Function at 0x14015cd00
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x14041d0c0]
xor rax, rsp
mov qword [rbp + 0x240], rax
lea rcx, [0x1404b98c7]
call fcn.1402b13b0
mov r8d, 0x104
lea rdx, [rbp + 0x130]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea rdx, [rsp + 0x50]
call fcn.14015d000
lea rdx, [rax + 1]
movzx r8d, byte [rax]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rdx + 4], r8b
mov byte [rdx + 5], 0
lea rcx, [rbp]
call fcn.140046ed0
nop
lea rcx, [rbp + 0x20]
call fcn.14004b9d0
mov r8d, 2
lea rdx, [rbp]
lea rcx, [rbp + 0x20]
call fcn.14005aac0
nop
lea rdx, [rsp + 0x50]
call fcn.14015d030
lea rdx, [rax + 1]
movzx r8d, byte [rax]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rdx + 6], r8b
mov byte [rdx + 7], 0
lea rcx, [rbp + 0x20]
call fcn.1400eeb30
lea rdx, [0x1400eeae0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rsp + 0x50]
call fcn.14015d060
lea rdx, [rax + 1]
movzx r8d, byte [rax]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rdx + 4], r8b
mov byte [rdx + 5], 0
lea rcx, [rbp + 0x20]
call fcn.1400eeb30
mov rcx, rax
lea rdx, [rbp + 0x130]
call fcn.1400eeb30
mov rbx, rax
lea rdx, [rsp + 0x60]
call fcn.14015d090
lea rdx, [rax + 1]
movzx ecx, byte [rax]
xor byte [rdx], cl
mov byte [rdx + 1], 0
mov rcx, rbx
call fcn.1400eeb30
lea rdx, [0x1400eeae0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rsp + 0x50]
call fcn.14015d0c0
lea rdx, [rax + 1]
movzx r8d, byte [rax]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rdx + 9], r8b
mov byte [rdx + 0xa], 0
lea rcx, [rbp + 0x20]
call fcn.1400eeb30
mov rcx, rax
lea rdx, [rbp + 0x130]
call fcn.1400eeb30
mov rbx, rax
lea rdx, [rsp + 0x68]
call fcn.14015d100
lea rdx, [rax + 1]
movzx r8d, byte [rax]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rdx + 0xc], r8b
mov byte [rdx + 0xd], 0
mov rcx, rbx
call fcn.1400eeb30
lea rdx, [0x1400eeae0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rsp + 0x50]
call fcn.14015d140
lea rdx, [rax + 1]
movzx r8d, byte [rax]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rdx + 9], r8b
mov byte [rdx + 0xa], 0
lea rcx, [rbp + 0x20]
call fcn.1400eeb30
lea rdx, [0x1400eeae0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x20]
call fcn.14005aa70
mov dword [rbp - 0x70], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
mov dword [rbp - 0x34], 1
xor ebx, ebx
mov word [rbp - 0x30], bx
lea rcx, [rbp]
call fcn.14005c590
mov rdx, rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateProcessA]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]