Function at 0x1400b79cc
Capabilities:
Create process on windows
Print debug messages
Write and execute a file
Write file on windows

Disassembly:
jmp 0x14010f180
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r15
lea rbp, [rsp - 0x470]
sub rsp, 0x570
mov rax, qword [0x14027e3d8]
xor rax, rsp
mov qword [rbp + 0x460], rax
mov rax, qword [rcx + 8]
mov rdi, rcx
movsxd rcx, dword [rax + 4]
mov rax, qword [rcx + rdi + 0x48]
mov rbx, qword [rax + 8]
mov rcx, rbx
mov qword [rsp + 0x58], rbx
mov rax, qword [rbx]
call qword [rax + 8]
lea rcx, [rsp + 0x50]
call fcn.1400bad39
mov dl, 0xa
mov rcx, rax
mov r8, qword [rax]
call qword [r8 + 0x40]
movzx esi, al
test rbx, rbx
je 0x14010f208
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x10]
test rax, rax
je 0x14010f208
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
movzx edx, sil
lea rcx, [rdi + 8]
call fcn.1400b6e7d
lea rcx, [rdi + 8]
call fcn.1400b5320
mov ecx, dword [rdi + 0x80]
xor eax, eax
xor r12d, r12d
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
mov qword [rbp - 0x10], r12
mov eax, ecx
mov qword [rbp - 8], 0xf
and al, 0x22
movups xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x20], r12b
movups xmmword [rsp + 0x50], xmm0
cmp al, 2
je 0x14010f273
mov rax, qword [rdi + 0x50]
mov r8, qword [rax]
test r8, r8
je 0x14010f273
cmp r8, qword [rdi + 0x78]
mov rax, qword [rdi + 0x30]
cmovb r8, qword [rdi + 0x78]
mov rdx, qword [rax]
sub r8, rdx
jmp 0x14010f2a4
test cl, 4
jne 0x14010f29a
mov rax, qword [rdi + 0x48]
mov rcx, qword [rax]
test rcx, rcx
je 0x14010f29a
mov rax, qword [rdi + 0x28]
mov rdx, qword [rax]
mov rax, qword [rdi + 0x60]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x14010f2a4
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x14010f2b2
lea rcx, [rbp - 0x20]
call fcn.1400b8773
mov rax, qword [0x1402818b8]
mov qword [rsp + 0x5a8], r14
test rax, rax
je 0x14010f2f0
mov r9, qword [rdi + 0xf0]
lea rcx, [rbp - 0x20]
mov r8d, dword [rdi + 0x100]
mov rdx, qword [rdi + 0xf8]
mov qword [rsp + 0x20], rcx
mov ecx, dword [rdi]
call rax
test al, al
jne 0x14010f59e
test byte [0x14027e268], 2
je 0x14010f30f
cmp qword [rbp - 8], 0x10
lea rcx, [rbp - 0x20]
cmovae rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x14010f314
cmp dword [rdi], 2
jl 0x14010f350
cmp qword [rbp - 8], 0x10
lea rbx, [rbp - 0x20]
mov ecx, 2
cmovae rbx, qword [rbp - 0x20]
call fcn.1400bd458
mov r8, rbx
lea rdx, [0x140241ad4]
mov rcx, rax
call fcn.1400bba86
mov ecx, 2
call fcn.1400bd458
mov rcx, rax
call fcn.1400bb41e
test byte [0x14027e268], 1
je 0x14010f4f9
xor edx, edx
xor ecx, ecx
call fcn.140111b00
cmp dword [0x1402818d0], r12d
jne 0x14010f383
mov rcx, qword [0x1402818c8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x14010f38f
mov rcx, qword [0x1402818c0]
call fcn.1400b59e7
call fcn.140111f10
test al, al
je 0x14010f4d5
mov rcx, qword [0x140281898]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp qword [rbp - 8], 0x10
lea r14, [rbp - 0x20]
mov rsi, qword [rbp - 0x10]
movabs rbx, 0x7fffffffffffffff
cmovae r14, qword [rbp - 0x20]
xorps xmm0, xmm0
mov qword [rbp + 0x10], r12
movups xmmword [rbp], xmm0
cmp rsi, rbx
ja 0x14010f8bf
mov qword [rbp + 0x18], 0xf
cmp rsi, 0x10
jae 0x14010f40a
mov r8d, 0x10
mov qword [rbp + 0x10], rsi
mov rdx, r14
lea rcx, [rbp]
call fcn.1400bd2d2
jmp 0x14010f44d
mov rax, rsi
or rax, 0xf
cmp rax, rbx
ja 0x14010f425
mov ecx, 0x16
mov rbx, rax
cmp rax, rcx
cmovb rbx, rcx
lea rdx, [rbx + 1]
lea rcx, [rbp]
call fcn.1400bbd38
lea r8, [rsi + 1]
mov qword [rbp], rax
mov rdx, r14
mov qword [rbp + 0x10], rsi
mov rcx, rax
mov qword [rbp + 0x18], rbx
call fcn.1400b8bfb
call fcn.1400b9e07
mov rcx, rax
lea rdx, [rbp]
xor r8d, r8d
call fcn.1400b9993
cmp qword [rbp + 0x18], 0x10
lea rdx, [rbp]
mov r8d, dword [rbp + 0x10]
lea r9, [rsp + 0x68]
cmovae rdx, qword [rbp]
mov rcx, qword [0x140281898]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x14010f4c5
