Function at 0x1400f95fb
Capabilities:
Create process on windows

Disassembly:
push rax
pushf
mov eax, 0x2c9e9e49
pushf
not eax
add eax, 0x966ace0e
xor eax, 0xde2ba5dd
rol eax, 0xe8
popf
pushf
not eax
add eax, 0xc7d85b1d
xor eax, 0xe04e4165
rol eax, 0xb3
popf
cmp eax, 4
jne 0x1400f9638
popf
pop rax
jmp 0x1400f9a7f
cmp eax, 0
jne 0x1400f9647
popf
pop rax
jmp 0x1400f9782
cmp eax, 3
jne 0x1400f9656
popf
pop rax
jmp 0x1400f99d4
cmp eax, 1
jne 0x1400f9665
popf
pop rax
jmp 0x1400f9889
cmp eax, 0xd
jne 0x1400f9674
popf
pop rax
jmp 0x1400fa053
cmp eax, 7
jne 0x1400f9683
popf
pop rax
jmp 0x1400f9ce1
cmp eax, 0xe
jne 0x1400f9692
popf
pop rax
jmp 0x1400fa0cd
cmp eax, 0xb
jne 0x1400f96a1
popf
pop rax
jmp 0x1400f9f8d
cmp eax, 0xc
jne 0x1400f96b0
popf
pop rax
jmp 0x1400fa008
cmp eax, 8
jne 0x1400f96bf
popf
pop rax
jmp 0x1400f9d7c
cmp eax, 0x10
jne 0x1400f96ce
popf
pop rax
jmp 0x1400fa239
cmp eax, 2
jne 0x1400f96dd
popf
pop rax
jmp 0x1400f9975
cmp eax, 9
jne 0x1400f96ec
popf
pop rax
jmp 0x1400f9e53
cmp eax, 0x12
jne 0x1400f96fb
popf
pop rax
jmp 0x1400fa351
cmp eax, 6
jne 0x1400f970a
popf
pop rax
jmp 0x1400f9bc2
cmp eax, 0x11
jne 0x1400f9719
popf
pop rax
jmp 0x1400fa2c2
cmp eax, 5
jne 0x1400f9728
popf
pop rax
jmp 0x1400f9b16
cmp eax, 0x16
jne 0x1400f9737
popf
pop rax
jmp 0x1400fa463
cmp eax, 0xa
jne 0x1400f9746
popf
pop rax
jmp 0x1400f9eda
cmp eax, 0x14
jne 0x1400f9755
popf
pop rax
jmp 0x1400fa3da
cmp eax, 0xf
jne 0x1400f9764
popf
pop rax
jmp 0x1400fa1a7
cmp eax, 0x13
jne 0x1400f9773
popf
pop rax
jmp 0x1400fa38b
cmp eax, 0x15
jne 0x1400f9782
popf
pop rax
jmp 0x1400fa435
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x120
mov rax, qword [0x140085080]
xor rax, rsp
mov qword [rsp + 0x110], rax
xor r15d, r15d
lea rcx, [rsp + 0x78]
call fcn.14009f86b
nop
lea rbx, [rsp + 0x78]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x90]
cmp rsi, 0xf
cmova rbx, rdi
mov rax, qword [rsp + 0x88]
cmp rax, 6
jb 0x1400f9844
push rax
pushf
mov eax, 0xff4bbdcb
pushf
not eax
add eax, 0xbff105a9
xor eax, 0x82987d82
rol eax, 0x1c
popf
pushf
not eax
add eax, 0x805cc91d
xor eax, 0xd082c9b8
rol eax, 0x4b
popf
pushf
not eax
add eax, 0xad8936f0
xor eax, 0xea62feb1
rol eax, 0xa
popf
pushf
not eax
add eax, 0x9c50096a
xor eax, 0x93451ca2
rol eax, 0xc5
popf
jmp 0x1400f9629
push rax
pushf
mov eax, 0xf96b0f73
pushf
not eax
add eax, 0xd9ab7b33
xor eax, 0xf35e9f4d
rol eax, 1
popf
pushf
not eax
add eax, 0xeb28d01b
xor eax, 0x8323c7f9
rol eax, 0x45
popf
pushf
not eax
add eax, 0xba3c711d
xor eax, 0xc1243734
rol eax, 0x6e
popf
jmp 0x1400f9629
lea r14, [rax + rbx]
lea r8, [r14 - 5]
sub r8, rbx
mov edx, 0xcb2de5b2
