Function at 0x140004000
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push rbp
push rsi
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x18], r8
mov dword [rbp - 0xc], edx
mov qword [rbp - 8], rcx
mov rax, qword [0x140021048]
xor rax, rbp
mov qword [rbp], rax
mov ecx, dword [0x140021b38]
mov eax, dword [0x140021b3c]
mov edx, ecx
add edx, 0x443f28b0
sub edx, 1
sub edx, 0x443f28b0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 0
mov al, cl
and al, 0
and r11b, dl
mov r9b, r8b
and r9b, 0
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x1400040a1
jmp 0x1400048a5
mov r8, qword [rbp - 8]
mov r10d, dword [rbp - 0xc]
mov r11, qword [rbp - 0x18]
mov eax, 0x10
mov qword [rbp - 0x58], rax
call fcn.140005920
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov rcx, rsp
mov qword [rbp - 0x30], rcx
call fcn.140005920
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov r9, rsp
mov qword [rbp - 0x70], r9
call fcn.140005920
sub rsp, rax
mov rdx, rsp
mov qword [rbp - 0x68], rdx
mov eax, 0x70
call fcn.140005920
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x60], rax
mov eax, 0x20
mov qword [rbp - 0x40], rax
call fcn.140005920
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov rcx, rsp
mov qword [rbp - 0x50], rcx
call fcn.140005920
sub rsp, rax
mov rcx, rsp
mov qword [rbp - 0x48], rcx
mov eax, 0x400
call fcn.140005920
sub rsp, rax
mov rax, qword [rbp - 0x40]
mov rsi, rsp
mov qword [rbp - 0x38], rsi
call fcn.140005920
sub rsp, rax
mov rax, qword [rbp - 0x30]
mov rsi, rsp
mov qword [rbp - 0x28], rsi
mov qword [rax], r11
mov dword [r9], r10d
mov qword [rdx], r8
mov qword [rcx], 0
cmp qword [rax], 0
sete al
mov byte [rbp - 0x19], al
mov ecx, dword [0x140021b38]
mov eax, dword [0x140021b3c]
mov edx, ecx
sub edx, 0x295fa9e8
sub edx, 1
add edx, 0x295fa9e8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x1400041b3
jmp 0x1400048a5
mov al, byte [rbp - 0x19]
test al, 1
jne 0x140004274
jmp 0x1400041c3
mov ecx, dword [0x140021b38]
mov eax, dword [0x140021b3c]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140004202
jmp 0x140004921
mov rax, qword [rbp - 0x30]
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.140009840
add rsp, 0x20
cmp rax, 0
sete al
mov byte [rbp - 0x71], al
mov ecx, dword [0x140021b38]
mov eax, dword [0x140021b3c]
mov edx, ecx
add edx, 0xfa4229a8
sub edx, 1
sub edx, 0xfa4229a8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140004264
jmp 0x140004921
mov al, byte [rbp - 0x71]
test al, 1
jne 0x140004274
jmp 0x14000430f
mov ecx, dword [0x140021b38]
mov eax, dword [0x140021b3c]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x1400042b3
jmp 0x14000493a
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x48]
mov qword [rax], rcx
mov ecx, dword [0x140021b38]
mov eax, dword [0x140021b3c]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x14000430a
jmp 0x14000493a
jmp 0x14000451a
mov rcx, qword [rbp - 0x60]
xor edx, edx
mov r8d, 0x68
sub rsp, 0x20
call fcn.140006d80
mov rax, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x50]
add rsp, 0x20
mov dword [rax], 0x68
xor edx, edx
mov r8d, 0x18
sub rsp, 0x20
call fcn.140006d80
mov rax, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x38]
add rsp, 0x20
mov r9, qword [rax]
sub rsp, 0x20
lea r8, [0x14001c3a2]
mov edx, 0x400
call fcn.140001f30
mov rdx, qword [rbp - 0x38]
mov r10, qword [rbp - 0x60]
add rsp, 0x20
mov rax, qword [rbp - 0x50]
xor ecx, ecx
mov r9d, ecx
sub rsp, 0x50
mov rcx, r9
mov r8, r9
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
add rsp, 0x50
cmp eax, 0
jne 0x14000447f
mov ecx, dword [0x140021b38]
mov eax, dword [0x140021b3c]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 0
mov al, cl
and al, 0
and r11b, dl
mov r9b, r8b
and r9b, 0
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x14000443b
jmp 0x140004957
mov ecx, dword [0x140021b38]
mov eax, dword [0x140021b3c]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x14000447a
jmp 0x140004957
jmp 0x1400047a4
mov ecx, dword [0x140021b38]
mov eax, dword [0x140021b3c]
mov edx, ecx
add edx, 0xf76d7654
sub edx, 1
sub edx, 0xf76d7654
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x1400044c3
