Function at 0x14003e900
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x390
mov rax, qword [0x14034e010]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov rax, qword [rsp + 0x3a0]
movzx eax, byte [rax + 0xc64]
test eax, eax
jne 0x14003e955
movzx eax, byte [0x14034ecfb]
test eax, eax
je 0x14003e955
movzx eax, byte [0x14035f9b6]
test eax, eax
jne 0x14003e955
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14003e91f
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x32]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x40], al
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x48], al
movzx eax, byte [rsp + 0x32]
mov byte [rsp + 0x50], al
movabs rax, 0x2a68bd082693c00d
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x240], rax
movabs rax, 0xc427e7653be1ac68
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x248], rax
lea rax, [rsp + 0x240]
mov qword [rsp + 0xc0], rax
movabs rax, 0x2a68bd0843eba523
mov qword [rsp + 0x360], rax
movabs rax, 0xc427e7653be1ac68
mov qword [rsp + 0x368], rax
lea rax, [rsp + 0x33]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x33]
mov byte [rsp + 0x58], al
movdqa xmm0, xmmword [rsp + 0x360]
movdqa xmmword [rsp + 0x2b0], xmm0
mov rax, qword [rsp + 0xc0]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x2a0], xmm0
movdqa xmm0, xmmword [rsp + 0x2a0]
pxor xmm0, xmmword [rsp + 0x2b0]
movdqa xmmword [rsp + 0x2c0], xmm0
mov rax, qword [rsp + 0xc0]
movdqa xmm0, xmmword [rsp + 0x2c0]
movdqu xmmword [rax], xmm0
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x3a0]
add rax, 0x400
mov rdx, qword [rsp + 0x130]
mov rcx, rax
call fcn.1402cd23c
test rax, rax
je 0x14003f41e
lea rdx, [0x140331cd4]
lea rcx, [rsp + 0x300]
call fcn.14001ea10
nop
mov rax, qword [rsp + 0x310]
mov qword [rsp + 0x138], rax
cmp qword [rsp + 0x138], 0xc
jae 0x14003eb52
mov rax, qword [rsp + 0x310]
mov qword [rsp + 0x140], rax
cmp qword [rsp + 0x140], 0
jne 0x14003eb1b
mov dword [rsp + 0x84], 1
jmp 0x14003eb26
mov dword [rsp + 0x84], 0
movzx eax, byte [rsp + 0x84]
mov byte [rsp + 0x34], al
movzx eax, byte [rsp + 0x34]
test eax, eax
jne 0x14003eb52
lea rdx, [rsp + 0x300]
lea rcx, [rsp + 0x300]
call fcn.14001e8e0
jmp 0x14003eb62
xor edx, edx
lea rcx, [rsp + 0x300]
call fcn.1400294e0
nop
mov rax, qword [rsp + 0x310]
mov qword [rsp + 0x148], rax
cmp qword [rsp + 0x148], 0
jne 0x14003eb8a
mov dword [rsp + 0x88], 1
jmp 0x14003eb95
mov dword [rsp + 0x88], 0
movzx eax, byte [rsp + 0x88]
mov byte [rsp + 0x35], al
movzx eax, byte [rsp + 0x35]
test eax, eax
je 0x14003ec36
mov edx, 7
lea rcx, [rsp + 0x300]
call fcn.140168960
lea rax, str.Cleaner
mov qword [rsp + 0x150], rax
mov qword [rsp + 0xa0], 0xffffffffffffffff
inc qword [rsp + 0xa0]
mov rax, qword [rsp + 0x150]
mov rcx, qword [rsp + 0xa0]
cmp byte [rax + rcx], 0
jne 0x14003ebdb
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x160], rax
mov r8, qword [rsp + 0x160]
lea rdx, str.Cleaner
lea rcx, [rsp + 0x300]
call fcn.140021ce0
nop
lea rcx, [rsp + 0x300]
call fcn.140021a50
lea rdx, [0x140331cd4]
lea rcx, [rsp + 0x320]
call fcn.14001ea10
nop
mov rax, qword [rsp + 0x330]
mov qword [rsp + 0x168], rax
cmp qword [rsp + 0x168], 0xc
jae 0x14003ecd2
mov rax, qword [rsp + 0x330]
mov qword [rsp + 0x170], rax
cmp qword [rsp + 0x170], 0
jne 0x14003ec9b
mov dword [rsp + 0x8c], 1
jmp 0x14003eca6
mov dword [rsp + 0x8c], 0
movzx eax, byte [rsp + 0x8c]
mov byte [rsp + 0x36], al
movzx eax, byte [rsp + 0x36]