pushf
not edx
add edx, 0xa85ccf29
xor edx, 0xb4f133b5
rol edx, 0xe
popf
pushf
not edx
add edx, 0xd0507917
xor edx, 0xecc1a6df
rol edx, 0xd3
popf
pushf
not edx
add edx, 0xb4680ba0
xor edx, 0xf266c0ae
rol edx, 0xb7
popf
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400f992f
push rax
pushf
mov eax, 0x22eafa65
pushf
not eax
add eax, 0xbeb614a2
xor eax, 0x95d6155c
rol eax, 0xeb
popf
pushf
not eax
add eax, 0xece12e79
xor eax, 0xab9f1f2d
rol eax, 0xcb
popf
pushf
not eax
add eax, 0xab0910ef
xor eax, 0xe177e36f
rol eax, 0x8e
popf
jmp 0x1400f9629
push rax
pushf
mov eax, 0x81b69de3
pushf
not eax
add eax, 0xdd4f7d45
xor eax, 0xa430ddba
rol eax, 0x82
popf
pushf
not eax
add eax, 0xafd329a8
xor eax, 0xfb0d7d80
rol eax, 0xab
popf
pushf
not eax
add eax, 0xda83d0e6
xor eax, 0xe7780e94
rol eax, 0x4f
popf
jmp 0x1400f9629
nop word [rax + rax]
push rax
pushf
mov eax, 0xfc335c05
pushf
not eax
add eax, 0xcfe33dd3
xor eax, 0xa9f3e3d0
rol eax, 0x76
popf
pushf
not eax
add eax, 0xbcc71069
xor eax, 0xd7c92973
rol eax, 0xe5
popf
pushf
not eax
add eax, 0x9b8fe86c
xor eax, 0xf2d18d35
rol eax, 0x55
popf
pushf
not eax
add eax, 0xdf9b8fbe
xor eax, 0xa4455930
rol eax, 0x91
popf
jmp 0x1400f9629
cmp dword [rax], 0x68747950
jne 0x1400f9a26
push rax
pushf
mov eax, 0x5a698fc
pushf
not eax
add eax, 0xca1e5197
xor eax, 0x94470a2f
rol eax, 0xd3
popf
pushf
not eax
add eax, 0xb4c68792
xor eax, 0xb3e390e0
rol eax, 0xb1
popf
pushf
not eax
add eax, 0xdf54ad1a
xor eax, 0x917b531a
rol eax, 0x85
popf
jmp 0x1400f9629
push rax
pushf
mov eax, 0x78cdd3f
pushf
not eax
add eax, 0xae5daccf
xor eax, 0xebc665ad
rol eax, 0xcd
popf
pushf
not eax
add eax, 0x9e4ecb65
xor eax, 0x8a6e3ac1
rol eax, 0x8b
popf
pushf
not eax
add eax, 0xecf51f88
xor eax, 0xc4663ae9
rol eax, 0xfb
popf
pushf
not eax
add eax, 0xf4e044c7
xor eax, 0xccc464ca
rol eax, 0x98
popf
jmp 0x1400f9629
cmp word [rax + 4], 0x6e6f
jne 0x1400f9ae4
push rax
pushf
mov eax, 0xbff17ad8
pushf
not eax
add eax, 0xebcbd044
xor eax, 0xfe71c955
rol eax, 0x14
popf
pushf
not eax
add eax, 0xf64bd5af
xor eax, 0xc41720ce
rol eax, 0xd2
popf
pushf
not eax
add eax, 0xab440b10
xor eax, 0xb1912237
rol eax, 0xf9
popf
pushf
not eax
add eax, 0xb349d282
xor eax, 0xf262485a
rol eax, 0x68
popf
jmp 0x1400f9629
push rax
pushf
mov eax, 0xc04c8c60
pushf
not eax
add eax, 0x8db16f0d
xor eax, 0xdf416785
rol eax, 0xad
popf
pushf
not eax
add eax, 0x85541780
xor eax, 0xd4aef53c
rol eax, 1
popf
jmp 0x1400f9629
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x1400f9b7c
push rax
pushf
mov eax, 0xa2ed7044
pushf
not eax
add eax, 0xe3601b3c
xor eax, 0xbf94c57e
rol eax, 0xaa
popf
pushf
not eax
