Function at 0x14001cf50
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x140b86080]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov ebx, edx
xor edi, edi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rax
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x40], 0x68
mov dword [rbp - 4], 1
mov word [rbp], di
lea rax, [0x140062870]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0xd
mov rdx, rcx
cmp qword [rcx + 0x18], 7
jbe 0x14001cfd9
mov rdx, qword [rcx]
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsp + 0x78], xmm0
movabs rax, 0xc000000000000000
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x50], 1
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.14000d700
mov eax, edi
mov ecx, 0x10
test ebx, ebx
cmove eax, ecx
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14001d0b0
test ebx, ebx
je 0x14001d09c
mov edx, ebx
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x50]
call fcn.14001cd80
mov rbx, qword [rsp + 0x50]
mov rax, rbx
movabs rcx, 0x7fffffffa697d0ff
cmp rbx, rcx
jge 0x14001d0da
add rbx, 0x59682f00
jmp 0x14001d0e4
movabs rbx, 0x7fffffffffffffff
mov esi, 0xff
movabs rdi, 0x4e94914f0000
movabs r14, 0x431bde82d7b634db
nop dword [rax]
lea rcx, [rsp + 0x50]
call fcn.14001cd80
mov rax, qword [rsp + 0x50]
cmp rbx, rax
je 0x14001d163
mov ecx, 1
cmovl ecx, esi
test cl, cl
jle 0x14001d163
mov rcx, rbx
sub rcx, rax
cmp rcx, rdi
jge 0x14001d157
mov rax, r14
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14001d14e
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x14001d100
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x14001d100
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x14001d19f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d19a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d1c3
call fcn.14001fba0
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.14001fb80
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1400274d0
int3