Function at 0x1400196c8
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov rax, qword [0x1400c7100]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov r15, r8
mov rsi, rdx
mov r12, rcx
mov qword [rbp - 0x78], rcx
xor edi, edi
cmp dword [rdx + 0xa4], 5
je 0x14001a0d4
mov eax, dword [rdx + 0xa0]
lea r14d, [rdi + 7]
mov r13d, 0x1000
cmp eax, 2
jne 0x140019d10
lea rbx, [rdx + 0xe0]
mov rdx, rbx
cmp qword [rbx + 0x18], r14
jbe 0x140019740
mov rdx, qword [rbx]
lea rcx, str.Waiting_on_process__ls
call fcn.140019174
mov rdx, rbx
lea rcx, [rbp + 0x60]
call fcn.140027a30
nop
xorps xmm0, xmm0
cmp qword [rbp + 0x70], rdi
jne 0x140019878
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov r8, r14
lea rdx, str.Warning
lea rcx, [rbp + 0x40]
call fcn.140008f40
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x90], xmm1
mov r8d, 0x25
lea rdx, str.Please_select_executable_to_wait_for_n
lea rcx, [rbp + 0x80]
call fcn.140008f40
nop
mov rax, qword [r12]
mov r9, qword [rax]
mov r8d, 1
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.140013f68
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, r14
jbe 0x140019818
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019813
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a106
call fcn.14006c690
movdqa xmm0, xmmword [0x1400b61d0]
movdqu xmmword [rbp + 0x90], xmm0
mov word [rbp + 0x80], di
mov rdx, qword [rbp + 0x58]
cmp rdx, r14
jbe 0x14001986e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019869
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a10c
call fcn.14006c690
mov ebx, 0xc0000225
jmp 0x140019bf3
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rdi
lea r12, [rsi + 0x108]
mov rax, qword [r12 + 8]
cmp qword [r12], rax
jne 0x14001999f
lea r8, [rbp + 0x60]
lea rcx, [rbp + 0x80]
call fcn.140034050
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
mov rbx, rdi
mov qword [rbp + 0x50], rbx
lea rdx, [rax + 8]
lea rcx, [rsp + 0x70]
cmp byte [rdx + 0x18], dil
je 0x1400198cf
call fcn.14001d6bc
jmp 0x1400198dc
lea rdx, [rbp + 0x40]
call fcn.14001d6bc
mov rbx, qword [rbp + 0x50]
lea rax, [rsp + 0x70]
cmp r12, rax
je 0x140019917
mov rcx, r12
call fcn.14001d020
mov rax, qword [rsp + 0x70]
mov qword [r12], rax
mov rax, qword [rsp + 0x78]
mov qword [r12 + 8], rax
mov rax, qword [rbp - 0x80]
mov qword [r12 + 0x10], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rdi
lea rcx, [rsp + 0x70]
call fcn.14001d020
nop
mov rdi, qword [rbp + 0x40]
test rdi, rdi
je 0x140019988
cmp rdi, qword [rbp + 0x48]
je 0x140019954
lea r14, [rdi + 8]
lea rcx, [r14 + 0x20]
call fcn.14001daa0
mov rcx, r14
call fcn.140007620
add r14, 0x40
lea rax, [r14 - 8]
cmp rax, qword [rbp + 0x48]
jne 0x140019935
sub rbx, rdi
and rbx, 0xffffffffffffffc0
mov rax, rdi
cmp rbx, r13
jb 0x14001997c
add rbx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a112
mov rdx, rbx
mov rcx, rdi
call fcn.14006c690