add eax, 0x8e6bb90b
xor eax, 0x82b2c243
rol eax, 0xe9
popf
pushf
not eax
add eax, 0xd8fa4fcf
xor eax, 0x8d2c348a
rol eax, 0x4e
popf
pushf
not eax
add eax, 0xa759b200
xor eax, 0xc4bfac10
rol eax, 0x5d
popf
jmp 0x1400f9629
push rax
pushf
mov eax, 0xf6b639b7
pushf
not eax
add eax, 0xe3b0867b
xor eax, 0x8faa7837
rol eax, 0xc8
popf
pushf
not eax
add eax, 0xff9da9ee
xor eax, 0xa1e1f4fd
rol eax, 0x6f
popf
pushf
not eax
add eax, 0x89b54d1d
xor eax, 0xe8f9c5a0
rol eax, 0x1d
popf
jmp 0x1400f9629
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x100], rax
mov dword [rsp + 0xa0], WSAGetLastError
mov dword [rsp + 0xdc], 1
mov word [rsp + 0xe0], r15w
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1a99a63d7]
pushf
sub rdx, 0x6992df57
popf
xor ecx, ecx
jmp 0x1400f9c71
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400f9cae
push rax
pushf
mov eax, 0xdb4048a9
pushf
not eax
add eax, 0xb52f63b1
xor eax, 0xdb20764c
rol eax, 0xe2
popf
pushf
not eax
add eax, 0x93a41228
xor eax, 0x88665ce7
rol eax, 0xfe
popf
jmp 0x1400f9629
push rax
pushf
mov eax, 0xc0bfca67
pushf
not eax
add eax, 0x928b84e8
xor eax, 0xf369fa0a
rol eax, 0xf9
popf
pushf
not eax
add eax, 0xa46d773c
xor eax, 0x9028323a
rol eax, 0xdc
popf
jmp 0x1400f9629
lea rdx, [0x184df4b3f]
pushf
sub rdx, 0x44d7c69f
popf
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400b7433
mov rbx, rax
jmp 0x1400f9d03
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
jmp 0x1400f9d0f
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1bb6842f5]
pushf
sub rdx, 0x7b678185
popf
mov rcx, rax
jmp 0x1400f9d2b
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400f9e53
mov edx, 0x8b417cc6
pushf
not edx
add edx, 0xc485fda1
xor edx, 0xadea10f8
rol edx, 0xec
popf
pushf
not edx
add edx, 0xb868f790
xor edx, 0xba8151e0
rol edx, 0x7b
popf
pushf
not edx
add edx, 0x8b476462
xor edx, 0xae853ef6
rol edx, 0xf9
popf
pushf
not edx
add edx, 0x855300dd
xor edx, 0xa08f3956
rol edx, 0x64
popf
mov rcx, qword [rsp + 0x60]
jmp 0x1400f9ddb
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x60]
jmp 0x1400f9de7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
jmp 0x1400f9df3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
push rax
pushf
mov eax, 0x3ebb8422
pushf
not eax
add eax, 0xc525771d
xor eax, 0xf6cddb2c
rol eax, 0x21
popf
pushf
not eax
add eax, 0xe5488e31
xor eax, 0x859a7beb
rol eax, 0xc1
popf
pushf
not eax
add eax, 0xfd860824
xor eax, 0xa5c91d44
rol eax, 0xa3
popf
pushf
not eax
add eax, 0xe0ea2099
xor eax, 0xc4256097
rol eax, 0xa3
popf
jmp 0x1400f9629
mov rdx, qword [rsp + 0x90]
cmp rdx, 0xf
jbe 0x1400f9ea7
push rax
pushf
mov eax, 0xc962b76c
pushf