test eax, eax
jne 0x14003ecd2
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x320]
call fcn.14001e8e0
jmp 0x14003ece2
xor edx, edx
lea rcx, [rsp + 0x320]
call fcn.1400294e0
nop
mov rax, qword [rsp + 0x330]
mov qword [rsp + 0x178], rax
cmp qword [rsp + 0x178], 0
jne 0x14003ed0a
mov dword [rsp + 0x90], 1
jmp 0x14003ed15
mov dword [rsp + 0x90], 0
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x37], al
movzx eax, byte [rsp + 0x37]
test eax, eax
je 0x14003edb6
mov edx, 7
lea rcx, [rsp + 0x320]
call fcn.140168960
lea rax, str.Cleaner
mov qword [rsp + 0x180], rax
mov qword [rsp + 0xa8], 0xffffffffffffffff
inc qword [rsp + 0xa8]
mov rax, qword [rsp + 0x180]
mov rcx, qword [rsp + 0xa8]
cmp byte [rax + rcx], 0
jne 0x14003ed5b
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x188], rax
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x190], rax
mov r8, qword [rsp + 0x190]
lea rdx, str.Cleaner
lea rcx, [rsp + 0x320]
call fcn.140021ce0
nop
lea rcx, [rsp + 0x320]
call fcn.140021a50
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x39]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x3a]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
mov rax, qword [0x14034ed78]
xor rax, 0x8b78
imul rax, rax, 0
imul rax, rax, 9
mov qword [rsp + 0x198], rax
imul rcx, qword [0x14034ed70], 0x8b78
xor edx, edx
mov rax, rcx
mov ecx, 4
div rcx
mov rcx, qword [rsp + 0x198]
add rcx, rax
mov rax, rcx
xor rax, 4
mov rcx, rax
call fcn.14002ffc0
mov dword [rsp + 0xb8], eax
movzx eax, byte [rsp + 0x38]
mov byte [rsp + 0x60], al
movzx eax, byte [rsp + 0x39]
mov byte [rsp + 0x68], al
movzx eax, byte [rsp + 0x3a]
mov byte [rsp + 0x70], al
movabs rax, 0x2a68bd082d8ed54c
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x250], rax
movabs rax, 0xc427e7653be1ac68
mov qword [rsp + 0x1a8], rax
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x258], rax
lea rax, [rsp + 0x250]
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0x260]
mov qword [rsp + 0xd0], rax
movabs rax, 0x2a68bd0843eba523
mov qword [rsp + 0x370], rax
movabs rax, 0xc427e7653be1ac68
mov qword [rsp + 0x378], rax
lea rax, [rsp + 0x3b]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x3b]
mov byte [rsp + 0x78], al
movdqa xmm0, xmmword [rsp + 0x370]
movdqa xmmword [rsp + 0x2e0], xmm0
mov rax, qword [rsp + 0xc8]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x2d0], xmm0
movdqa xmm0, xmmword [rsp + 0x2d0]
pxor xmm0, xmmword [rsp + 0x2e0]
movdqa xmmword [rsp + 0x2f0], xmm0
mov rax, qword [rsp + 0xc8]
movdqa xmm0, xmmword [rsp + 0x2f0]
movdqu xmmword [rax], xmm0
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x3a0]
add rax, 0x800
mov rcx, qword [rsp + 0x3a0]
add rcx, 0x400
mov edx, dword [rsp + 0xb8]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], 0
mov r9, rax
mov r8, rcx
mov rdx, qword [rsp + 0xd0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x140360448], eax
jle 0x14003f043
lea rcx, [0x140360448]
call fcn.140269f54
cmp dword [0x140360448], 0xffffffff
jne 0x14003f043
lea rax, [0x140360450]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [0x140360450]
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
mov rcx, rax
call fcn.14002f340
lea rax, [0x140360450]
mov qword [rsp + 0x268], rax
lea rcx, [0x140310560]
call fcn.140269d78
lea rcx, [0x140360448]
call fcn.140269ef4
lea rax, [0x140360450]
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xd8]
mov rcx, qword [rcx]