nop
xor edi, edi
cmp byte [rbp + 0xa0], dil
je 0x14001999f
lea rcx, [rbp + 0x88]
call fcn.14001d020
mov byte [rsi + 0x104], 1
lea r15, [rsi + 0x120]
mov r13, qword [rsp + 0x60]
mov rax, qword [r15 + 8]
cmp qword [r15], rax
je 0x140019a41
lea rax, [rsp + 0x58]
cmp r12, rax
je 0x1400199e2
mov r8, r13
sub r8, qword [rsp + 0x58]
sar r8, 6
mov rdx, qword [rsp + 0x58]
mov rcx, r12
call fcn.14001d220
mov eax, dword [rsi + 0x100]
cmp eax, dword [rsi + 0xb0]
jae 0x140019c03
inc eax
mov dword [rsi + 0x100], eax
mov rdi, qword [r15]
mov r14, qword [r15 + 8]
lea rbx, [rdi + 0x40]
jmp 0x140019a1c
mov rdx, rbx
mov rcx, rdi
call fcn.14001d170
add rdi, 0x40
add rbx, 0x40
cmp rbx, r14
jne 0x140019a09
mov rbx, qword [r15 + 8]
lea rcx, [rbx - 0x18]
call fcn.14001daa0
lea rcx, [rbx - 0x38]
call fcn.140007620
add qword [r15 + 8], 0xffffffffffffffc0
jmp 0x140019bbd
lea r8, [rbp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.140034050
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x80], xmm0
mov rbx, rdi
mov qword [rbp + 0x90], rbx
lea rdx, [rax + 8]
lea rcx, [rbp + 0x40]
cmp byte [rdx + 0x18], dil
je 0x140019a79
call fcn.14001d6bc
jmp 0x140019a8c
lea rdx, [rbp + 0x80]
call fcn.14001d6bc
mov rbx, qword [rbp + 0x90]
lea rcx, [rsp + 0x58]
call fcn.14001d020
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x58], rax
mov r13, qword [rbp + 0x48]
mov qword [rsp + 0x60], r13
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rdi
lea rcx, [rbp + 0x40]
call fcn.14001d020
nop
mov rdi, qword [rbp + 0x80]
test rdi, rdi
je 0x140019b3a
cmp rdi, qword [rbp + 0x88]
je 0x140019b02
lea r14, [rdi + 8]
lea rcx, [r14 + 0x20]
call fcn.14001daa0
mov rcx, r14
call fcn.140007620
add r14, 0x40
lea rax, [r14 - 8]
cmp rax, qword [rbp + 0x88]
jne 0x140019ae0
sub rbx, rdi
and rbx, 0xffffffffffffffc0
mov rax, rdi
cmp rbx, 0x1000
jb 0x140019b2e
add rbx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a118
mov rdx, rbx
mov rcx, rdi
call fcn.14006c690
nop
cmp byte [rbp - 0x40], 0
je 0x140019b49
lea rcx, [rbp - 0x58]
call fcn.14001d020
mov rax, qword [r15]
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], rax
mov rdi, qword [r12]
mov r14, qword [rsi + 0x110]
movaps xmm0, xmmword [rbp - 0x70]
movaps xmmword [rbp + 0x40], xmm0
mov rbx, qword [rsp + 0x58]
cmp rbx, r13
je 0x140019ba1
cmp rdi, r14
je 0x140019b9d
mov eax, dword [rdi]
cmp dword [rbx], eax
jae 0x140019b8e
mov rdx, rbx
lea rcx, [rbp + 0x40]
call fcn.14001ddcc
add rbx, 0x40
jmp 0x140019b98
ja 0x140019b94
add rbx, 0x40
add rdi, 0x40
cmp rbx, r13
jne 0x140019b71
movaps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x40], xmm0
jmp 0x140019bb8
mov rdx, rbx
lea rcx, [rbp + 0x40]
call fcn.14001ddcc
add rbx, 0x40
cmp rbx, r13
jne 0x140019ba8
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
cmp byte [rsi + 0x104], dil
jne 0x1400199b2
lea rcx, str.Process_wait_canceled_by_user
call fcn.1400190e8
mov ebx, 0xc0000240
lea rcx, [rsp + 0x58]
call fcn.14001d020
nop
lea rcx, [rbp + 0x60]
call fcn.140007620
mov eax, ebx
jmp 0x14001a0d6
mov rdi, qword [r15]
mov eax, dword [rdi]
mov dword [rsi + 0xc0], eax
mov r14, qword [r15 + 8]
lea rbx, [rdi + 0x40]
jmp 0x140019c2b
mov rdx, rbx
mov rcx, rdi
call fcn.14001d170
add rdi, 0x40
add rbx, 0x40
cmp rbx, r14
jne 0x140019c18
mov rbx, qword [r15 + 8]
lea rcx, [rbx - 0x18]
call fcn.14001daa0
lea rcx, [rbx - 0x38]
call fcn.140007620
add qword [r15 + 8], 0xffffffffffffffc0
mov edx, dword [rsi + 0xc0]
lea rcx, str.Got_process__d
call fcn.140019200
nop
lea rcx, [rsp + 0x58]
call fcn.14001d020
nop
lea rcx, [rbp + 0x60]
call fcn.140007620
mov r13d, 0x1000
mov r12, qword [rbp - 0x78]
xor edi, edi
cmp dword [rsi + 0xa4], 2
jae 0x14001a0d4
cmp dword [rsi + 0xa0], 1
je 0x14001a0d4
lea r14, [r12 + 8]
cmp byte [rsi + 0xb8], dil
je 0x140019f76
lea rcx, str.Escalating_process_handle_access
call fcn.140019174
mov r8d, r13d
mov edx, dword [rsi + 0xc0]
mov rcx, r14
call fcn.140033c50
mov ebx, eax
test eax, eax
js 0x140019cfd
call fcn.140014078
mov rdi, rax
mov rbx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, 0x1d7b
mov r8, rbx
mov edx, eax
mov rcx, rdi
call fcn.1400291a0
mov ebx, eax
xor edi, edi
test eax, eax
jns 0x140019f90
mov edx, ebx
lea rcx, str.Failed_to_escalate_process_handle_access__status_0x_X
call fcn.140018fd0
jmp 0x140019fa2
cmp eax, 1
jne 0x140019c7e
xor edx, edx
lea r8d, [rax + 0x63]
lea rcx, [rbp - 0x2c]
call fcn.140098980
mov dword [rbp - 0x30], 0x68
lea rdi, [rsi + 0x38]
mov r8, rdi
cmp qword [rdi + 0x18], r14
jbe 0x140019d3f
mov r8, qword [rdi]
lea rbx, [rsi + 0xe0]
mov rdx, rbx
cmp qword [rbx + 0x18], r14
jbe 0x140019d52
mov rdx, qword [rbx]
lea rcx, str.Creating_new_process__ls_with_arguments__ls
call fcn.140019174
mov rdx, rbx
lea rcx, [rbp + 0x60]
call fcn.140027ce0
cmp qword [rax + 0x18], r14
jbe 0x140019d73
mov rax, qword [rax]
cmp qword [rdi + 0x18], r14
jbe 0x140019d7c
mov rdi, qword [rdi]
cmp qword [rbx + 0x18], r14
jbe 0x140019d85
mov rbx, qword [rbx]
mov qword [rsp + 0x48], r15
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
lea rcx, [rbp + 0x60]
call fcn.140007620
xor edi, edi
test ebx, ebx
jne 0x140019ea3
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
lea r8d, [rdi + 5]
lea rdx, [0x1400abd30]
lea rcx, [rbp + 0x60]
call fcn.140008f40
nop
mov rax, qword gs:[0x30]
mov edx, dword [rax + 0x1250]
lea rcx, [rbp + 0x40]
call fcn.140028520
nop
mov r8, rax
lea rdx, str.Failed_to_create_new_process._n
lea rcx, [rbp + 0x80]
call fcn.140017324
nop
mov rcx, qword [r12]
mov r9, qword [rcx]
xor r8d, r8d
lea rdx, [rbp + 0x60]
mov rcx, rax
call fcn.140013f68
nop
lea rcx, [rbp + 0x80]
call fcn.140007620
nop
lea rcx, [rbp + 0x40]
call fcn.140007620
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, r14
jbe 0x140019e8f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, r13
jb 0x140019e8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a11e
call fcn.14006c690
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
jmp 0x14001a0d6
lea r14, [r12 + 8]
cmp byte [rsi + 0xb8], dil
je 0x140019efe
lea rcx, [0x1400abd80]
call fcn.140019174
mov r8d, r13d
mov edx, dword [r15 + 0x10]
mov rcx, r14
call fcn.140033c50
mov ebx, eax
test eax, eax
js 0x140019f63
call fcn.140014078
mov rdi, rax
mov rbx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, 0x1d7b
mov r8, rbx
mov edx, eax
mov rcx, rdi
call fcn.1400291a0
xor edi, edi
jmp 0x140019f10
mov r8d, 0xd7b
mov edx, dword [r15 + 0x10]
mov rcx, r14
call fcn.140033c50
mov ebx, eax
test eax, eax
js 0x140019f63
mov rcx, r14
call fcn.140033df0
cmp dword [rsi + 0xa4], 2
jb 0x140019f57
mov eax, dword [r15 + 0x10]
mov dword [rsi + 0xc0], eax
mov rcx, r14
call fcn.140033d40
cmp dword [rsi + 0xa4], 3
jne 0x140019f57
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [rsi + 0xb4], dil
jmp 0x140019c7e
mov edx, ebx
lea rcx, str.Failed_to_attach_to_process__status_0x_X
call fcn.140018fd0
jmp 0x140019bfc
mov r8d, 0xd7b
mov edx, dword [rsi + 0xc0]
mov rcx, r14
call fcn.140033c50
mov ebx, eax
test eax, eax
js 0x140019fa2
mov rcx, r14
call fcn.140033ea0
mov ecx, 0xc000010a
test al, al
cmove ebx, ecx
test ebx, ebx
je 0x14001a060
mov edx, ebx
lea rcx, [rbp + 0x40]
call fcn.140028520
nop
mov r8, rax
lea rdx, str.Can_not_attach_to_the_process._n
lea rcx, [rbp + 0x80]
call fcn.140017324
nop
lea rcx, [rbp + 0x40]
call fcn.140007620
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
mov r8d, 5
lea rdx, [0x1400abe80]
lea rcx, [rbp + 0x60]
call fcn.140008f40
nop
mov rax, qword [r12]
mov r9, qword [rax]
xor r8d, r8d
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x80]
call fcn.140013f68
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 7
jbe 0x14001a054
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, r13
jb 0x14001a04e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a100
call fcn.14006c690
nop
lea rcx, [rbp + 0x80]
jmp 0x140019bf7
mov rbx, qword [r12 + 0x18]
xor edx, edx
cmp byte [rbx + 0x15], dil
je 0x14001a09a
mov r8d, 0x250
lea rcx, [rbp + 0xb0]
call fcn.140098980
mov rax, qword [rbx]
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call qword [rax + 0x80]
cmp dword [rbp + 0xbc], edi
jmp 0x14001a0c3
mov r8d, 0x388
lea rcx, [rbp + 0xb0]
call fcn.140098980
mov rax, qword [rbx]
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call qword [rax + 0x78]
cmp qword [rbp + 0xc8], rdi
setne al
test al, al
jne 0x14001a0d4
lea rcx, [r12 + 8]
call fcn.140033df0
xor eax, eax
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.14006c670
mov rbx, qword [rsp + 0x5a8]
add rsp, 0x550
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14007da9c
nop
call fcn.14007da9c
nop
call fcn.14007da9c
nop
call fcn.14007da9c
nop
call fcn.14007da9c
nop
call fcn.14007da9c
int3