Function at 0x14008fb00
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x2e0
mov rax, qword [0x1401930c0]
xor rax, rsp
mov qword [rsp + 0x2d8], rax
xor r15d, r15d
mov dword [rsp + 0x48], r15d
mov byte [0x14022dbd8], r15b
cmp dword [0x14022dc90], r15d
jne 0x14008fb58
call fcn.140090630
test al, al
je 0x140090451
xor edx, edx
mov r8d, 0xf8
lea rcx, [rsp + 0x180]
call fcn.140122d90
lea rcx, [0x140000000]
lea rax, [rcx + 0x179878]
mov qword [rsp + 0x180], rax
lea rax, [rcx + 0x1797d0]
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x220], r15
mov qword [rsp + 0x228], r15
mov dword [rsp + 0x230], r15d
mov qword [rsp + 0x238], r15
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x240], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x250], xmm1
movdqa xmmword [rsp + 0x260], xmm0
mov byte [rsp + 0x270], r15b
mov dword [rsp + 0x48], 1
lea rax, [0x140170d68]
mov qword [rsp + 0x218], rax
mov dword [rsp + 0x214], 0x80
mov qword [rsp + 0x188], r15
xor r8d, r8d
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0x218]
call fcn.14000f580
nop
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea rax, [0x140145c00]
mov qword [rsp + rcx + 0x190], rax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x18c], edx
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, [0x1401797e0]
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x20]
mov dword [rsp + rcx + 0x17c], edx
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, str.t3_t_
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x17c], edx
lea rcx, [rsp + 0x198]
call fcn.14000f150
lea rax, [0x1401797f0]
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x200], r15
mov dword [rsp + 0x208], r15d
lea rdx, str.HWID
lea rcx, [rsp + 0x190]
call fcn.1400926f0
mov edx, dword [0x14022dc90]
mov rcx, rax
call fcn.140090f80
mov rcx, rax
lea rdx, str.gamecsgo
call fcn.1400926f0
mov rcx, rax
lea rdx, [0x1401795f8]
call fcn.1400926f0
mov rcx, rax
lea rdx, [0x1401781ec]
call fcn.1400926f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x158], xmm0
mov qword [rsp + 0x168], r15
mov qword [rsp + 0x170], 0xf
mov byte [rsp + 0x158], 0
mov dword [rsp + 0x48], 0x21
xor eax, eax
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rax
mov rcx, r15
mov edx, dword [rsp + 0x208]
mov eax, edx
and al, 0x22
cmp al, 2
je 0x14008fdb1
mov rax, qword [rsp + 0x1d8]
mov rbx, qword [rax]
test rbx, rbx
je 0x14008fdb1
mov rax, qword [rsp + 0x1b8]
mov r9, qword [rax]
cmp rbx, qword [rsp + 0x200]
cmovb rbx, qword [rsp + 0x200]
sub rbx, r9
mov rcx, r9
jmp 0x14008fdef
test dl, 4
jne 0x14008fe28
mov rax, qword [rsp + 0x1d0]
mov rdx, qword [rax]
mov rbx, r15
test rdx, rdx
je 0x14008fdea
mov rax, qword [rsp + 0x1b0]
mov r9, qword [rax]
mov rax, qword [rsp + 0x1e8]
movsxd rbx, dword [rax]
add rbx, rdx
sub rbx, r9
mov rcx, r9
jmp 0x14008fdef
mov r9, qword [rsp + 0x68]
test rcx, rcx
je 0x14008fe28
lea rcx, [rsp + 0x158]
cmp rbx, 0xf
ja 0x14008fe1f
mov qword [rsp + 0x168], rbx
mov r8, rbx
mov rdx, r9
call fcn.1401226f0
mov byte [rsp + rbx + 0x158], 0
jmp 0x14008fe28
mov rdx, rbx
call fcn.140011e10
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0xc8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xd8], xmm1
mov r8d, 0x2f
lea rdx, str.Content_Type:_application_x_www_form_urlencoded
lea rcx, [rsp + 0xc8]
call fcn.1400032f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0xa8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xb8], xmm1
mov r12d, 0x14
mov r8d, r12d
lea rdx, str.auth_hwidAuthExtrim_
lea rcx, [rsp + 0xa8]
call fcn.1400032f0
nop
lea rax, [rsp + 0x158]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [0x14022e000]
lea r8d, [r12 - 0x13]
lea rdx, [rsp + 0x280]
