Function at 0x1400018c0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
sub rsp, 0x200
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x180], rax
xor r14d, r14d
movabs rax, 0x73d7acf0dd10414c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x939f290afdd8ba79
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x33c6f7f1260745fd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0xa5891f8fb463abbe
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0xaaf405326f840bd5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0x980024a289cbe7af
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x1b0c3828d4c7b0f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0xe0fa4563bbf8d718
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0x46b284dc55652aa1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
movabs rax, 0xf9e776ede80cc2da
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
movabs rax, 0xc89b594606e63fe3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs rax, 0x98655cc7a7ffd1dc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqa xmm0, xmmword [rbp + 0x80]
vxorps xmm0, xmm0, xmmword [rbp + 0x160]
vmovdqa xmmword [rbp + 0x80], xmm0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 8], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x18], xmm1
lea rax, [rbp + 0x60]
mov rbx, 0xffffffffffffffff
vzeroupper
inc rbx
cmp byte [rax + rbx], r14b
jne 0x140001a63
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x140001e79
cmp rbx, 0xf
ja 0x140001aab
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], 0xf
mov r8, rbx
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 8], r14b
jmp 0x140001b40
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x140001ae4
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000e910
test rax, rax
je 0x140001d23
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001b21
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140001b01
mov rsi, r14
jmp 0x140001b21
cmp rcx, 0x1000
jb 0x140001b19
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001e7f
jmp 0x140001ac5
call fcn.14000e910
mov rsi, rax
mov qword [rbp + 8], rsi
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], rdi
mov r8, rbx
lea rdx, [rbp + 0x60]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], r14b
mov rcx, qword [rbp + 0x18]
mov rdx, qword [rbp + 0x20]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140001bd9
lea r8, [rcx + 1]
mov qword [rbp + 0x18], r8
lea rbx, [rbp + 8]
cmp rdx, 0xf
cmova rbx, qword [rbp + 8]
lea rax, [0x140012491]
lea rsi, [0x140012490]
cmp rax, rbx
jbe 0x140001b9b
lea rax, [rbx + rcx]
cmp rsi, rax
ja 0x140001b9b
cmp rbx, rsi
ja 0x140001b93
mov rdi, r14
jmp 0x140001ba0
mov rdi, rbx
sub rdi, rsi
jmp 0x140001ba0
mov edi, 1
lea rcx, [rbx + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 1
sub r8, rdi
lea rdx, [rsi + 1]
add rdx, rdi
lea rcx, [rbx + rdi]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 8]
jmp 0x140001bf0
mov qword [rsp + 0x28], 1
mov edx, 1
lea rcx, [rbp + 8]
call fcn.14000e720
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x40]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140001c52
lea rax, [rcx + 1]
mov qword [rbp + 0x38], rax
lea rax, [rbp + 0x28]
cmp rdx, 0xf
cmova rax, qword [rbp + 0x28]
mov word [rax + rcx], 0x22
lea rax, [rbp + 0x28]
jmp 0x140001c69
mov qword [rsp + 0x20], 1
mov edx, 1
lea rcx, [rbp + 0x28]
call fcn.14000e4a0
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x150], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x140], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x150], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x140001ce0
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001cdb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001cdb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ea24
movdqa xmm0, xmmword [0x1400124c0]
movdqu xmmword [rbp + 0x38], xmm0
mov byte [rbp + 0x28], 0
mov rdx, qword [rbp + 0x20]
cmp rdx, 0xf
jbe 0x140001d2f
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d2a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ea24
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], rax
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], rax
lea rdx, [rbp + 0x140]
cmp qword [rbp + 0x158], 0xf
cmova rdx, qword [rbp + 0x140]
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140001e09
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbp + 0xb0]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140001e09
mov rcx, rax
call fcn.1400011c0
test al, al
jne 0x140001e09
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x140001e4d
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e48
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ea24
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14000e8f0
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1400011a0
int3
call fcn.140001100
int3