Function at 0x140099040
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x908
mov qword [rsp + 0x828], 0xfffffffffffffffe
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x8f0], rax
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
lea rcx, [rsp + 0x4f0]
call fcn.14009cde0
call fcn.14009a5f0
mov qword [rsp + 0x4f8], rax
cmp qword [rsp + 0x4f8], 0
jne 0x14009909e
xor eax, eax
jmp 0x140099cd8
mov edx, 1
lea rcx, [0x14012cf58]
xor eax, eax
lock cmpxchg dword [rcx], edx
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x4f8]
movzx eax, byte [rax + 0x1298]
test eax, eax
jne 0x1400990d5
cmp dword [rsp + 0x78], 0
je 0x1400990d5
xor eax, eax
jmp 0x140099cd8
cmp dword [rsp + 0x78], 0
je 0x1400990f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xbaad0101
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [rsp + 0x630], 0
mov dword [rsp + 0x600], 0
xor eax, eax
mov word [rsp + 0xa0], ax
lea rdi, [rsp + 0xa2]
xor eax, eax
mov ecx, 0x410
rep stosb byte [rdi], al
lea rcx, [rsp + 0x608]
call fcn.140025640
nop
xor eax, eax
mov word [rsp + 0x570], ax
lea rdi, [rsp + 0x572]
xor eax, eax
mov ecx, 0x3e
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x5c0], ax
lea rdi, [rsp + 0x5c2]
xor eax, eax
mov ecx, 0x3e
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x58], ax
lea rdi, [rsp + 0x5a]
xor eax, eax
mov ecx, 0x1e
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x4c0], ax
lea rdi, [rsp + 0x4c2]
xor eax, eax
mov ecx, 0x1e
rep stosb byte [rdi], al
mov dword [rsp + 0x500], 0
lea rdi, [rsp + 0x508]
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov qword [rsp + 0x80], 0
lea rdi, [rsp + 0x88]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x4f8]
add rcx, 0x244
mov edx, 1
call fcn.1400a0720
mov rcx, qword [rsp + 0x4f8]
add rcx, 0x244
lea rdx, [0x1400f42d0]
call fcn.1400af0e8
test eax, eax
jne 0x14009922b
lea rcx, [0x1400f42f8]
call fcn.1400a0b30
cmp eax, 2
jb 0x14009922b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xbaad0103
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rax, qword [rsp + 0x4f8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x4e8], rax
cmp qword [rsp + 0x4f8], 0
jne 0x14009924f
jmp 0x140099c17
xor eax, eax
test eax, eax
jne 0x14009923f
mov rdi, qword [rsp + 0x4e8]
xor eax, eax
mov ecx, 0x1a00
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x4e8]
mov dword [rax], 0xc
mov rax, qword [rsp + 0x4e8]
mov dword [rax + 8], 0x1a00
mov rax, qword [rsp + 0x4e8]
mov dword [rax + 4], 0x90909090
mov rcx, qword [rsp + 0x4e8]
mov rax, qword [rsp + 0x4f8]
mov eax, dword [rax + 0x129c]
mov dword [rcx + 0x1978], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
mov rax, qword [rsp + 0x4e8]
mov dword [rax + 0x24], edx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov rax, qword [rsp + 0x4e8]
mov dword [rax + 0x20], edx
mov qword [rsp + 0x4e0], 0
mov rcx, qword [rsp + 0x4e8]
mov rax, qword [rsp + 0x4e0]
mov qword [rcx + 0x30], rax
mov qword [rsp + 0x638], 0
mov rcx, qword [rsp + 0x4e8]
