Function at 0x140001030
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov rbx, rax
test rax, rax
jne 0x140001071
lea rcx, str.CreateJobObject
call fcn.1400014a0
lea eax, [rbx + 1]
jmp 0x1400012b6
xor edx, edx
lea rcx, [rsp + 0xe0]
mov r8d, 0x90
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x90
mov dword [rsp + 0xf0], 0x2000
lea r8, [rsp + 0xe0]
mov edx, 9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
jne 0x1400010c7
lea rcx, [0x140003440]
call fcn.1400014a0
mov eax, 1
jmp 0x1400012b6
xor edx, edx
mov qword [rsp + 0x190], rdi
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rsp + 0x70], 0x68
xor edi, edi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea rcx, str.trojan.exe
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor edx, edx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000114d
lea rcx, str.Starting_trojan
call fcn.1400014a0
lea eax, [rdi + 1]
jmp 0x1400012ae
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x140001180
lea rcx, [0x140003480]
call fcn.1400014a0
mov eax, 1
jmp 0x1400012ae
mov rax, qword [rsp + 0x50]
mov qword [0x140005628], rax
call fcn.140001370
lea rax, [rsp + 0x50]
mov word [rsp + 0xb0], di
mov qword [rsp + 0x48], rax
lea rcx, str.tj_privoxy.exe
lea rax, [rsp + 0x70]
mov dword [rsp + 0xac], 1
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rdi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
xor edx, edx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400011f9
lea rcx, str.Starting_Privoxy
call fcn.1400014a0
mov eax, 1
jmp 0x1400012ae
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x14000122c
lea rcx, [0x1400034f8]
call fcn.1400014a0
mov eax, 1
jmp 0x1400012ae
mov rax, qword [rsp + 0x50]
mov qword [0x140005630], rax
call fcn.1400015f0
test eax, eax
jne 0x140001254
lea rcx, str.setProxy
call fcn.1400014a0
mov eax, 1
jmp 0x1400012ae
mov edx, 1
lea rcx, section..text
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
jne 0x14000127d
lea rcx, [0x140003528]
call fcn.1400014a0
mov eax, 1
jmp 0x1400012ae
xor r8d, r8d
lea rdx, [0x140005628]
or r9d, 0xffffffff
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp dword [0x140005620], edi
jne 0x1400012ac
call fcn.1400016a0
mov dword [0x140005620], 1
xor eax, eax
mov rdi, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140001740
add rsp, 0x180
pop rbx
ret