Function at 0x140001596
Capabilities:
Create process on windows
Create thread

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
call dbg.__main
lea rax, str.notepad.exe
mov rcx, rax
call sym.FindProcessId_char_const_
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x1400015d4
lea rax, str.Could_not_find_notepad.exe_process._n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 1
jmp 0x1400018e7
mov eax, dword [rbp - 4]
mov edx, eax
lea rax, str.Found_notepad.exe_with_process_ID__lu_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, [rbp - 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.ThreadFunction_void_]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140001640
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.CreateThread_failed_with_error__lu_n
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x140001674
lea rax, str.CreateThread_succeeded_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp - 0x10]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp - 4]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x1400016b7
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.OpenProcess_failed_with_error__lu_n
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x1400017d1
mov rax, qword [rbp - 0x18]
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8d, 0x1000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp - 0x20], rax
cmp qword [rbp - 0x20], 0
jne 0x14000170a
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.VirtualAllocEx_failed_with_error__lu_n
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x1400017c1
mov rax, qword [rbp - 0x18]
lea rdx, [rbp - 0x34]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0
mov rdx, qword [rbp - 0x20]
mov qword [rsp + 0x20], rdx
lea r9, [sym.ThreadFunction_void_]
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000176d
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.CreateRemoteThread_failed_with_error__lu_n
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x1400017a1
lea rax, str.CreateRemoteThread_succeeded_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp - 0x10]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x18]
mov r9d, 0x8000
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x1000
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x28], rax
cmp qword [rbp - 0x28], 0
jne 0x140001817
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.VirtualAlloc_failed_with_error__lu_n
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x140001841
lea rax, str.VirtualAlloc_succeeded_n
mov rcx, rax
call sym.printf_char_const__::_
mov rax, qword [rbp - 0x28]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call rax
test eax, eax
setne al
test al, al
je 0x140001864
lea rax, str.Debugger_is_present_n
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x140001873
lea rax, str.Debugger_is_not_present_n
mov rcx, rax
call sym.printf_char_const__::_
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9d, 0
lea r8, str.notepad.exe
lea rax, str.open
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
cmp rax, 0x20
ja 0x1400018d3
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.ShellExecute_failed_with_error__lu_n
mov rcx, rax
call sym.printf_char_const__::_
jmp 0x1400018e2
lea rax, str.ShellExecute_succeeded_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
sub rsp, 0xffffffffffffff80
pop rbp
ret