mov rax, qword [rsp + 0x638]
mov qword [rcx + 0x40], rax
mov rax, qword [rsp + 0x4e8]
cmp qword [rax + 0x30], 0
je 0x14009935b
mov rax, qword [rsp + 0x4e8]
mov rax, qword [rax + 0x30]
mov rcx, qword [rsp + 0x4e8]
mov rax, qword [rax + 0x10]
mov qword [rcx + 0x18], rax
mov rax, qword [rsp + 0x4e8]
mov rax, qword [rax + 0x30]
mov rcx, qword [rsp + 0x4e8]
mov rax, qword [rax + 8]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x920]
mov rax, qword [rax]
cmp dword [rax], 0x88888888
jne 0x14009937f
mov rax, qword [rsp + 0x4e8]
mov byte [rax + 0x1971], 0
jmp 0x14009939c
mov rcx, qword [rsp + 0x4e8]
mov rax, qword [rsp + 0x4f8]
movzx eax, byte [rax + 0x1297]
mov byte [rcx + 0x1971], al
mov rcx, qword [rsp + 0x4e8]
mov rax, qword [rsp + 0x4f8]
movzx eax, byte [rax + 0x1294]
mov byte [rcx + 0x1973], al
mov rcx, qword [rsp + 0x4e8]
mov rax, qword [rsp + 0x4f8]
movzx eax, byte [rax + 0x1295]
mov byte [rcx + 0x1972], al
mov rcx, qword [rsp + 0x4e8]
mov rax, qword [rsp + 0x4f8]
movzx eax, byte [rax + 0x1298]
mov byte [rcx + 0x1970], al
mov rcx, qword [rsp + 0x4e8]
mov rax, qword [rsp + 0x920]
mov qword [rcx + 0x5c0], rax
mov r8, qword [rsp + 0x4f8]
add r8, 0x244
mov rcx, qword [rsp + 0x4e8]
add rcx, 0xa56
mov r9d, 0x104
mov edx, 0x105
call fcn.1400b233c
mov r8, qword [rsp + 0x4f8]
add r8, 0x658
mov rcx, qword [rsp + 0x4e8]
add rcx, 0x1074
mov r9d, 0x104
mov edx, 0x105
call fcn.1400b233c
mov r8, qword [rsp + 0x4f8]
add r8, 0x862
mov rcx, qword [rsp + 0x4e8]
add rcx, 0xc60
mov r9d, 0x104
mov edx, 0x105
call fcn.1400b233c
mov r8, qword [rsp + 0x4f8]
add r8, 0xa6c
mov rcx, qword [rsp + 0x4e8]
add rcx, 0xe6a
mov r9d, 0x104
mov edx, 0x105
call fcn.1400b233c
mov r8, qword [rsp + 0x4f8]
add r8, 0x44e
mov rcx, qword [rsp + 0x4e8]
add rcx, 0x127e
mov r9d, 0x104
mov edx, 0x105
call fcn.1400b233c
mov r8, qword [rsp + 0x4f8]
add r8, 0xe80
mov rcx, qword [rsp + 0x4e8]
add rcx, 0x14c6
mov r9d, 0x104
mov edx, 0x105
call fcn.1400b233c
mov r8, qword [rsp + 0x4f8]
add r8, 0x108a
mov rcx, qword [rsp + 0x4e8]
add rcx, 0x16d0
mov r9d, 0x104
mov edx, 0x105
call fcn.1400b233c
mov r8, qword [rsp + 0x4f8]
add r8, 0xc76
mov rcx, qword [rsp + 0x4e8]
add rcx, 0x1488
mov r9d, 0x1e
mov edx, 0x1f
call fcn.1400b233c
mov rcx, qword [rsp + 0x4e8]
add rcx, 0x18da
mov r9d, 0x1e
lea r8, [0x14012ce80]
mov edx, 0x1f
call fcn.1400b233c
mov rcx, qword [rsp + 0x4e8]
add rcx, 0x1918
mov r9d, 0x1e
lea r8, [0x14012ce40]
mov edx, 0x1f
call fcn.1400b233c
mov rcx, qword [rsp + 0x4e8]
add rcx, 0x197c
mov r9d, 0x1e
lea r8, [0x14012cf00]
mov edx, 0x1f
call fcn.1400b233c
mov rcx, qword [rsp + 0x4e8]
add rcx, 0x19ba
mov r9d, 0x1e
lea r8, [0x14012cec0]
mov edx, 0x1f
call fcn.1400b233c
mov rdx, qword [rsp + 0x4e8]
mov rax, qword [0x14012cf40]
mov qword [rdx + 0x1968], rax
mov rcx, qword [rsp + 0x4e8]
mov rax, qword [0x14012cf48]
mov qword [rcx + 0x1960], rax
mov rcx, qword [rsp + 0x4e8]
mov eax, dword [0x14012ce34]
mov dword [rcx + 0x1958], eax
mov rcx, qword [rsp + 0x4e8]
mov eax, dword [0x14012cf50]
mov dword [rcx + 0x195c], eax
mov r8, qword [rsp + 0x4f8]
add r8, 0x3a
mov rcx, qword [rsp + 0x4e8]
add rcx, 0x84c
mov r9d, 0x104
mov edx, 0x105
call fcn.1400b233c
mov rsi, qword [rsp + 0x920]
mov rsi, qword [rsi + 8]
mov rdi, qword [rsp + 0x4e8]
add rdi, 0xf0
mov ecx, 0x4d0
rep movsb byte [rdi], byte [rsi]
mov rsi, qword [rsp + 0x920]
mov rsi, qword [rsi]
mov rdi, qword [rsp + 0x4e8]
add rdi, 0x50
mov ecx, 0x98
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x98], 0x208
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xa0]
call fcn.14009b800
test eax, eax
je 0x14009970a
lea rdx, str.CrashReport64.exe
lea rcx, [rsp + 0xa0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
movzx eax, word [rsp + 0xa0]
test eax, eax
jne 0x14009971b
jmp 0x140099c17
xor eax, eax
test eax, eax
jne 0x14009970a
mov r9d, 0x10
mov r8d, 0x20
lea rdx, [rsp + 0x570]
mov rcx, qword [rsp + 0x4e8]
call fcn.1400afc20
mov r9d, 0xa
mov r8d, 0x20
lea rdx, [rsp + 0x5c0]
mov rcx, qword [rsp + 0x4f8]
mov rcx, qword [rcx + 0x12a0]
call fcn.1400afc20
mov rdx, qword [rsp + 0x4e8]
mov ecx, dword [rdx + 0x20]
mov r9d, 0xa
mov r8d, 0x10
lea rdx, [rsp + 0x58]
call fcn.1400afc20
mov rdx, qword [rsp + 0x4e8]
mov ecx, dword [rdx + 0x24]
mov r9d, 0xa
mov r8d, 0x10
lea rdx, [rsp + 0x4c0]
call fcn.1400afc20
lea r8, [0x1400f3eec]
lea rdx, [rsp + 0x608]
lea rcx, [rsp + 0x640]
call fcn.140037aa0
mov qword [rsp + 0x830], rax
mov rax, qword [rsp + 0x830]
mov qword [rsp + 0x838], rax
lea r8, [rsp + 0xa0]
mov rdx, qword [rsp + 0x838]
lea rcx, [rsp + 0x668]
call fcn.140037aa0
mov qword [rsp + 0x840], rax
mov rax, qword [rsp + 0x840]
mov qword [rsp + 0x848], rax
lea r8, [0x1400f435c]
mov rdx, qword [rsp + 0x848]
lea rcx, [rsp + 0x690]
call fcn.140037aa0
mov qword [rsp + 0x850], rax
mov rax, qword [rsp + 0x850]
mov qword [rsp + 0x858], rax
lea r8, str._BugInfo:
mov rdx, qword [rsp + 0x858]
lea rcx, [rsp + 0x6b8]
call fcn.140037aa0
mov qword [rsp + 0x860], rax
mov rax, qword [rsp + 0x860]
mov qword [rsp + 0x868], rax
lea r8, [rsp + 0x570]
mov rdx, qword [rsp + 0x868]
lea rcx, [rsp + 0x6e0]
call fcn.140037aa0
mov qword [rsp + 0x870], rax
mov rax, qword [rsp + 0x870]
mov qword [rsp + 0x878], rax
lea r8, [0x1400f3ecc]
mov rdx, qword [rsp + 0x878]
lea rcx, [rsp + 0x708]
call fcn.140037aa0
mov qword [rsp + 0x880], rax
mov rax, qword [rsp + 0x880]
mov qword [rsp + 0x888], rax
lea r8, [rsp + 0x58]
mov rdx, qword [rsp + 0x888]
lea rcx, [rsp + 0x730]
call fcn.140037aa0
mov qword [rsp + 0x890], rax
mov rax, qword [rsp + 0x890]
mov qword [rsp + 0x898], rax
lea r8, [0x1400f3e7c]
mov rdx, qword [rsp + 0x898]
lea rcx, [rsp + 0x758]
call fcn.140037aa0
mov qword [rsp + 0x8a0], rax
mov rax, qword [rsp + 0x8a0]
mov qword [rsp + 0x8a8], rax
lea r8, [rsp + 0x4c0]
mov rdx, qword [rsp + 0x8a8]
lea rcx, [rsp + 0x780]
call fcn.140037aa0
mov qword [rsp + 0x8b0], rax
mov rax, qword [rsp + 0x8b0]
mov qword [rsp + 0x8b8], rax
lea r8, [0x1400f3e5c]
mov rdx, qword [rsp + 0x8b8]
lea rcx, [rsp + 0x7a8]
