Function at 0x1400033e0
Capabilities:
Create process on windows
Create thread

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0x100
mov rax, qword [0x1400e6080]
xor rax, rsp
mov qword [rbp + 0x37], rax
cmp byte [0x1400e7800], 0
je 0x140003911
mov ecx, dword [0x1400e7b00]
mov qword [r11 + 8], rbx
lea rbx, [0x1400e73a8]
mov qword [r11 + 0x10], rdi
xor edi, edi
movaps xmmword [r11 - 0x18], xmm7
xorps xmm7, xmm7
test ecx, ecx
je 0x14000343b
cmp ecx, 1
je 0x14000366b
jmp 0x1400038f9
mov rcx, qword [0x1400e70a0]
lea rdx, [0x1400e7800]
movss xmm1, dword [0x1400e6104]
mov r8d, Ordinal_301
movss xmm0, dword [0x1400e6100]
unpcklps xmm0, xmm1
xorps xmm1, xmm1
mov eax, dword [rcx + 0x1dc0]
movsd qword [rcx + 0x1dd4], xmm0
or eax, 1
mov dword [rcx + 0x1dc0], eax
or eax, 0x42
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
unpcklps xmm1, xmm7
movsd qword [rcx + 0x1ddc], xmm1
movss xmm0, dword [0x1400e6108]
movss xmm1, dword [0x1400e610c]
movss dword [rcx + 0x1de4], xmm0
movss dword [rcx + 0x1de8], xmm1
mov dword [rcx + 0x1dc0], eax
mov dword [rcx + 0x1dc8], 1
mov dword [rcx + 0x1e20], 0x3f800000
lea rcx, str.Vax_Loader___ImGui
call fcn.1400118d0
call fcn.14004ecf0
test al, al
je 0x1400035da
call fcn.140050ca0
test al, al
je 0x1400035da
lea rcx, str.Login_using_username_and_password.
call fcn.140044f40
mov rax, qword [0x1400e70a0]
mov rax, qword [rax + 0x1d18]
cmp byte [rax + 0xd4], dil
jne 0x140003530
mov eax, dword [rax + 0x1f4]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.140046ff0
mov qword [rsp + 0x38], rdi
lea rax, [rbp - 0x59]
mov qword [rsp + 0x30], rdi
lea r8, [0x1400e7801]
mov dword [rsp + 0x28], edi
lea rcx, str.Username
mov r9d, 0xff
mov qword [rsp + 0x20], rax
xor edx, edx
mov qword [rbp - 0x59], rdi
call fcn.14004a750
mov qword [rsp + 0x38], rdi
lea rax, [rbp - 0x59]
mov qword [rsp + 0x30], rdi
lea r8, [0x1400e7900]
mov dword [rsp + 0x28], 0x8000
lea rcx, str.Password
mov r9d, 0xff
mov qword [rsp + 0x20], rax
xor edx, edx
mov qword [rbp - 0x59], rdi
call fcn.14004a750
lea rdx, [rbp - 0x59]
mov qword [rbp - 0x59], rdi
lea rcx, str.Login
call fcn.140045860
test al, al
je 0x1400035d5
mov qword [rsp + 0x28], rdi
lea r8, [0x1400031d0]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.140050dc0
call fcn.14004f170
mov rcx, qword [0x1400e70a0]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x134]
movss xmm1, dword [rax + 0x54]
subss xmm1, dword [rax + 0xa0]
addss xmm1, dword [0x1400d627c]
movss dword [rax + 0x11c], xmm1
maxss xmm0, xmm1
movss dword [rax + 0x134], xmm0
mov rax, qword [rcx + 0x1d18]
cmp byte [rax + 0xd4], dil
jne 0x14000364e
mov eax, dword [rax + 0x1f4]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.140046ff0
cmp qword [0x1400e73c0], 0xf
mov rcx, rbx
cmova rcx, qword [0x1400e73a8]
call fcn.140044f40
call fcn.140014ba0