call fcn.14008f290
nop
lea rcx, [rsp + 0xa8]
call fcn.14000e640
nop
lea rcx, [rsp + 0xc8]
call fcn.14000e640
nop
mov qword [rsp + 0xa0], r15
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x48]
call fcn.140048610
mov rdx, rax
movzx ecx, byte [0x14022dff0]
movzx eax, byte [rax]
mov byte [0x14022dff0], al
mov byte [rdx], cl
lea rcx, [rdx + 8]
mov rax, qword [0x14022dff8]
mov r8, qword [rcx]
mov qword [0x14022dff8], r8
mov qword [rcx], rax
movzx edx, byte [rdx]
call fcn.14000df10
nop
cmp byte [0x14022dff0], 1
sete dil
mov byte [rsp + 0x40], dil
mov r13, qword [0x14022dff8]
jne 0x1400901de
mov r14, qword [r13]
mov rbx, qword [r14 + 8]
mov rsi, r14
mov r12d, 5
cmp byte [rbx + 0x19], 0
jne 0x14008ffda
nop word [rax + rax]
lea rcx, [rbx + 0x20]
mov rdi, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x14008ff92
mov rcx, qword [rcx]
mov r8, rdi
cmp rdi, r12
cmova r8, r12
lea rdx, str.error
call fcn.1401231d0
test eax, eax
je 0x14008ffb2
jns 0x14008ffbd
mov al, 0xff
jmp 0x14008ffbf
cmp rdi, r12
jae 0x14008ffbb
mov al, 0xff
jmp 0x14008ffbf
jbe 0x14008ffc9
mov al, 1
test al, al
jns 0x14008ffc9
mov rbx, qword [rbx + 0x10]
jmp 0x14008ffcf
mov rsi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x14008ff80
movzx edi, byte [rsp + 0x40]
cmp byte [rsi + 0x19], 0
jne 0x1400901d8
lea rcx, [rsi + 0x20]
mov rbx, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x14008fff6
mov rcx, qword [rcx]
mov r8, rbx
cmp rbx, 5
cmova r8, r12
lea rdx, str.error
call fcn.1401231d0
test eax, eax
je 0x140090017
jns 0x140090023
mov al, 0xff
jmp 0x140090025
cmp rbx, 5
jae 0x140090021
mov al, 0xff
jmp 0x140090025
jbe 0x14009002d
mov al, 1
test al, al
jg 0x1400901d8
cmp rsi, r14
je 0x1400901d8
test dil, dil
je 0x1400901b7
mov rsi, r14
mov rbx, qword [r14 + 8]
mov r14d, 3
cmp byte [rbx + 0x19], 0
jne 0x1400900b5
nop dword [rax]
nop word [rax + rax]
lea rcx, [rbx + 0x20]
mov rdi, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x140090072
mov rcx, qword [rcx]
mov r8, rdi
cmp rdi, r14
cmova r8, r14
lea rdx, [0x1401796fc]
call fcn.1401231d0
test eax, eax
je 0x140090092
jns 0x14009009d
mov al, 0xff
jmp 0x14009009f
cmp rdi, r14
jae 0x14009009b
mov al, 0xff
jmp 0x14009009f
jbe 0x1400900a9
mov al, 1
test al, al
jns 0x1400900a9
mov rbx, qword [rbx + 0x10]
jmp 0x1400900af
mov rsi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x140090060
cmp byte [rsi + 0x19], 0
jne 0x1400901b7
lea rcx, [rsi + 0x20]
mov rbx, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x1400900d1
mov rcx, qword [rcx]
mov r8, rbx
cmp rbx, 3
cmova r8, r14
lea rdx, [0x1401796fc]
call fcn.1401231d0
test eax, eax
je 0x1400900f2
jns 0x1400900fe
mov al, 0xff
jmp 0x140090100
cmp rbx, 3
jae 0x1400900fc
mov al, 0xff
jmp 0x140090100
jbe 0x140090108
mov al, 1
test al, al
jg 0x1400901b7
cmp rsi, qword [r13]
je 0x1400901b7
mov r9d, 0x20010
lea r8, [0x140179678]
lea rdx, [0x140179690]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [0x1401796fc]
lea rcx, [0x14022dff0]
call fcn.14000ff20
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x14017b2e0]
movdqu xmmword [rsp + 0x78], xmm1
mov byte [rsp + 0x68], 0
mov dword [rsp + 0x48], 0x51
cmp byte [rax], 3
jne 0x140090485
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x68]
call fcn.14000c7c0
lea r8, [rsp + 0x68]
cmp qword [rsp + 0x80], 0xf
cmova r8, qword [rsp + 0x68]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
lea rcx, [rsp + 0x68]
call fcn.14000e640
jmp 0x140090428
mov r9d, 0x20010
lea r8, [0x140179678]
lea rdx, [0x140179718]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140090428
mov r12d, 0x14
lea rsi, [0x14022dff0]
mov qword [rsp + 0x68], rsi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