call fcn.140037aa0
mov qword [rsp + 0x8c0], rax
mov rax, qword [rsp + 0x8c0]
mov qword [rsp + 0x8c8], rax
lea r8, [rsp + 0x5c0]
mov rdx, qword [rsp + 0x8c8]
lea rcx, [rsp + 0x7d0]
call fcn.140037aa0
mov qword [rsp + 0x8d0], rax
mov rax, qword [rsp + 0x8d0]
mov qword [rsp + 0x8d8], rax
lea r8, [0x1400f3e0c]
mov rdx, qword [rsp + 0x8d8]
lea rcx, [rsp + 0x7f8]
call fcn.140037aa0
mov qword [rsp + 0x8e0], rax
mov rax, qword [rsp + 0x8e0]
mov qword [rsp + 0x8e8], rax
mov rdx, qword [rsp + 0x8e8]
lea rcx, [rsp + 0x608]
call fcn.140027250
nop
lea rcx, [rsp + 0x7f8]
call fcn.140020350
nop
lea rcx, [rsp + 0x7d0]
call fcn.140020350
nop
lea rcx, [rsp + 0x7a8]
call fcn.140020350
nop
lea rcx, [rsp + 0x780]
call fcn.140020350
nop
lea rcx, [rsp + 0x758]
call fcn.140020350
nop
lea rcx, [rsp + 0x730]
call fcn.140020350
nop
lea rcx, [rsp + 0x708]
call fcn.140020350
nop
lea rcx, [rsp + 0x6e0]
call fcn.140020350
nop
lea rcx, [rsp + 0x6b8]
call fcn.140020350
nop
lea rcx, [rsp + 0x690]
call fcn.140020350
nop
lea rcx, [rsp + 0x668]
call fcn.140020350
nop
lea rcx, [rsp + 0x640]
call fcn.140020350
lea rcx, [rsp + 0x608]
call fcn.140029df0
cmp rax, 0x208
jb 0x140099af8
jmp 0x140099c17
xor eax, eax
test eax, eax
jne 0x140099ade
lea rcx, [rsp + 0x608]
call fcn.140029dd0
mov r9d, 0x207
mov r8, rax
mov edx, 0x208
lea rcx, [rsp + 0xa0]
call fcn.1400b233c
mov dword [rsp + 0x604], 0
lea rcx, [rsp + 0x604]
call fcn.140098f80
mov dword [rsp + 0x5b0], eax
cmp dword [rsp + 0x5b0], 0
jne 0x140099b65
mov rax, qword [rsp + 0x4f8]
movzx eax, byte [rax + 0x1295]
mov dword [rsp + 0x604], eax
cmp dword [rsp + 0x604], 0
je 0x140099b87
xor edx, edx
lea rcx, [rsp + 0xa0]
call fcn.140099d00
mov dword [rsp + 0x600], eax
jmp 0x140099beb
mov dword [rsp + 0x500], 0x68
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x500]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xa0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x600], eax
cmp dword [rsp + 0x600], 0
jne 0x140099bf7
jmp 0x140099c17
xor eax, eax
test eax, eax
jne 0x140099beb
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x4f8]
mov rcx, qword [rcx + 0x12a0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp qword [rsp + 0x80], 0
je 0x140099c30
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x88], 0
je 0x140099c49
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x600], 0
je 0x140099cb9
mov rax, qword [rsp + 0x4f8]
movzx eax, byte [rax + 0x1296]
test eax, eax
je 0x140099cb9
mov rax, qword [rsp + 0x4f8]
movzx eax, byte [rax + 0x1298]
test eax, eax
je 0x140099cb9
mov dword [rsp + 0x630], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xbaad0102
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, 0xbaad0102
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor edx, edx
mov rcx, qword [rsp + 0x4f8]
call fcn.140098e70
mov dword [rsp + 0x820], 0
lea rcx, [rsp + 0x608]
call fcn.140020350
mov eax, dword [rsp + 0x820]
mov rcx, qword [rsp + 0x8f0]
xor rcx, rsp
call fcn.1400ad2c0
add rsp, 0x908
pop rdi
pop rsi
ret