mov rax, qword [rax + 8]
sub rax, rcx
sar rax, 3
mov qword [rsp + 0x1b8], rax
cmp qword [rsp + 0x1b8], 0x123
jae 0x14003f210
mov byte [rsp + 0x3c], 1
lea rax, [0x140360450]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xe0]
mov rcx, qword [rcx]
mov rax, qword [rax + 8]
sub rax, rcx
sar rax, 3
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x1c0]
xor rax, 0xaac
mov qword [rsp + 0x1c8], rax
mov rax, qword [rsp + 0x270]
mov qword [rsp + 0xe8], rax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0xf8], rax
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0xf8], rax
movzx eax, byte [rsp + 0x80]
mov byte [rsp + 0x3d], al
movzx eax, byte [rsp + 0x3d]
mov byte [rsp + 0x81], al
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0xf0], rax
movzx eax, byte [rsp + 0x82]
mov byte [rsp + 0x83], al
lea rax, [rsp + 0x100]
mov qword [rsp + 0x1d8], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x1d0], rax
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x1d8]
mov rcx, qword [rsp + 0x1e0]
movzx ecx, byte [rcx]
mov byte [rax], cl
lea rax, [rsp + 0x104]
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x1e8], rax
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x1f8], rax
mov rax, qword [rsp + 0x1f0]
mov rcx, qword [rsp + 0x1f8]
mov ecx, dword [rcx]
mov dword [rax], ecx
lea rax, [rsp + 0x100]
mov qword [rsp + 0x200], rax
mov rdx, qword [rsp + 0x200]
lea rcx, [0x140360450]
call fcn.140167a10
jmp 0x14003f29e
lea rax, [0x140360450]
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0x108]
add rax, 8
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x110]
mov rax, qword [rax]
mov qword [rsp + 0x288], rax
mov rax, qword [rsp + 0x118]
mov rax, qword [rax]
mov qword [rsp + 0x290], rax
lea rax, [0x140360450]
mov qword [rsp + 0x208], rax
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x298], rax
mov rax, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x118]
mov rcx, qword [rcx]
mov qword [rax], rcx
lea rdx, [0x140331cd4]
lea rcx, [rsp + 0x340]
call fcn.14001ea10
nop
mov rax, qword [rsp + 0x350]
mov qword [rsp + 0x210], rax
cmp qword [rsp + 0x210], 0xc
jae 0x14003f32d
mov rax, qword [rsp + 0x350]
mov qword [rsp + 0x218], rax
cmp qword [rsp + 0x218], 0
jne 0x14003f2f6
mov dword [rsp + 0x94], 1
jmp 0x14003f301
mov dword [rsp + 0x94], 0
movzx eax, byte [rsp + 0x94]
mov byte [rsp + 0x3e], al
movzx eax, byte [rsp + 0x3e]
test eax, eax
jne 0x14003f32d
lea rdx, [rsp + 0x340]
lea rcx, [rsp + 0x340]
call fcn.14001e8e0
jmp 0x14003f33d
xor edx, edx
lea rcx, [rsp + 0x340]
call fcn.1400294e0
nop
mov rax, qword [rsp + 0x350]
mov qword [rsp + 0x220], rax
cmp qword [rsp + 0x220], 0
jne 0x14003f365
mov dword [rsp + 0x98], 1
jmp 0x14003f370
mov dword [rsp + 0x98], 0
movzx eax, byte [rsp + 0x98]
mov byte [rsp + 0x3f], al
movzx eax, byte [rsp + 0x3f]
test eax, eax
je 0x14003f411
mov edx, 7
lea rcx, [rsp + 0x340]
call fcn.140168960
lea rax, str.Cleaner
mov qword [rsp + 0x228], rax
mov qword [rsp + 0xb0], 0xffffffffffffffff
inc qword [rsp + 0xb0]
mov rax, qword [rsp + 0x228]
mov rcx, qword [rsp + 0xb0]
cmp byte [rax + rcx], 0
jne 0x14003f3b6
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0x230]
mov qword [rsp + 0x238], rax
mov r8, qword [rsp + 0x238]
lea rdx, str.Cleaner
lea rcx, [rsp + 0x340]
call fcn.140021ce0
nop
lea rcx, [rsp + 0x340]
call fcn.140021a50
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.140269760
add rsp, 0x390
pop rdi
ret