Function at 0x1401206d0
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x1b8
lea rbp, [rsp + 0x1f0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x150], xmm4
movaps xmmword [rbp - 0x140], xmm4
movabs rax, 0xffffffffffffff10
movaps xmmword [rbp + rax - 0x40], xmm4
movaps xmmword [rbp + rax - 0x30], xmm4
movaps xmmword [rbp + rax - 0x20], xmm4
add rax, 0x30
jne 0x140120706
mov qword [rbp - 0x40], rax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rbx, rcx
mov r14, rdx
mov r15, r8
mov r12, r9
mov r13, qword [rbp + 0x48]
test rbx, rbx
je 0x140120771
mov edx, dword [rbx + 8]
lea rcx, [rbx + 0xc]
mov qword [rbp - 0x130], rcx
mov rcx, qword [rbp - 0x130]
mov dword [rsp + 0x20], 1
xor r8d, r8d
mov dword [rsp + 0x28], r8d
mov r9d, 1
call fcn.1400ea200
mov rcx, rax
jmp 0x140120773
xor ecx, ecx
xor edx, edx
mov qword [rbp - 0x130], rdx
mov qword [rbp - 0x40], rcx
test r14, r14
je 0x1401207bb
mov edx, dword [r14 + 8]
lea rcx, [r14 + 0xc]
mov qword [rbp - 0x138], rcx
mov rcx, qword [rbp - 0x138]
mov dword [rsp + 0x20], 1
xor r8d, r8d
mov dword [rsp + 0x28], r8d
mov r9d, 1
call fcn.1400ea200
mov rcx, rax
jmp 0x1401207bd
xor ecx, ecx
xor edx, edx
mov qword [rbp - 0x138], rdx
mov qword [rbp - 0x48], rcx
xor edi, edi
cmp byte [rbp + 0x30], 0
setne dil
mov dword [rbp - 0x4c], edi
test r13, r13
je 0x14012080f
mov edx, dword [r13 + 8]
lea rcx, [r13 + 0xc]
mov qword [rbp - 0x148], rcx
mov rcx, qword [rbp - 0x148]
mov dword [rsp + 0x20], 1
xor r8d, r8d
mov dword [rsp + 0x28], r8d
mov r9d, 1
call fcn.1400ea200
jmp 0x140120816
xor ecx, ecx
xor edx, edx
mov rax, rdx
xor ecx, ecx
mov qword [rbp - 0x148], rcx
mov qword [rbp - 0x140], rax
mov qword [rbp - 0x58], rax
lea rdi, [rbp - 0xb8]
mov rsi, qword [rbp + 0x50]
mov ecx, 0xc
rep movsq qword [rdi], qword [rsi]
xor ecx, ecx
xorps xmm0, xmm0
movups xmmword [rbp - 0x120], xmm0
movups xmmword [rbp - 0x110], xmm0
movups xmmword [rbp - 0x100], xmm0
movups xmmword [rbp - 0xf0], xmm0
movups xmmword [rbp - 0xe0], xmm0
movups xmmword [rbp - 0xd0], xmm0
mov qword [rbp - 0xc0], rcx
lea rcx, [rbp - 0xb8]
lea rdx, [rbp - 0x120]
call fcn.14018df90
mov rsi, qword [rbp + 0x58]
mov qword [rbp - 0x128], rsi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ebx, dword [rbp - 0x4c]
mov dword [rsp + 0x20], ebx
mov ebx, dword [rbp + 0x38]
mov dword [rsp + 0x28], ebx
mov rbx, qword [rbp + 0x40]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rbp - 0x140]
mov qword [rsp + 0x38], rbx
lea rcx, [rbp - 0x120]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rsi
mov rcx, qword [rbp - 0x40]
mov qword [rbp - 0x158], rcx
mov rdx, qword [rbp - 0x48]
mov qword [rbp - 0x160], rdx
mov r8, r15
mov qword [rbp - 0x168], r8
mov r9, r12
mov qword [rbp - 0x170], r9
lea rcx, [rbp - 0x198]
call fcn.140004070
mov rcx, qword [rbp - 0x158]
mov rdx, qword [rbp - 0x160]
mov r8, qword [rbp - 0x168]
mov r9, qword [rbp - 0x170]
call sub.KERNEL32.dll_CreateProcessA
mov esi, eax
lea rcx, [rbp - 0x198]
call fcn.1400040c0
call fcn.140002bd7
mov rdi, rax
mov qword [rbp - 0x150], rdi
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [rbp - 0x150]
mov dword [rcx + 8], eax
test esi, esi
setne sil
movzx esi, sil
cmp qword [rbp + 0x10], 0
je 0x140120975
mov rbx, qword [rbp - 0x40]
test rbx, 0xffffffffffff0000
je 0x140120975
mov rcx, rbx
call fcn.140113500
cmp qword [rbp + 0x18], 0
je 0x140120991
mov r14, qword [rbp - 0x48]
test r14, 0xffffffffffff0000
je 0x140120991
mov rcx, r14
call fcn.140113500
cmp qword [rbp + 0x48], 0
je 0x1401209ad
mov r15, qword [rbp - 0x58]
test r15, 0xffffffffffff0000
je 0x1401209ad
mov rcx, r15
call fcn.140113500
lea rcx, [rbp - 0x120]
call fcn.14018de10
movzx eax, sil
add rsp, 0x1b8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret