Function at 0x14001df40
Capabilities:
Create process on windows
Resume thread
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x1400d33c0]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov rdi, rcx
lea rcx, [rbp - 0x60]
xor r12d, r12d
mov rsi, r8
mov r15, rdx
mov dword [rsp + 0x60], r12d
call fcn.14002d820
mov rcx, qword [rsi + 8]
movzx r14d, byte [rsi + 0x10]
mov ebx, r12d
test rcx, rcx
je 0x14001dfa0
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
jne 0x14001e0a3
xor r14b, r14b
cmp byte [rsi + 0x20], r12b
lea rax, [0x1400c4140]
mov dword [rbp - 0x24], 1
cmove rax, qword [rbp - 0x50]
cmp byte [rsi + 1], r12b
mov qword [rbp - 0x50], rax
mov eax, 5
cmovne ax, r12w
mov word [rbp - 0x20], ax
mov rax, qword [rsi + 0x30]
test rax, rax
jne 0x14001dfe2
cmp qword [rsi + 0x38], r12
jne 0x14001dfe2
cmp qword [rsi + 0x40], r12
je 0x14001dffd
mov qword [rbp - 0x10], rax
mov rax, qword [rsi + 0x38]
mov dword [rbp - 0x24], 0x101
mov qword [rbp - 8], rax
mov rax, qword [rsi + 0x40]
mov qword [rbp], rax
cmp qword [rsi + 0x28], r12
je 0x14001e009
or ebx, 0x1000004
cmp byte [rsi + 0x48], r12b
je 0x14001e013
bts ebx, 0x18
xor eax, eax
lea rcx, [rbp + 0x28]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r15
mov qword [rbp + 0x40], 7
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x38], r12
mov word [rbp + 0x28], r12w
call fcn.140007850
mov rdx, qword [rsi + 0x18]
test rdx, rdx
je 0x14001e309
lea rcx, [rsp + 0x60]
xor r8d, r8d
bts ebx, 0xa
mov qword [rsp + 0x60], r12
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x14001e273
lea rcx, [rsp + 0x78]
xor edx, edx
mov byte [rsp + 0x70], r12b
call fcn.14000ecd0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
jne 0x14001e25c
cmp byte [0x1400d77dc], r12b
je 0x14001e25b
jmp 0x14001e57b
call fcn.140012cb0
cmp dword [rax], 3
jge 0x14001e0f1
lea rcx, [rsp + 0x68]
xor edx, edx
mov byte [rsp + 0x60], bl
call fcn.14000ecd0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
jne 0x14001e0d5
cmp byte [0x1400d77dc], bl
jne 0x14001e586
int3
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.14001dbd0
lea rcx, [rsp + 0x68]
call fcn.14000ee20
jmp 0x14001e542
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 8]
sub rcx, qword [rax]
sar rcx, 3
cmp rcx, 0x1fffffff
jbe 0x14001e131
lea rcx, [rsp + 0x68]
xor edx, edx
mov byte [rsp + 0x60], bl
call fcn.14000ecd0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
jne 0x14001e0d5
cmp byte [0x1400d77dc], bl
je 0x14001e0d4
jmp 0x14001e591
cmp dword [rbp - 0x60], 0x70
jne 0x14001e18f
cmp qword [rbp + 8], rbx
jne 0x14001e18f
xor r8d, r8d
lea r9, [rsp + 0x60]
xor ecx, ecx
lea edx, [r8 + 1]
mov qword [rsp + 0x60], r12
call qword [0x1400d8b90]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001e18f
call fcn.140090614
xor r8d, r8d
lea r9, [rsp + 0x60]
lea edx, [r8 + 1]
mov rcx, rax
mov qword [rbp + 8], rax
call qword [0x1400d8b90]
test eax, eax
jne 0x14001e1bf
mov rcx, qword [rbp + 8]
call fcn.140091c98
mov qword [rbp + 8], r12
lea rcx, [rsp + 0x68]
xor edx, edx
mov byte [rsp + 0x60], bl
call fcn.14000ecd0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
jne 0x14001e0d5
cmp byte [0x1400d77dc], bl
je 0x14001e0d4
jmp 0x14001e59c
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 8]
mov r9, qword [rax]
sub rcx, qword [rax]
mov rax, qword [rax + 8]
sub rax, r9
sar rcx, 3
sar rax, 3
test rax, rax
je 0x14001e5a7
mov r10, qword [rbp + 8]
test r10, r10
je 0x14001e22b
lea edx, [rcx*8]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rdx
mov r8d, 0x20002
mov rcx, r10
xor edx, edx
call qword [0x1400d8b88]
test eax, eax
setne al
test al, al
je 0x14001e22b
mov r14b, 1
mov ebx, 0x80000
jmp 0x14001dfa0
lea rcx, [rsp + 0x68]
xor edx, edx
mov byte [rsp + 0x60], bl
call fcn.14000ecd0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
jne 0x14001e0d5
cmp byte [0x1400d77dc], bl
je 0x14001e0d4
jmp 0x14001e5b4
int3
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.14001dbd0
