Function at 0x140031310
Capabilities:
Check for time delay via gettickcount
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Terminate process

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x440
mov rdi, rsp
mov ecx, 0x110
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x450]
mov qword [rsp + 0x3e0], 0xfffffffffffffffe
mov byte [rsp + 0x3da], 0
mov byte [rsp + 0x3d9], 0
mov byte [rsp + 0x3d8], 0
cmp qword [rsp + 0x470], 0
je 0x14003137f
mov rcx, qword [rsp + 0x470]
call fcn.140006200
cmp qword [rsp + 0x478], 0
je 0x140031397
mov rcx, qword [rsp + 0x478]
call fcn.140006200
cmp qword [rsp + 0x488], 0
je 0x1400313b0
mov rax, qword [rsp + 0x488]
mov dword [rax], 0xffffffff
mov rcx, qword [rsp + 0x458]
call fcn.14000f390
test rax, rax
je 0x1400313cc
mov eax, 0xffffffff
jmp 0x1400320ff
mov qword [rsp + 0xb8], 0
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x58], rax
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetElement
xor edx, edx
lea rcx, [rsp + 0xd8]
call fcn.140060770
cmp qword [rsp + 0x490], 0
je 0x1400314b5
mov rax, qword [rsp + 0x490]
cmp qword [rax], 0
jne 0x14003145a
mov r9d, 0xef9
lea r8, [0x140154480]
lea rdx, [0x1401516d8]
xor ecx, ecx
call fcn.14000f120
mov qword [rsp + 0x490], 0
jmp 0x1400314b5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [rsp + 0x3d8], 1
mov dword [rsp + 0xf4], eax
mov byte [rsp + 0x3d9], 1
mov rax, qword [rsp + 0x490]
mov eax, dword [rax + 8]
mov dword [rsp + 0xf8], eax
cmp byte [rsp + 0x3d8], 0
jne 0x14003149f
lea rcx, str.dwTimeStartup
call fcn.14005e930
mov byte [rsp + 0x3da], 1
mov eax, dword [rsp + 0xf4]
mov dword [rsp + 0xfc], eax
mov dword [rsp + 0x100], 0xffffffff
mov qword [rsp + 0x108], 0
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetElement
xor edx, edx
lea rcx, [rsp + 0x118]
call fcn.140060770
mov dword [rsp + 0x118], reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rsp + 0x128], 1
cmp qword [rsp + 0x470], 0
je 0x140031539
xor r9d, r9d
lea r8, [rsp + 0x118]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x140031539
mov qword [rsp + 0x78], 0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x58], rax
jmp 0x140031fb3
cmp qword [rsp + 0x478], 0
je 0x14003158a
xor r9d, r9d
lea r8, [rsp + 0x118]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x14003158a
mov qword [rsp + 0xb8], 0
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x98], rax
jmp 0x140031fb3
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x150]
call fcn.140060770
mov dword [rsp + 0x150], 0x68
mov dword [rsp + 0x18c], 0x101
xor eax, eax
mov word [rsp + 0x190], ax
cmp qword [rsp + 0x470], 0
je 0x14003161a
cmp qword [rsp + 0x78], 0
je 0x1400315e0
mov qword [rsp + 0x3e8], 1
jmp 0x1400315ec
mov qword [rsp + 0x3e8], 0
mov r9d, 0xf28
lea r8, [0x1401544e0]
lea rdx, [0x140151738]
mov rcx, qword [rsp + 0x3e8]
call fcn.14000f120
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x1a8], rax
cmp qword [rsp + 0x478], 0
je 0x14003167b
cmp qword [rsp + 0xb8], 0
je 0x14003163e
mov qword [rsp + 0x3f0], 1
jmp 0x14003164a
mov qword [rsp + 0x3f0], 0
mov r9d, 0xf2d
lea r8, [0x140154540]
lea rdx, [0x1401517a8]
mov rcx, qword [rsp + 0x3f0]
call fcn.14000f120
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x108], 1
