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140015d56
mov rcx, r8
call fcn.1400a59a4
xor eax, eax
jmp 0x140015d1d
test sil, sil
je 0x140015c21
mov edx, r14d
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp - 0x38]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140015c7d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015c78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015d74
call fcn.1400a59a4
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r15w
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140015ccd
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140015cc8
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140015d50
mov rcx, r8
call fcn.1400a59a4
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140015d18
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140015d13
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140015d56
mov rcx, r8
call fcn.1400a59a4
mov eax, 1
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 7
mov word [rdi], r15w
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1400a5460
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x180
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400b4704
nop
call fcn.1400b4704
nop
call fcn.140003f10
nop
call fcn.1400b4704
nop
call fcn.1400b4704
nop
call fcn.1400b4704
int3
call fcn.1400b4704
int3