movabs rax, 0x8000000000000000
mov qword [rsp + 0x80], rax
movzx ecx, byte [rsi]
mov edx, ecx
sub edx, 1
je 0x140090244
cmp edx, 1
je 0x140090235
sub ecx, 1
je 0x140090244
cmp ecx, 1
je 0x140090235
mov qword [rsp + 0x80], 1
jmp 0x140090250
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x78], rcx
jmp 0x140090250
mov rax, qword [rsi + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x70], rcx
test dil, dil
je 0x14009031b
mov r13, qword [r13]
mov rbx, qword [r13 + 8]
mov r14, r13
cmp byte [rbx + 0x19], 0
jne 0x1400902c7
nop word [rax + rax]
lea rcx, [rbx + 0x20]
mov rdi, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x140090282
mov rcx, qword [rcx]
mov r8, rdi
cmp rdi, 0x14
cmova r8, r12
lea rdx, str.license_diff_minutes
call fcn.1401231d0
test eax, eax
je 0x1400902a3
jns 0x1400902af
mov al, 0xff
jmp 0x1400902b1
cmp rdi, 0x14
jae 0x1400902ad
mov al, 0xff
jmp 0x1400902b1
jbe 0x1400902bb
mov al, 1
test al, al
jns 0x1400902bb
mov rbx, qword [rbx + 0x10]
jmp 0x1400902c1
mov r14, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x140090270
cmp byte [r14 + 0x19], 0
jne 0x140090313
lea rcx, [r14 + 0x20]
mov rbx, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x1400902e0
mov rcx, qword [rcx]
mov r8, rbx
cmp rbx, 0x14
cmova r8, r12
lea rdx, str.license_diff_minutes
call fcn.1401231d0
test eax, eax
je 0x140090301
jns 0x14009030d
mov al, 0xff
jmp 0x14009030f
cmp rbx, 0x14
jae 0x14009030b
mov al, 0xff
jmp 0x14009030f
jbe 0x140090316
mov al, 1
test al, al
jle 0x140090316
mov r14, r13
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x48], rsi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movabs rax, 0x8000000000000000
mov qword [rsp + 0x60], rax
movzx ecx, byte [rsi]
mov edx, ecx
sub edx, 1
je 0x140090374
cmp edx, 1
je 0x140090365
sub ecx, 1
je 0x140090374
cmp ecx, 1
je 0x140090365
mov qword [rsp + 0x60], 1
jmp 0x140090380
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
jmp 0x140090380
mov rax, qword [rsi + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x50], rcx
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x68]
call fcn.14001ad90
test al, al
je 0x1400903fb
lea rdx, str.license_diff_minutes
mov rcx, rsi
call fcn.14000ff20
movzx edx, byte [rax]
mov r8d, edx
sub r8d, 5
je 0x1400903e0
sub r8d, 1
je 0x1400903d0
cmp r8d, 1
jne 0x1400904e0
add rax, 8
cmp dl, 7
cmovne rax, r15
cvttsd2si rcx, qword [rax]
jmp 0x1400903ef
add rax, 8
cmp dl, 6
cmovne rax, r15
mov rcx, qword [rax]
jmp 0x1400903ef
sub dl, 5
cmp dl, 1
ja 0x1400903ec
lea r15, [rax + 8]
mov rcx, qword [r15]
test rcx, rcx
jns 0x1400903fb
mov byte [0x14022dbd8], 1
lea rcx, [rsp + 0x280]
call fcn.14000e640
nop
lea rcx, [rsp + 0x158]
call fcn.14000e640
nop
lea rcx, [rsp + 0x180]
call fcn.140090540
mov al, 1
jmp 0x140090453
lea rcx, [rsp + 0x280]
call fcn.14000e640
nop
lea rcx, [rsp + 0x158]
call fcn.14000e640
nop
lea rcx, [rsp + 0x180]
call fcn.140090540
xor al, al
mov rcx, qword [rsp + 0x2d8]
xor rcx, rsp
call fcn.1400f0fb0
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov rcx, rax
call fcn.14000e470
mov rdx, rax
lea rcx, [rsp + 0xc8]
call fcn.1400032b0
nop
mov r8, rax
lea rdx, str.type_must_be_string__but_is
lea rcx, [rsp + 0xa8]
call fcn.14000fcf0
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rsp + 0xe8]
call fcn.140010e10
lea rdx, [0x140191770]
lea rcx, [rsp + 0xe8]
call fcn.1400f3334
nop
mov rcx, rax
call fcn.14000e470
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400032b0
nop
mov r8, rax
lea rdx, str.type_must_be_number__but_is
lea rcx, [rsp + 0x48]
call fcn.14000fcf0
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rsp + 0x120]
call fcn.140010e10
lea rdx, [0x140191770]
lea rcx, [rsp + 0x120]
call fcn.1400f3334
int3