mov dword [rsp + 0x1c4], 0
cmp qword [rsp + 0x450], 0
je 0x1400316af
mov eax, dword [rsp + 0x1c4]
bts eax, 0xa
mov dword [rsp + 0x1c4], eax
lea rcx, [rsp + 0x1e0]
call fcn.140001d70
nop
lea rcx, [rsp + 0x258]
call fcn.14003b920
nop
mov rdx, qword [rsp + 0x458]
lea rcx, [rsp + 0x258]
call fcn.14003d380
cmp qword [rsp + 0x460], 0
jne 0x1400316f9
mov qword [rsp + 0x3f8], 0
jmp 0x140031747
mov rax, qword [rsp + 0x460]
movzx eax, word [rax]
test eax, eax
jne 0x140031727
lea rdx, [rsp + 0x1e0]
mov rcx, qword [rsp + 0x458]
call fcn.1400387d0
mov qword [rsp + 0x400], rax
jmp 0x140031737
mov rax, qword [rsp + 0x460]
mov qword [rsp + 0x400], rax
mov rax, qword [rsp + 0x400]
mov qword [rsp + 0x3f8], rax
lea rcx, [rsp + 0x258]
call fcn.140019e20
lea rcx, [rsp + 0xd8]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x150]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x3f8]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x450]
mov qword [rsp + 0x30], rcx
mov ecx, dword [rsp + 0x1c4]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400317dc
mov qword [rsp + 0xd8], 0
lea rcx, [rsp + 0x258]
call fcn.140001df0
nop
lea rcx, [rsp + 0x1e0]
call fcn.140001eb0
jmp 0x140031fb3
cmp qword [rsp + 0x470], 0
je 0x14003183e
cmp qword [rsp + 0x78], 0
je 0x1400317fd
mov qword [rsp + 0x408], 1
jmp 0x140031809
mov qword [rsp + 0x408], 0
mov r9d, 0xf4a
lea r8, [0x1401545a0]
lea rdx, str.hStdOutWrite___NULL
mov rcx, qword [rsp + 0x408]
call fcn.14000f120
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], 0
cmp qword [rsp + 0x478], 0
je 0x1400318a9
cmp qword [rsp + 0xb8], 0
je 0x140031862
mov qword [rsp + 0x410], 1
jmp 0x14003186e
mov qword [rsp + 0x410], 0
mov r9d, 0xf50
lea r8, [0x140154600]
lea rdx, str.hStdErrorWrite___NULL
mov rcx, qword [rsp + 0x410]
call fcn.14000f120
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xb8], 0
mov dword [rsp + 0x100], 0
lea rcx, [rsp + 0x2a8]
call fcn.14003b920
nop
lea rcx, [rsp + 0x2f8]
call fcn.14003b920
nop
cmp qword [rsp + 0x470], 0
jne 0x1400318e6
cmp qword [rsp + 0x490], 0
je 0x1400318f5
xor edx, edx
lea rcx, [rsp + 0x2a8]
call fcn.140039570
cmp qword [rsp + 0x478], 0
jne 0x14003190b
cmp qword [rsp + 0x490], 0
je 0x14003191a
xor edx, edx
lea rcx, [rsp + 0x2f8]
call fcn.140039570
mov dword [rsp + 0x384], 0
cmp qword [rsp + 0x490], 0
je 0x140031994
mov rax, qword [rsp + 0x458]
mov qword [rsp + 0x358], rax
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x360], rax
lea rax, [rsp + 0x2f8]
mov qword [rsp + 0x368], rax
mov rax, qword [rsp + 0x490]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x370], rax
mov rax, qword [rsp + 0x490]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x378], rax
mov qword [rsp + 0x350], 0
cmp qword [rsp + 0x108], 0
je 0x140031cd9
mov edx, 0x64
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1400319ce
mov qword [rsp + 0x108], 0
jmp 0x140031cd9
cmp qword [rsp + 0x490], 0
je 0x140031cd9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x3c4], eax
cmp byte [rsp + 0x3da], 0
jne 0x140031a00
lea rcx, str.dwTimeLastNotify
call fcn.14005e930
mov eax, dword [rsp + 0xfc]
cmp dword [rsp + 0x3c4], eax
jb 0x140031a1e
mov qword [rsp + 0x418], 1
jmp 0x140031a2a
mov qword [rsp + 0x418], 0
mov r9d, 0xf79