mov rcx, qword [rbp]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f4c0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010f8c5
call fcn.1400bb464
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
mov byte [rbp], r12b
cmp dword [0x1402818d0], r12d
jne 0x14010f4ed
mov rcx, qword [0x1402818c8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x14010f4f9
mov rcx, qword [0x1402818c0]
call fcn.1400b9f79
mov eax, dword [rdi]
cmp eax, 4
jne 0x14010f626
mov r8d, 0x400
lea rdx, [rbp - 0x20]
cmp qword [rbp - 0x10], r8
lea rcx, [rbp + 0x60]
cmovb r8, qword [rbp - 0x10]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
call fcn.1400b8bfb
lea rcx, [rbp + 0x60]
call fcn.1400b8589
call fcn.1400b59ab
test al, al
jne 0x14010f61c
cmp qword [0x1402818a8], r12
je 0x14010f61c
lea rdx, [rbp + 0x20]
lea rcx, [rdi + 8]
call fcn.1400b93d5
mov rcx, rax
call qword [0x1402818a8]
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x14010f59e
mov rcx, qword [rbp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f599
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010f8cb
call fcn.1400bb464
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14010f5d9
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f5d4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010f8a7
call fcn.1400bb464
mov ecx, dword [rdi + 0x104]
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rdi + 8]
call fcn.1400bbe37
mov r14, qword [rsp + 0x5a8]
mov rcx, qword [rbp + 0x460]
xor rcx, rsp
call fcn.1400b8bba
mov rbx, qword [rsp + 0x5b0]
add rsp, 0x570
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400ba997
jmp 0x14010f59e
cmp eax, 3
jne 0x14010f59e
cmp qword [0x1402818b0], r12
lea rcx, [rdi + 8]
je 0x14010f691
lea rdx, [rbp + 0x20]
call fcn.1400b93d5
mov rcx, rax
call qword [0x1402818b0]
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x14010f59e
mov rcx, qword [rbp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f599
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010f8ad
jmp 0x14010f599
lea rdx, [rbp + 0x40]
call fcn.1400b93d5
mov rbx, rax
cmp qword [rax + 0x10], r12
lea rsi, [rax + 0x10]
je 0x14010f766
cmp byte [0x1402818a3], r12b
je 0x14010f766
mov r8d, 0x104
lea rdx, [rbp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x5c
lea rcx, [rbp + 0x60]
call fcn.1400bb58b
test rax, rax
je 0x14010f6e2
mov word [rax + 2], r12w
lea r8, str.debug_message.exe
mov edx, 0x104
lea rcx, [rbp + 0x60]
call fcn.1400b83b8
cmp qword [rbx + 0x18], 0x10
jb 0x14010f701
mov rbx, qword [rbx]
mov rax, qword [rsi]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rbx
call fcn.1400b9209
cmp qword [rbp + 0x30], r12
jne 0x14010f7a9
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x14010f766
mov rcx, qword [rbp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f761
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010f8b9
call fcn.1400bb464
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x14010f59e
mov rcx, qword [rbp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f599
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010f8b3
jmp 0x14010f599
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x68
xor eax, eax
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
lea rcx, [rbp + 0x60]
mov dword [rbp - 0x2c], eax
lea rax, [rbp]
cmovae rdx, qword [rbp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14010f840
mov rcx, qword [rbp]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14010f863
cmp qword [rbp + 0x38], 8
lea rdx, [rbp + 0x20]
mov r9d, 0x40010
lea r8, str.Fatal_error
cmovae rdx, qword [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x14010f766
mov rcx, qword [rbp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f761
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010f8b9
jmp 0x14010f761
call fcn.1400b7864
int3
call fcn.1400b7864
int3
call fcn.1400b7864
int3
call fcn.1400b7864
int3
call fcn.1400b8e3a
int3
call fcn.1400b7864
int3
call fcn.1400b7864
int3