Function at 0x140019c40
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov rax, qword [0x1400cc0b8]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov r15, r8
mov rsi, rdx
mov r12, rcx
mov qword [rbp - 0x60], rcx
xor edi, edi
cmp dword [rdx + 0xa4], 5
je 0x14001a66e
mov eax, dword [rdx + 0xa0]
lea r14d, [rdi + 8]
mov r13d, 0x1000
cmp eax, 2
jne 0x14001a292
lea rbx, [rdx + 0xe0]
mov rdx, rbx
cmp qword [rbx + 0x18], r14
jb 0x140019cb8
mov rdx, qword [rbx]
lea rcx, str.Waiting_on_process__ls
call fcn.14001976c
mov rdx, rbx
lea rcx, [rbp + 0x88]
call fcn.140028020
nop
xorps xmm0, xmm0
cmp qword [rbp + 0x98], rdi
jne 0x140019e1d
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov r8d, 7
lea rdx, str.Warning
lea rcx, [rbp + 0x40]
call fcn.140009374
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
mov r8d, 0x25
lea rdx, str.Please_select_executable_to_wait_for_n
lea rcx, [rbp + 0x60]
call fcn.140009374
nop
mov rax, qword [r12]
mov rbx, qword [rax]
call fcn.1400144ec
lea r9, [rbp + 0x60]
cmp qword [rbp + 0x78], r14
cmovae r9, qword [rbp + 0x60]
lea r8, [0x1400b8c7c]
mov edx, 3
mov rcx, rax
call fcn.1400145fc
lea r8, [rbp + 0x40]
cmp qword [rbp + 0x58], r14
cmovae r8, qword [rbp + 0x40]
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], r14
cmovae rdx, qword [rbp + 0x60]
mov r9d, 0x30
mov rcx, rbx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, r14
jb 0x140019dc3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019dbe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a6a0
call fcn.14006c550
movdqa xmm0, xmmword [0x1400ba940]
movdqu xmmword [rbp + 0x70], xmm0
mov word [rbp + 0x60], di
mov rdx, qword [rbp + 0x58]
cmp rdx, r14
jb 0x140019e13
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019e0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a6a6
call fcn.14006c550
mov ebx, 0xc0000225
jmp 0x14001a16f
movdqu xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rdi
lea r12, [rsi + 0x108]
mov rax, qword [r12 + 8]
cmp qword [r12], rax
jne 0x140019f3f
lea r8, [rbp + 0x88]
lea rcx, [rbp + 0x60]
call fcn.140034450
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov rbx, rdi
mov qword [rbp - 0x70], rbx
lea rdx, [rax + 8]
lea rcx, [rsp + 0x50]
cmp byte [rdx + 0x18], dil
je 0x140019e72
call fcn.14001dba8
jmp 0x140019e7f
lea rdx, [rbp - 0x80]
call fcn.14001dba8
mov rbx, qword [rbp - 0x70]
lea rax, [rsp + 0x50]
cmp r12, rax
je 0x140019ebc
mov rcx, r12
call fcn.14001d4ec
mov rax, qword [rsp + 0x50]
mov qword [r12], rax
mov rax, qword [rsp + 0x58]
mov qword [r12 + 8], rax
mov rax, qword [rsp + 0x60]
mov qword [r12 + 0x10], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
lea rcx, [rsp + 0x50]
call fcn.14001d4ec
nop
mov rdi, qword [rbp - 0x80]
test rdi, rdi
je 0x140019f2d
cmp rdi, qword [rbp - 0x78]
je 0x140019ef9
lea r14, [rdi + 8]
lea rcx, [r14 + 0x20]
call fcn.14001df8c
mov rcx, r14
call fcn.140007668
add r14, 0x40
lea rax, [r14 - 8]
cmp rax, qword [rbp - 0x78]
jne 0x140019eda
sub rbx, rdi
and rbx, 0xffffffffffffffc0
mov rax, rdi
cmp rbx, r13
jb 0x140019f21
add rbx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a6ac
mov rdx, rbx
mov rcx, rdi
