Function at 0x14168c1b8
Capabilities:
Create process on windows
Terminate process

Disassembly:
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
or byte [rax], al
dec dword [rdi]
ud0
push rdi
sub rsp, 0x2b0
xor eax, eax
test eax, eax
je 0x14168b6e1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test ebx, ebx
jne 0x14168b4f7
cmp dword [r14 + 0x14], ebx
je 0x14168b48d
cmp dword [r9 + 0x70000cf], eax
or byte [rbx + 0x71ce9c7], 0
add byte [rax - 0x73], cl
adc eax, 0x49c78b4c
mov edx, ebp
call 0x14168c1b8
jmp 0x14168b494
lea r11, [r12 + rcx*2]
cmp eax, esi
jne 0x14168b49b
invalid
mov qword [rcx + rax*8], rdi
jmp 0x14168b4a7
cmp qword [rcx + rax*8 + 8], rdx
loopne 0x14168b4ee
mov esi, edx
mov qword [rax - 0x28], r12
mov rdi, rcx
fmul dword [rax - 0x75]
stc
call qword [0x1a671b9f0]
loopne 0x14168b4b3
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rbp - 0x28], ecx
call fcn.141641c80
mov r14d, 2
mov dword [rbp - 1], r14d
mov rcx, qword [rdx + 0x40]
add rcx, 0x20
jmp 0x141657480
mov rcx, qword [rax - 0x75]
invalid
add eax, 0x8b800040
sar edi, cl
push rax
xor byte [rbp + rdi*2 - 0x74b70003], ch
enter 0xffffffffffff8548, 0xffffffffffffffc0
je 0x14168b7be
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
mov rcx, rbx
call qword [0x1416b13a0]
mov eax, esi
mov rcx, qword [rsp + 0x60]
mov ecx, 0x80004005
call 0x1416a7b70
int3
xor eax, eax
test eax, eax
je 0x14168b989
nop
nop
nop
nop
nop
lodsb al, byte [rsi]
and al, 0x60
invalid
mov ecx, dword [rax + 0x78]
je 0x14168b80e
cmp byte [0x14171bd89], r12b
jne 0x14168b8d5
mov dword [0x1416fffe0], ecx
cmp byte [0x1417014d9], 0
jne 0x14168b814
call 0x1b674fb1d
add eax, 0x1bf
add byte [rbx + 0x4c8b48c7], cl
and al, 0x89
invalid
nop
nop
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x14168b829
cmp byte [rax - 0x7b], cl
sal byte [rdi + rcx + 0x48], cl
or eax, 0xffffffff
or rax, 0xffffffffffffffff
inc qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x475f4]
lea rcx, [rbp + 0x138]
call fcn.141667e70
and al, 0x28
lea rax, [rsp + 0x60]
mov qword [rbp + rax*2 - 0x75], rax
invalid
xor eax, eax
test eax, eax
je 0x14168bc31
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
test ebx, ebx
js 0x18668bcd7
add dword [rax - 0x75], ecx
invalid
mov r15b, 0x48
mov bh, 0x48
lea eax, [0x1416d10a8]
mov r9d, 0x12
call fcn.14163f4b0
test rbx, rbx
je 0x14168bb2d
nop
sbb byte [rbx], dh
sal bh, cl
ja 0x14168b9e6
inc edx
cmp edx, dword [rdi + 0x10]
jae 0x14168b996
mov rax, qword [rdi]
call 0x18973452d
mov eax, dword [rcx]
call qword [rax + 8]
jmp 0x14168bc6b
add edi, edi
push rax
or cl, ch
jl 0x14168b9ef
add byte [rax], al
sub dword [rax], 0xffffffff
adc eax, 0x234a9
nop
mov rcx, qword [rsp + 0x20]
test rcx, rcx
mov qword [rbp - 0x78], r13
xor ebx, ebx
mov dword [rbp - 0x70], ebx
mov qword [rbp - 0x68], rbx
mov rdx, rdi
js 0x14168b9a2
add dword [rax], eax
mov edi, eax
mov rcx, qword [0x14170f420]
test rcx, rcx
mov qword [rdi + 8], rax
test rbx, rbx
jne 0x14168b9b0
xor edi, edi
test esi, esi
setle byte [rbx - 0x76b7e740]
push 0x707d8844
mov rax, qword [rsi]
or edi, 0xffffffe8
scasd eax, dword [rdi]
mov ah, 0xfe
dec dword [rcx + rdi + 0x7d]
sal byte [rdi - 0x23], 1
xorps xmm0, xmm0
wbnoinvd
add byte fs:[rax], al
std
invalid
mov dword [rsp - 0x14], ebx
sub rsp, 0x40
mov rsi, r9
mov r15, r8
mov r13, rdx
mov r15, rdi
add rsp, 0x20
pop rbp
ret
call fcn.141689e20
test eax, eax
jne 0x14168c781
xor eax, eax
test eax, eax
je 0x14168bee6
nop
nop
nop
nop
nop
nop
nop
nop
pcmpgtd mm0, qword [rbx + 0x9740d3f]
add rdi, 2
cmp rdi, rbp
jb 0x14168bc4b
invalid
insb byte [rdi], dx
and al, 0x38
mov rcx, rcx
je 0x14168bc79
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14168bc80
call qword [rdx + 0x18]
add rax, rbx
mov qword [0x1416f89b0], rax
call fcn.141698440
or dword [rdx], eax
add byte [rax], al
lea rdx, [0x1416d32a8]
lea rcx, [rbp - 0x7efa72b8]
test eax, 0x7ae90003
invalid
push rdx
sbb byte [rax + 3], cl
ret
mov r8d, 0x208
lea rdx, [rsp + 0xa0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
test eax, eax
je 0x14168c1a4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [rsp + 0x30], 0x70
lea rax, [rsp + 0x34]
mov rdi, rax
xor eax, eax
mov ecx, 0x6c
rep stosb byte [rdi], al
mov eax, 0x72
mov word [rsp + 0x20], ax
mov eax, 0x75
mov word [rsp + 0x22], ax
mov eax, 0x6e
mov word [rsp + 0x24], ax
mov eax, 0x61
mov word [rsp + 0x26], ax
mov eax, 0x73
mov word [rsp + 0x28], ax
xor eax, eax
mov word [rsp + 0x2a], ax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x60], 1
xor eax, eax
test eax, eax
je 0x14168c4c6
nop
nop
nop
nop
nop
nop
nop
nop
invalid
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x2b0
pop rdi
ret