lea r8, [0x140154660]
lea rdx, str.dwCurrentTime___dwTimeLastNotify
mov rcx, qword [rsp + 0x418]
call fcn.14000f120
cmp byte [rsp + 0x3da], 0
jne 0x140031a61
lea rcx, str.dwTimeLastNotify
call fcn.14005e930
cmp byte [rsp + 0x3d9], 0
jne 0x140031a77
lea rcx, str.dwNotifyInterval
call fcn.14005e930
mov eax, dword [rsp + 0xfc]
mov ecx, dword [rsp + 0x3c4]
sub ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0xf8]
jb 0x140031cd9
mov byte [rsp + 0x3da], 1
mov eax, dword [rsp + 0x3c4]
mov dword [rsp + 0xfc], eax
mov rax, qword [rsp + 0x490]
cmp qword [rax], 0
je 0x140031aee
cmp byte [rsp + 0x3d8], 0
jne 0x140031ad0
lea rcx, str.dwTimeStartup
call fcn.14005e930
mov eax, dword [rsp + 0xf4]
cmp dword [rsp + 0x3c4], eax
jb 0x140031aee
mov qword [rsp + 0x420], 1
jmp 0x140031afa
mov qword [rsp + 0x420], 0
mov r9d, 0xf80
lea r8, [0x1401546c0]
lea rdx, str.pTimeoutCheckParam__m_fnIsTimeout___NULL__dwCurrentTime___dwTimeStartup
mov rcx, qword [rsp + 0x420]
call fcn.14000f120
cmp byte [rsp + 0x3d8], 0
jne 0x140031b31
lea rcx, str.dwTimeStartup
call fcn.14005e930
mov eax, dword [rsp + 0xf4]
mov ecx, dword [rsp + 0x3c4]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x348], eax
xor edx, edx
lea rcx, [rsp + 0x2a8]
call fcn.1400397f0
test rax, rax
je 0x140031b80
xor edx, edx
lea rcx, [rsp + 0x2f8]
call fcn.1400397f0
test rax, rax
je 0x140031b80
mov qword [rsp + 0x428], 1
jmp 0x140031b8c
mov qword [rsp + 0x428], 0
mov r9d, 0xf85
lea r8, [0x140154770]
lea rdx, str.memStdOutWideText.EndWCharOf__0___memStdErrorWideText.EndWCharOf__0_
mov rcx, qword [rsp + 0x428]
call fcn.14000f120
lea rcx, [rsp + 0x348]
mov rax, qword [rsp + 0x490]
call qword [rax]
mov dword [rsp + 0x384], eax
lea rcx, [rsp + 0x2a8]
call fcn.14000e7a0
xor edx, edx
mov ecx, 2
div rcx
mov rax, rdx
mov qword [rsp + 0x3c8], rax
cmp qword [rsp + 0x3c8], 0
je 0x140031c18
lea rcx, [rsp + 0x2a8]
call fcn.14000e7a0
sub rax, qword [rsp + 0x3c8]
mov rdx, rax
lea rcx, [rsp + 0x2a8]
call fcn.140039d40
lea rcx, [rsp + 0x2f8]
call fcn.14000e7a0
xor edx, edx
mov ecx, 2
div rcx
mov rax, rdx
mov qword [rsp + 0x3c8], rax
cmp qword [rsp + 0x3c8], 0
je 0x140031c6a
lea rcx, [rsp + 0x2f8]
call fcn.14000e7a0
sub rax, qword [rsp + 0x3c8]
mov rdx, rax
lea rcx, [rsp + 0x2f8]
call fcn.140039d40
xor edx, edx
lea rcx, [rsp + 0x2a8]
call fcn.1400397f0
test rax, rax
jne 0x140031c8d
xor edx, edx
lea rcx, [rsp + 0x2a8]
call fcn.140039570
xor edx, edx
lea rcx, [rsp + 0x2f8]
call fcn.1400397f0
test rax, rax
jne 0x140031cb0
xor edx, edx
lea rcx, [rsp + 0x2f8]
call fcn.140039570
cmp dword [rsp + 0x384], 1
jne 0x140031cbf
jmp 0x140031d79
cmp dword [rsp + 0x384], 2
jne 0x140031cd9
mov dword [rsp + 0x100], 0xfffffffe
jmp 0x140031d79
mov qword [rsp + 0x398], 0
cmp qword [rsp + 0x470], 0
je 0x140031d11
lea r9, [rsp + 0x398]
lea r8, [rsp + 0x2a8]
mov edx, dword [rsp + 0x468]
mov rcx, qword [rsp + 0x58]
call fcn.1400382d0
mov qword [rsp + 0x3b8], 0
cmp qword [rsp + 0x478], 0
je 0x140031d4c
lea r9, [rsp + 0x3b8]
lea r8, [rsp + 0x2f8]
mov edx, dword [rsp + 0x468]
mov rcx, qword [rsp + 0x98]
call fcn.1400382d0
cmp qword [rsp + 0x398], 0
jg 0x140031994
cmp qword [rsp + 0x3b8], 0
jg 0x140031994
cmp qword [rsp + 0x108], 0
jne 0x140031994
cmp qword [rsp + 0x490], 0
je 0x140031e24