jmp 0x14000495c
mov rax, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
mov rcx, qword [rcx]
mov qword [rax], rcx
mov ecx, dword [0x140021b38]
mov eax, dword [0x140021b3c]
mov edx, ecx
sub edx, 0x7bc75ee8
sub edx, 1
add edx, 0x7bc75ee8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140004515
jmp 0x14000495c
jmp 0x14000451a
mov ecx, dword [0x140021b38]
mov eax, dword [0x140021b3c]
mov edx, ecx
add edx, 0x447081db
sub edx, 1
sub edx, 0x447081db
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 0
mov al, cl
and al, 0
and r11b, dl
mov r9b, r8b
and r9b, 0
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x140004591
jmp 0x14000496f
mov rax, qword [rbp - 0x48]
cmp qword [rax], 0
setne al
mov byte [rbp - 0x72], al
mov ecx, dword [0x140021b38]
mov eax, dword [0x140021b3c]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x1400045de
jmp 0x14000496f
mov al, byte [rbp - 0x72]
test al, 1
jne 0x1400046a9
jmp 0x1400045ee
mov ecx, dword [0x140021b38]
mov eax, dword [0x140021b3c]
mov edx, ecx
sub edx, 0x6b6ddb70
sub edx, 1
add edx, 0x6b6ddb70
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140004632
jmp 0x140004974
mov ecx, dword [0x140021b38]
mov eax, dword [0x140021b3c]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 0
mov al, cl
and al, 0
and r11b, dl
mov r9b, r8b
and r9b, 0
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x1400046a4
jmp 0x140004974
jmp 0x1400047a4
mov ecx, dword [0x140021b38]
mov eax, dword [0x140021b3c]
mov edx, ecx
add edx, 0x72d5a8f8
sub edx, 1
sub edx, 0x72d5a8f8
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x1400046ed
jmp 0x140004979
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
movsxd r9, dword [r9]
mov r8, qword [r8]
mov rcx, qword [rcx]
mov r10, qword [rax]
mov qword [rdx], r10
mov r10, qword [rax + 8]
mov qword [rdx + 8], r10
mov rax, qword [rax + 0x10]
mov qword [rdx + 0x10], rax
sub rsp, 0x20
call fcn.140003930
add rsp, 0x20
mov ecx, dword [0x140021b38]
mov eax, dword [0x140021b3c]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 0
mov al, cl
and al, 0
and r11b, dl
mov r9b, r8b
and r9b, 0
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x14000479f
jmp 0x140004979
jmp 0x1400047a4
mov ecx, dword [0x140021b38]
mov eax, dword [0x140021b3c]
mov edx, ecx
sub edx, 0x380a0811
sub edx, 1
add edx, 0x380a0811
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and r11b, dl
mov r9b, r8b
and r9b, 0xff
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x14000481b
jmp 0x1400049be
mov ecx, dword [0x140021b38]
mov eax, dword [0x140021b3c]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 0
mov al, cl
and al, 0
and r11b, dl
mov r9b, r8b
and r9b, 0
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x14000488d
jmp 0x1400049be
mov rcx, qword [rbp]
xor rcx, rbp
sub rsp, 0x20
call fcn.140005990
nop
lea rsp, [rbp + 8]
pop rsi
pop rbp
ret
mov rdx, qword [rbp - 8]
mov r9d, dword [rbp - 0xc]
mov r11, qword [rbp - 0x18]
mov eax, 0x10
mov qword [rbp - 0x80], rax
call fcn.140005920
sub rsp, rax
mov rax, qword [rbp - 0x80]
mov r10, rsp
call fcn.140005920
sub rsp, rax
mov rax, qword [rbp - 0x80]
mov r8, rsp
call fcn.140005920
sub rsp, rax
mov rcx, rsp
mov eax, 0x70
call fcn.140005920
sub rsp, rax
mov eax, 0x20
call fcn.140005920
sub rsp, rax
mov rax, qword [rbp - 0x80]
call fcn.140005920
sub rsp, rax
mov rax, rsp
mov qword [r10], r11
mov dword [r8], r9d
mov qword [rcx], rdx
mov qword [rax], 0
jmp 0x1400040a1
mov rax, qword [rbp - 0x30]
mov rcx, qword [rax]
sub rsp, 0x20
call fcn.140009840
add rsp, 0x20
jmp 0x140004202
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x48]
mov qword [rax], rcx
jmp 0x1400042b3
jmp 0x14000443b
mov rax, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
mov rcx, qword [rcx]
mov qword [rax], rcx
jmp 0x1400044c3
jmp 0x140004591
jmp 0x140004632
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
movsxd r9, dword [r9]
mov r8, qword [r8]
mov rcx, qword [rcx]
mov r10, qword [rax]
mov qword [rdx], r10
mov r10, qword [rax + 8]
mov qword [rdx + 8], r10
mov rax, qword [rax + 0x10]
mov qword [rdx + 0x10], rax
sub rsp, 0x20
call fcn.140003930
add rsp, 0x20
jmp 0x1400046ed
jmp 0x14000481b