Function at 0x140015b10
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x178
movaps xmmword [rsp + 0x160], xmm6
mov byte [rsp + 0x5f], r8b
mov rdi, rdx
mov rdx, rcx
mov rax, qword [0x140036010]
xor rax, rsp
mov qword [rsp + 0x158], rax
lea rsi, [rsp + 0x110]
mov rcx, rsi
call fcn.14001a3b0
mov rcx, rsi
call fcn.140027180
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 7
mov word [rax], 0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x14001619a
lea rbp, [rcx + 2]
lea rax, [rsp + 0x60]
mov qword [rax + 0x10], rbp
mov rbp, rax
cmp rdx, 8
jb 0x140015bbb
mov rbp, qword [rsp + 0x60]
mov dword [rbp + rcx*2], 0x200022
mov word [rbp + rcx*2 + 4], 0
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x140], xmm1
movaps xmmword [rsp + 0x130], xmm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 7
mov word [rax], 0
mov rax, qword [rsp + 0x78]
cmp rax, 8
jb 0x140015c20
mov rcx, qword [rsp + 0x60]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x1400161be
call fcn.140020c40
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], 0
mov rax, qword [rsp + 0x128]
cmp rax, 8
jb 0x140015c69
mov rcx, qword [rsp + 0x110]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x1400161e1
call fcn.140020c40
mov r14, qword [rdi]
mov r15, qword [rdi + 8]
cmp r14, r15
je 0x140016056
xorps xmm6, xmm6
lea rdi, [rsp + 0xd0]
lea rbp, [rsp + 0xf0]
lea rax, [rsp + 0x70]
movups xmmword [rax], xmm6
cmp qword [r14 + 0x18], 0x10
mov rbx, r14
jb 0x140015ca1
mov rbx, qword [r14]
mov r12, qword [r14 + 0x10]
cmp r12, 0xf
ja 0x140015f5b
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x60], xmm0
mov r13d, 0xf
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r13
mov rcx, rdi
lea rdx, [rsp + 0x60]
call fcn.14001a3b0
mov rcx, rdi
call fcn.140027180
lea rcx, [rsp + 0x100]
movups xmmword [rcx], xmm6
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x100], xmm1
movaps xmmword [rsp + 0xf0], xmm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 7
mov word [rax], 0
mov rax, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x108]
mov rdx, rcx
sub rdx, rax
cmp rdx, 2
jb 0x140015f02
lea rdx, [rax + 2]
mov qword [rsp + 0x100], rdx
mov rdx, rbp
cmp rcx, 8
jb 0x140015d50
mov rdx, qword [rsp + 0xf0]
mov dword [rdx + rax*2], 0x200022
mov word [rdx + rax*2 + 4], 0
mov rax, rbp
lea rcx, [rsp + 0x120]
movups xmmword [rcx], xmm6
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x120], xmm1
movaps xmmword [rsp + 0x110], xmm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 7
mov word [rax], 0
mov r8, qword [rsp + 0x120]
cmp qword [rsp + 0x128], 8
lea r9, [rsp + 0x110]
jb 0x140015dbb
mov r9, qword [rsp + 0x110]
mov rax, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x148]
mov rdx, rcx
sub rdx, rax
cmp rdx, r8
jb 0x140015f24
lea rbx, [rax + r8]
mov qword [rsp + 0x140], rbx
lea rsi, [rsp + 0x130]
cmp rcx, 8
jb 0x140015dfc
mov rsi, qword [rsp + 0x130]
lea rcx, [rsi + rax*2]
add r8, r8
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rsi + rbx*2], 0
mov rax, qword [rsp + 0x128]
cmp rax, 8
jb 0x140015e41
mov rcx, qword [rsp + 0x110]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x140015fa3
call fcn.140020c40
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 7
mov word [rsp + 0x110], 0
mov rax, qword [rsp + 0x108]
cmp rax, 8
jb 0x140015e93
mov rcx, qword [rsp + 0xf0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x140015fca
call fcn.140020c40
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 7
mov word [rsp + 0xf0], 0
mov rax, qword [rsp + 0xe8]
cmp rax, 8
jb 0x140015ee5
mov rcx, qword [rsp + 0xd0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x140015ff1
call fcn.140020c40
mov rax, qword [rsp + 0x78]
cmp rax, 0x10
jae 0x140015f3e
add r14, 0x20
cmp r14, r15
jne 0x140015c8c
jmp 0x140016056
mov qword [rsp + 0x20], 2
mov edx, 2
mov rcx, rbp
lea r9, [0x140031fd4]
call fcn.1400245f0
jmp 0x140015d61
mov qword [rsp + 0x20], r8
lea rcx, [rsp + 0x130]
mov rdx, r8
call fcn.1400245f0
jmp 0x140015e11
mov rcx, qword [rsp + 0x60]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x140016032
call fcn.140020c40
jmp 0x140015ef0
mov r13, r12
or r13, 0xf
movabs rax, 0x7fffffffffffffff
cmp r13, rax
cmovae r13, rax
cmp r13, 0xfff
jae 0x140016018
lea rcx, [r13 + 1]
call fcn.140020c48
mov rcx, rax
mov qword [rsp + 0x60], rcx
lea r8, [r12 + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140015cbd
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140016227
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbx
jmp 0x140015e3c
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140016227
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbx
jmp 0x140015e8e
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140016227
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbx
jmp 0x140015ee0
lea rcx, [r13 + 0x28]
call fcn.140020c48
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140015f8c
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140016227
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x140015f54
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
xor eax, eax
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x60], 0x68
mov qword [rsp + 0x120], rax
movaps xmmword [rsp + 0x110], xmm0
cmp qword [rsp + 0x148], 8
jb 0x1400160ba
mov rdx, qword [rsp + 0x130]
jmp 0x1400160c2
lea rdx, [rsp + 0x130]
lea rax, [rsp + 0x110]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000020
mov dword [rsp + 0x20], 0
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test eax, eax
je 0x140016137
cmp byte [rsp + 0x5f], 0
je 0x14001611c
mov rcx, qword [rsp + 0x110]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x110]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0x118]
call rdi
mov rax, qword [rsp + 0x148]
cmp rax, 8
jb 0x140016167
mov rcx, qword [rsp + 0x130]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x140016204
call fcn.140020c40
test esi, esi
setne bl
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.140021cd0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x160]
add rsp, 0x178
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x20], 2
lea r9, [0x140031fd4]
lea rcx, [rsp + 0x60]
mov edx, 2
call fcn.1400245f0
jmp 0x140015bca
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140016227
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
jmp 0x140015c1b
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140016227
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
jmp 0x140015c64
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x140016227
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, rbp
jmp 0x140016162
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3