cmp dword [rsp + 0x384], 0
jne 0x140031e24
cmp qword [rsp + 0x108], 0
jne 0x140031daf
mov qword [rsp + 0x430], 1
jmp 0x140031dbb
mov qword [rsp + 0x430], 0
mov r9d, 0xfb2
lea r8, [0x140154820]
lea rdx, str.blpProcessRunning__FALSE
mov rcx, qword [rsp + 0x430]
call fcn.14000f120
cmp byte [rsp + 0x3d8], 0
jne 0x140031df2
lea rcx, str.dwTimeStartup
call fcn.14005e930
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsp + 0xf4]
mov dword [rsp + 0x348], eax
mov qword [rsp + 0x350], 1
lea rcx, [rsp + 0x348]
mov rax, qword [rsp + 0x490]
call qword [rax]
cmp qword [rsp + 0x470], 0
je 0x140031e77
xor edx, edx
lea rcx, [rsp + 0x2a8]
call fcn.1400397f0
mov r9d, 0xfbc
lea r8, [0x140154880]
lea rdx, str.memStdOutWideText.EndWCharOf__0_
mov rcx, rax
call fcn.14000f120
lea rcx, [rsp + 0x2a8]
call fcn.140002680
mov rdx, rax
mov rcx, qword [rsp + 0x470]
call fcn.14004c6e0
cmp qword [rsp + 0x478], 0
je 0x140031f25
xor edx, edx
lea rcx, [rsp + 0x2f8]
call fcn.1400397f0
mov r9d, 0xfc4
lea r8, [0x1401548e0]
lea rdx, str.memStdErrorWideText.EndWCharOf__0_
mov rcx, rax
call fcn.14000f120
mov rax, qword [rsp + 0x470]
cmp qword [rsp + 0x478], rax
jne 0x140031f08
mov rcx, qword [rsp + 0x478]
call fcn.140019fa0
test rax, rax
jne 0x140031ee9
lea rdx, [0x140151b78]
mov rcx, qword [rsp + 0x478]
call fcn.14004b350
lea rcx, [rsp + 0x2f8]
call fcn.140002680
mov rdx, rax
mov rcx, qword [rsp + 0x478]
call fcn.14004b350
jmp 0x140031f25
lea rcx, [rsp + 0x2f8]
call fcn.140002680
mov rdx, rax
mov rcx, qword [rsp + 0x478]
call fcn.14004c6e0
cmp qword [rsp + 0x488], 0
je 0x140031f72
cmp dword [rsp + 0x100], 0xfffffffe
jne 0x140031f4a
mov rax, qword [rsp + 0x488]
mov dword [rax], 0xffffffff
jmp 0x140031f72
mov rdx, qword [rsp + 0x488]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x140031f72
mov rax, qword [rsp + 0x488]
mov dword [rax], 0
lea rcx, [rsp + 0x2f8]
call fcn.140001df0
nop
lea rcx, [rsp + 0x2a8]
call fcn.140001df0
nop
lea rcx, [rsp + 0x258]
call fcn.140001df0
nop
lea rcx, [rsp + 0x1e0]
call fcn.140001eb0
xor eax, eax
test eax, eax
jne 0x1400314cc
cmp qword [rsp + 0xd8], 0
je 0x140032053
cmp qword [rsp + 0x108], 0
je 0x140032037
mov edx, dword [rsp + 0xe8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
mov edx, dword [rsp + 0xe8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
mov r8d, dword [rsp + 0xe8]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x3d0], rax
cmp qword [rsp + 0x3d0], 0
je 0x140032037
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x58], 0
je 0x140032066
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x78], 0
je 0x140032079
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x98], 0
je 0x140032092
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0xb8], 0
je 0x1400320ab
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x480], 0
je 0x1400320f8
cmp qword [rsp + 0x470], 0
je 0x1400320ce
mov rcx, qword [rsp + 0x470]
call fcn.14004bd10
cmp qword [rsp + 0x478], 0
je 0x1400320f8
mov rax, qword [rsp + 0x470]
cmp qword [rsp + 0x478], rax
je 0x1400320f8
mov rcx, qword [rsp + 0x478]
call fcn.14004bd10
mov eax, dword [rsp + 0x100]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140158198]
call fcn.14005d920
mov rax, rdi
add rsp, 0x440
pop rdi
ret