call fcn.14006c550
nop
cmp byte [rbp + 0x80], 0
je 0x140019f3f
lea rcx, [rbp + 0x68]
call fcn.14001d4ec
mov byte [rsi + 0x104], 1
lea rdi, [rsi + 0x120]
mov r13, qword [rbp + 0x48]
mov rax, qword [rdi + 8]
cmp qword [rdi], rax
je 0x140019fd9
lea rax, [rbp + 0x40]
cmp r12, rax
je 0x140019f7a
mov r8, r13
sub r8, qword [rbp + 0x40]
sar r8, 6
mov rdx, qword [rbp + 0x40]
mov rcx, r12
call fcn.14001d63c
mov eax, dword [rsi + 0x100]
cmp eax, dword [rsi + 0xb0]
jae 0x14001a182
inc eax
mov dword [rsi + 0x100], eax
mov r14, qword [rdi]
mov r15, qword [rdi + 8]
lea rbx, [r14 + 0x40]
jmp 0x140019fb4
mov rdx, rbx
mov rcx, r14
call fcn.14001d970
add r14, 0x40
add rbx, 0x40
cmp rbx, r15
jne 0x140019fa1
mov rbx, qword [rdi + 8]
lea rcx, [rbx - 0x18]
call fcn.14001df8c
lea rcx, [rbx - 0x38]
call fcn.140007668
add qword [rdi + 8], 0xffffffffffffffc0
jmp 0x14001a13c
lea r8, [rbp + 0x88]
lea rcx, [rbp - 0x58]
call fcn.140034450
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
xor ebx, ebx
mov qword [rbp + 0x70], rbx
lea rdx, [rax + 8]
lea rcx, [rsp + 0x50]
cmp byte [rdx + 0x18], bl
je 0x14001a00d
call fcn.14001dba8
jmp 0x14001a01a
lea rdx, [rbp + 0x60]
call fcn.14001dba8
mov rbx, qword [rbp + 0x70]
lea rcx, [rbp + 0x40]
call fcn.14001d4ec
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0x40], rax
mov r13, qword [rsp + 0x58]
mov qword [rbp + 0x48], r13
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x50], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
and qword [rsp + 0x60], 0
lea rcx, [rsp + 0x50]
call fcn.14001d4ec
nop
mov r14, qword [rbp + 0x60]
test r14, r14
je 0x14001a0c2
cmp r14, qword [rbp + 0x68]
je 0x14001a08a
lea r15, [r14 + 8]
lea rcx, [r15 + 0x20]
call fcn.14001df8c
mov rcx, r15
call fcn.140007668
add r15, 0x40
lea rax, [r15 - 8]
cmp rax, qword [rbp + 0x68]
jne 0x14001a06b
sub rbx, r14
and rbx, 0xffffffffffffffc0
mov rax, r14
cmp rbx, 0x1000
jb 0x14001a0b6
add rbx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a6b2
mov rdx, rbx
mov rcx, r14
call fcn.14006c550
nop
cmp byte [rbp - 0x38], 0
je 0x14001a0d1
lea rcx, [rbp - 0x50]
call fcn.14001d4ec
mov r14, qword [r12]
mov r15, qword [rsi + 0x110]
mov qword [rbp - 0x80], rdi
mov rax, qword [rdi]
mov qword [rbp - 0x78], rax
mov rbx, qword [rbp + 0x40]
jmp 0x14001a115
cmp r14, r15
je 0x14001a11a
mov eax, dword [r14]
cmp dword [rbx], eax
jae 0x14001a10b
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.14001e298
add rbx, 0x40
jmp 0x14001a115
ja 0x14001a111
add rbx, 0x40
add r14, 0x40
cmp rbx, r13
jne 0x14001a0ed
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x50], xmm0
jmp 0x14001a137
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14001e298
add rbx, 0x40
cmp rbx, r13
jne 0x14001a126
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rsi + 0x104], 0
jne 0x140019f51
lea rcx, str.Process_wait_canceled_by_user
call fcn.140019730
mov ebx, 0xc0000240
lea rcx, [rbp + 0x40]
call fcn.14001d4ec
nop
lea rcx, [rbp + 0x88]
call fcn.140007668
mov eax, ebx
jmp 0x14001a670
mov r14, qword [rdi]
mov eax, dword [r14]
mov dword [rsi + 0xc0], eax
mov r15, qword [rdi + 8]
lea rbx, [r14 + 0x40]
jmp 0x14001a1ab
mov rdx, rbx
mov rcx, r14