movss xmm1, dword [0x1400e6104]
lea rdx, [0x1400e7800]
movss xmm0, dword [0x1400e6100]
lea rcx, str.Vax_Loader___ImGui
mov r9, qword [0x1400e70a0]
mov r8d, Ordinal_301
unpcklps xmm0, xmm1
xorps xmm1, xmm1
unpcklps xmm1, xmm7
movsd qword [r9 + 0x1ddc], xmm1
movsd qword [r9 + 0x1dd4], xmm0
mov dword [r9 + 0x1dc4], 2
mov byte [r9 + 0x1dfc], 1
mov dword [r9 + 0x1de4], 0x43fa0000
mov dword [r9 + 0x1de8], 0x43960000
mov dword [r9 + 0x1dc8], 1
or dword [r9 + 0x1dc0], 0x43
mov dword [r9 + 0x1e20], 0x3f800000
call fcn.1400118d0
lea rcx, str.User_Data
call fcn.140044f40
mov rax, qword [0x1400e70a0]
mov rax, qword [rax + 0x1d18]
cmp byte [rax + 0xd4], dil
jne 0x140003732
mov eax, dword [rax + 0x1f4]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.140046ff0
cmp qword [0x1400e72c8], 0xf
lea rdx, [0x1400e72b0]
lea rcx, str.Username_:__s
cmova rdx, qword [0x1400e72b0]
call fcn.140044f40
cmp qword [0x1400e7308], 0xf
lea rdx, [0x1400e72f0]
lea rcx, str.HWID_:__s
cmova rdx, qword [0x1400e72f0]
call fcn.140044f40
cmp qword [0x1400e7b60], 0xf
lea rdx, [0x1400e7b48]
lea rcx, str.Subscription_Expiry_:__s
cmova rdx, qword [0x1400e7b48]
call fcn.140044f40
lea rdx, [rbp - 0x59]
mov qword [rbp - 0x59], rdi
lea rcx, str.Inject
call fcn.140045860
test al, al
je 0x14000384f
xorps xmm0, xmm0
mov dword [rbp - 0x39], 0x68
lea rax, [rbp - 0x51]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, str.C:UsersjvallAppDataLocalTemp_vax.exe
lea rax, [rbp - 0x39]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
movups xmmword [rbp - 0x31], xmm0
movups xmmword [rbp - 0x21], xmm0
movups xmmword [rbp - 0x11], xmm0
movups xmmword [rbp - 1], xmm0
movups xmmword [rbp + 0xf], xmm0
movups xmmword [rbp + 0x1f], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14000383b
mov rcx, qword [rbp - 0x51]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000384f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_creating_process:__lu_n
call fcn.140002090
lea rdx, [rbp - 0x59]
mov qword [rbp - 0x59], rdi
lea rcx, str.Back
call fcn.140045860
test al, al
je 0x14000386d
mov dword [0x1400e7b00], edi
mov rcx, qword [0x1400e70a0]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x134]
movss xmm1, dword [rax + 0x54]
subss xmm1, dword [rax + 0xa0]
addss xmm1, dword [0x1400d627c]
movss dword [rax + 0x11c], xmm1
maxss xmm0, xmm1
movss dword [rax + 0x134], xmm0
mov rax, qword [rcx + 0x1d18]
cmp byte [rax + 0xd4], dil
jne 0x1400038dc
mov eax, dword [rax + 0x1f4]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.140046ff0
cmp qword [0x1400e73c0], 0xf
cmova rbx, qword [0x1400e73a8]
mov rcx, rbx
call fcn.140044f40
call fcn.140014ba0
mov rdi, qword [rsp + 0x118]
mov rbx, qword [rsp + 0x110]
movaps xmm7, xmmword [rsp + 0xf0]
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400b6000
add rsp, 0x100
pop rbp
ret