lea rcx, [rsp + 0x78]
jmp 0x14001e51c
cmp qword [rbp + 0x40], 8
lea rax, [rbp + 0x10]
movzx ecx, r14b
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x60]
lea r8, [rbp + 0x28]
cmovae r8, qword [rbp + 0x28]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsi + 0x18]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
test ebx, ebx
jne 0x14001e383
lea rcx, [rsp + 0x78]
xor edx, edx
mov byte [rsp + 0x70], r12b
call fcn.14000ecd0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
jne 0x14001e25c
cmp byte [0x1400d77dc], r12b
je 0x14001e25b
jmp 0x14001e5bf
cmp qword [rbp + 0x40], 8
lea rcx, [rbp + 0x10]
movzx eax, r14b
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x60]
lea rdx, [rbp + 0x28]
cmovae rdx, qword [rbp + 0x28]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14001e383
lea rcx, [rsp + 0x78]
xor edx, edx
mov byte [rsp + 0x70], r12b
call fcn.14000ecd0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
jne 0x14001e25c
cmp byte [0x1400d77dc], r12b
je 0x14001e25b
jmp 0x14001e5ca
xorps xmm0, xmm0
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x70], r12
movdqu xmmword [rbp - 0x80], xmm0
call fcn.14002d710
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x14001e495
mov rdx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x14001e48b
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x70], r12d
call fcn.14001dde0
lea rcx, [rsp + 0x68]
mov byte [rsp + 0x60], r12b
mov rdx, rax
mov rbx, rax
call fcn.14000ecd0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rbx, rax
jne 0x14001e3f6
cmp byte [0x1400d77dc], r12b
jne 0x14001e5d5
int3
cmp byte [rsp + 0x60], r12b
je 0x14001e405
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x14001e40a
mov rax, qword [rsp + 0x68]
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne al
test al, al
je 0x14001e443
cmp byte [rsp + 0x60], r12b
je 0x14001e430
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x14001e435
mov rax, qword [rsp + 0x68]
mov edx, 0xea60
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, [rsp + 0x78]
xor edx, edx
mov byte [rsp + 0x70], r12b
call fcn.14000ecd0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
jne 0x14001e46d
cmp byte [0x1400d77dc], r12b
jne 0x14001e5e0
int3
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.14001dbd0
lea rcx, [rsp + 0x78]
call fcn.14000ee20
lea rcx, [rsp + 0x68]
jmp 0x14001e4f4
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp byte [rsi], r12b
je 0x14001e4a7
mov rcx, qword [rbp - 0x80]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x70], r12d
call fcn.14001dde0
lea rcx, [rsp + 0x78]
mov byte [rsp + 0x70], r12b
mov rdx, rax
mov rbx, rax
call fcn.14000ecd0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rbx, rax
jne 0x14001e4e2
cmp byte [0x1400d77dc], r12b
jne 0x14001e5eb
int3
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.14001dbd0
lea rcx, [rsp + 0x78]
call fcn.14000ee20
lea rcx, [rbp - 0x80]
call fcn.14000ee20
lea rcx, [rbp - 0x78]
call fcn.14000ee20
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x70], r12
call fcn.14000ee20
lea rcx, [rbp - 0x80]
call fcn.14000ee20
cmp qword [rbp + 0x40], 8
jb 0x14001e531
mov rcx, qword [rbp + 0x28]
call fcn.1400910f4
mov qword [rbp + 0x40], 7
mov qword [rbp + 0x38], r12
mov word [rbp + 0x28], r12w
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x14001e55a
call qword [0x1400d8b98]
mov rcx, qword [rbp + 8]
call fcn.140091c98
mov rax, rdi
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.140091a70
add rsp, 0x150
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 1
call fcn.14009400c
int3
mov ecx, 1
call fcn.14009400c
int3
mov ecx, 1
call fcn.14009400c
int3
mov ecx, 1
call fcn.14009400c
int3
lea rcx, str.invalid_vector_T__subscript
call fcn.14009048c
int3
mov ecx, 1
call fcn.14009400c
int3
mov ecx, 1
call fcn.14009400c
int3
mov ecx, 1
call fcn.14009400c
int3
mov ecx, 1
call fcn.14009400c
int3
mov ecx, 1
call fcn.14009400c
int3
mov ecx, 1
call fcn.14009400c
int3