Function at 0x140001000
Capabilities:
Create process on windows
Resume thread
Terminate process

Disassembly:
push rdi
sub rsp, 0x530
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x528], rax
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor edi, edi
lea rax, [0x140005768]
mov qword [rsp + 0x48], rax
lea rcx, str.EdrawMax.exe
lea rax, [0x140005050]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rdi
xor edx, edx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x100434
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14000108c
lea r9d, [rdi + 0x30]
xor ecx, ecx
lea r8, str.EdrawMax_Ultimate_v13.1.0.1152_Loader___H_Hayat
lea rdx, str.Failed_to_create_process.
call qword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [rdi + 1]
jmp 0x1400012e3
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [0x140005770]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x80], 0x10001f
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rdx, [rsp + 0x520]
lea rcx, str.EdrawMax.exe
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
test eax, eax
je 0x140001109
cmp dword [rsp + 0x520], 6
jne 0x140001109
mov rdx, qword [rsp + 0xd8]
lea r8, [0x140005780]
mov rcx, qword [0x140005768]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp qword [0x140005780], rdi
jne 0x140001147
mov rcx, qword [0x140005768]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r9d, 0x30
lea r8, str.EdrawMax_Ultimate_v13.1.0.1152_Loader___H_Hayat
lea rdx, str.Failed_to_obtain_module_base.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x1400012e3
mov ecx, 5
mov qword [rsp + 0x540], rbx
call fcn.140001338
mov rdx, qword [0x140005780]
mov r9d, 5
mov rcx, qword [0x140005768]
add rdx, 0xb3e120
mov r8, rax
mov qword [rsp + 0x20], rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400012ab
lea r9, [0x140005048]
mov r8, rbx
sub r8, r9
mov rcx, rdi
nop dword [rax]
movzx eax, byte [rcx + r9]
lea rdx, [rcx + r9]
cmp byte [r8 + rdx], al
jne 0x1400012a3
inc rcx
cmp rcx, 5
jb 0x1400011a0
mov rcx, rbx
call fcn.140001330
mov rdx, qword [0x140005780]
lea r8, [0x1400050c0]
mov rcx, qword [0x140005768]
add rdx, 0x341510
mov r9d, 7
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x140005780]
lea r8, [0x140005040]
mov rcx, qword [0x140005768]
add rdx, 0x461c77
mov r9d, 7
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x140005780]
lea r8, [0x1400050b8]
mov rcx, qword [0x140005768]
add rdx, 0x5fa7de
mov r9d, 6
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x140005780]
lea r8, [0x1400050c8]
mov rcx, qword [0x140005768]
add rdx, 0x5fa9c4
mov r9d, 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140005770]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [0x140005768]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140005770]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400012db
mov rcx, rbx
call fcn.140001330
mov rcx, qword [0x140005768]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r9d, 0x30
lea r8, str.EdrawMax_Ultimate_v13.1.0.1152_Loader___H_Hayat
lea rdx, str.Invalid_version.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
mov rbx, qword [rsp + 0x540]
mov rcx, qword [rsp + 0x528]
xor rcx, rsp
call fcn.140001310
add rsp, 0x530
pop rdi
ret