not eax
add eax, 0xa101b064
xor eax, 0xe7d18944
rol eax, 0x93
popf
pushf
not eax
add eax, 0xeab147bb
xor eax, 0xf264be9a
rol eax, 0x77
popf
pushf
not eax
add eax, 0xc7d6486f
xor eax, 0xb4fe8eb0
rol eax, 0x23
popf
jmp 0x1400f9629
push rax
pushf
mov eax, 0x5bf41b88
pushf
not eax
add eax, 0x8bf0a471
xor eax, 0xa97a7737
rol eax, 0x14
popf
pushf
not eax
add eax, 0xc82f934e
xor eax, 0xca346ade
rol eax, 0x72
popf
jmp 0x1400f9629
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f9f47
push rax
pushf
mov eax, 0x40fdfd0
pushf
not eax
add eax, 0x8052973a
xor eax, 0x8c11bc00
rol eax, 0x28
popf
pushf
not eax
add eax, 0xbb02759f
xor eax, 0xedd60f9b
rol eax, 0x1f
popf
pushf
not eax
add eax, 0xf69a7ddb
xor eax, 0xfb381e2b
rol eax, 0x28
popf
pushf
not eax
add eax, 0xaf2287ce
xor eax, 0xfd3c8a03
rol eax, 0x97
popf
jmp 0x1400f9629
push rax
pushf
mov eax, 0x2f5879bf
pushf
not eax
add eax, 0xda717e9c
xor eax, 0x827fc3e8
rol eax, 0x1d
popf
pushf
not eax
add eax, 0xd93067d7
xor eax, 0x8e177fdd
rol eax, 0x5c
popf
pushf
not eax
add eax, 0xb71639a9
xor eax, 0xd974ea56
rol eax, 0x9c
popf
jmp 0x1400f9629
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f9fd5
push rax
pushf
mov eax, 0x752d3e8d
pushf
not eax
add eax, 0xbd481a74
xor eax, 0xf19b24bc
rol eax, 0x58
popf
pushf
not eax
add eax, 0xeec90611
xor eax, 0x940c8411
rol eax, 0x32
popf
jmp 0x1400f9629
push rax
pushf
mov eax, 0x324c2548
pushf
not eax
add eax, 0xa498ec18
xor eax, 0x8ba6a09f
rol eax, 0x59
popf
pushf
not eax
add eax, 0x87297428
xor eax, 0xe535965b
rol eax, 0x39
popf
jmp 0x1400f9629
call fcn.1400bfce0
push rax
pushf
mov eax, 0xe608434d
pushf
not eax
add eax, 0x8134851e
xor eax, 0xd066c1fd
rol eax, 0x70
popf
pushf
not eax
add eax, 0xcd84c305
xor eax, 0x9b0d1296
rol eax, 0x97
popf
pushf
not eax
add eax, 0x8c7a0867
xor eax, 0xf6085b34
rol eax, 0x31
popf
jmp 0x1400f9629
mov al, 8
pushf
not al
add al, 0x1c
xor al, 0x13
rol al, 0x45
popf
pushf
not al
add al, 0xfa
xor al, 0xf1
rol al, 0xed
popf
jmp 0x1400fa435
inc rax
lea r8, [r14 - 5]
sub r8, rax
mov edx, 0x4a1a880e
pushf
not edx
add edx, 0x8ce98520
xor edx, 0xa32c0c94
rol edx, 0xf7
popf
pushf
not edx
add edx, 0xd8b573fd
xor edx, 0xf94d986b
rol edx, 0x15
popf
pushf
not edx
add edx, 0x9c4af855
xor edx, 0x86641b4a
rol edx, 0xe2
popf
pushf
not edx
add edx, 0x88e15e07
xor edx, 0xa83e6c18
rol edx, 0x94
popf
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x1400fa174
push rax
pushf
mov eax, 0xd538692d
pushf
not eax
add eax, 0x966dfb16
xor eax, 0xb6b6d1a7
rol eax, 0x54
popf
pushf
not eax
add eax, 0xd248a584
xor eax, 0xcd512caf
rol eax, 0x9b
popf
jmp 0x1400f9629
push rax
pushf
mov eax, 0x1328baa5
pushf
not eax
add eax, 0x9485e419
xor eax, 0x9ef0a656
rol eax, 0x94
popf
pushf
not eax
add eax, 0xee5c05b0
xor eax, 0xfc0acad7
rol eax, 0xd2
popf
jmp 0x1400f9629
cmp rsi, 0xf
jbe 0x1400fa1e0
push rax
pushf
mov eax, 0x8b7a0115
pushf
not eax
add eax, 0xb858ccc5
xor eax, 0xed7c8ff1
rol eax, 0x8f
popf
pushf
not eax
add eax, 0xebd389fe
xor eax, 0xc9a4692c
rol eax, 0xd6
popf
jmp 0x1400f9629
push rax
pushf
mov eax, 0x6982fbea
pushf
not eax
add eax, 0xaaef43a9
xor eax, 0xbe05a55a
rol eax, 0x69
popf
pushf
not eax
add eax, 0xd8172a10
xor eax, 0xed1fe3e4
rol eax, 0x41
popf
pushf
not eax
add eax, 0xa2e6b894
xor eax, 0xe0ca9af7
rol eax, 0x46
popf
pushf
not eax
add eax, 0xef92fca7
xor eax, 0xcec86eda
rol eax, 0xd9
popf
jmp 0x1400f9629
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400fa28f
push rax
pushf
mov eax, 0xcf9c697d
pushf
not eax
add eax, 0xa8fd60f4
xor eax, 0x8c3b00e5
rol eax, 0x62
popf
pushf
not eax
add eax, 0xb22a33f8
xor eax, 0xefd5cd4a
rol eax, 0x1d
popf
pushf
not eax
add eax, 0xec951c0c
xor eax, 0xd62728cd
rol eax, 0xbf
popf
jmp 0x1400f9629
push rax
pushf
mov eax, 0x25439029
pushf
not eax
add eax, 0xe0af8161
xor eax, 0x874b10ae
rol eax, 0xe7
popf
pushf
not eax
add eax, 0xb373c6eb
xor eax, 0x9302fa4d
rol eax, 0xa4
popf
jmp 0x1400f9629
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400fa30a
push rax
pushf
mov eax, 0x9cd3dda9
pushf
not eax
add eax, 0xd16abf3d
xor eax, 0xa6813bc0
rol eax, 0x3f
popf
pushf
not eax
add eax, 0xbe62cb86
xor eax, 0xf556de78
rol eax, 0x1f
popf
jmp 0x1400f9629
push rax
pushf
mov eax, 0x61eb797c
pushf
not eax
add eax, 0xe973f8e7
xor eax, 0x82b9e6a5
rol eax, 0x35
popf
pushf
not eax
add eax, 0xc068ad50
xor eax, 0xa564ea59
rol eax, 0x81
popf
pushf
not eax
add eax, 0xdf12d306
xor eax, 0xdb38f87b
rol eax, 6
popf
jmp 0x1400f9629
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400bfce0
nop
push rax
pushf
mov eax, 0x541b8302
pushf
not eax
add eax, 0x9c225d70
xor eax, 0xe5b85d76
rol eax, 0xe7
popf
pushf
not eax
add eax, 0x89f9ebd8
xor eax, 0xe2582754
rol eax, 0xf5
popf
pushf
not eax
add eax, 0xbb308931
xor eax, 0x9087cb61
rol eax, 0x55
popf
jmp 0x1400f9629
xor al, al
push rax
pushf
mov eax, 0xfc5505a4
pushf
not eax
add eax, 0xba934ff3
xor eax, 0x89087938
rol eax, 0xd
popf
pushf
not eax
add eax, 0xa17766b6
xor eax, 0xa6335c17
rol eax, 0xfd
popf
pushf
not eax
add eax, 0xd1bb433a
xor eax, 0xeadbad97
rol eax, 0xd9
popf
pushf
not eax
add eax, 0x836f7d3a
xor eax, 0x911dec69
rol eax, 0x23
popf
jmp 0x1400f9629
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1400dadee
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
int3