call fcn.14001d970
add r14, 0x40
add rbx, 0x40
cmp rbx, r15
jne 0x14001a198
mov rbx, qword [rdi + 8]
lea rcx, [rbx - 0x18]
call fcn.14001df8c
lea rcx, [rbx - 0x38]
call fcn.140007668
add qword [rdi + 8], 0xffffffffffffffc0
mov edx, dword [rsi + 0xc0]
lea rcx, str.Got_process__d
call fcn.1400197a8
nop
lea rcx, [rbp + 0x40]
call fcn.14001d4ec
nop
lea rcx, [rbp + 0x88]
call fcn.140007668
mov r13d, 0x1000
mov r12, qword [rbp - 0x60]
xor edi, edi
cmp dword [rsi + 0xa4], 2
jae 0x14001a66e
cmp dword [rsi + 0xa0], 1
je 0x14001a66e
lea r14, [r12 + 8]
cmp byte [rsi + 0xb8], dil
je 0x14001a50b
lea rcx, str.Escalating_process_handle_access
call fcn.14001976c
mov r8d, r13d
mov edx, dword [rsi + 0xc0]
mov rcx, r14
call fcn.140034060
mov ebx, eax
test eax, eax
js 0x14001a27f
call fcn.1400147cc
mov rdi, rax
mov rbx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, 0x1d7b
mov r8, rbx
mov edx, eax
mov rcx, rdi
call fcn.1400297b0
mov ebx, eax
xor edi, edi
test eax, eax
jns 0x14001a525
mov edx, ebx
lea rcx, str.Failed_to_escalate_process_handle_access__status_0x_X
call fcn.1400196b8
jmp 0x14001a540
cmp eax, 1
jne 0x14001a200
xor edx, edx
lea r8d, [rax + 0x63]
lea rcx, [rbp - 0x2c]
call fcn.14006f000
mov dword [rbp - 0x30], 0x68
lea rdi, [rsi + 0x38]
mov r8, rdi
cmp qword [rdi + 0x18], r14
jb 0x14001a2c1
mov r8, qword [rdi]
lea rbx, [rsi + 0xe0]
mov rdx, rbx
cmp qword [rbx + 0x18], r14
jb 0x14001a2d4
mov rdx, qword [rbx]
lea rcx, str.Creating_new_process__ls_with_arguments__ls
call fcn.14001976c
mov rdx, rbx
lea rcx, [rbp + 0x88]
call fcn.140028290
cmp qword [rax + 0x18], r14
jb 0x14001a2f8
mov rax, qword [rax]
cmp qword [rdi + 0x18], r14
jb 0x14001a301
mov rdi, qword [rdi]
cmp qword [rbx + 0x18], r14
jb 0x14001a30a
mov rbx, qword [rbx]
mov qword [rsp + 0x48], r15
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
lea rcx, [rbp + 0x88]
call fcn.140007668
xor edi, edi
test ebx, ebx
jne 0x14001a438
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x98], xmm1
lea r8d, [rdi + 5]
lea rdx, [0x1400b0b30]
lea rcx, [rbp + 0x88]
call fcn.140009374
nop
mov rax, qword gs:[0x30]
mov edx, dword [rax + 0x1250]
lea rcx, [rbp + 0x40]
call fcn.140028a30
nop
mov r8, rax
lea rdx, str.Failed_to_create_new_process._n
lea rcx, [rbp + 0x60]
call fcn.140017a58
nop
mov rcx, qword [r12]
lea r8, [rbp + 0x88]
mov rdx, rax
mov rcx, qword [rcx]
call fcn.140014754
nop
lea rcx, [rbp + 0x60]
call fcn.140007668
nop
lea rcx, [rbp + 0x40]
call fcn.140007668
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, r14
jb 0x14001a424
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a41f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a6b8
call fcn.14006c550
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
jmp 0x14001a670
lea r14, [r12 + 8]
cmp byte [rsi + 0xb8], dil
je 0x14001a493
lea rcx, [0x1400b0a58]
call fcn.14001976c
mov r8d, r13d
mov edx, dword [r15 + 0x10]
mov rcx, r14
call fcn.140034060
mov ebx, eax
test eax, eax
js 0x14001a4f8
call fcn.1400147cc
mov rdi, rax
mov rbx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, 0x1d7b
mov r8, rbx
mov edx, eax
mov rcx, rdi
call fcn.1400297b0
xor edi, edi
jmp 0x14001a4a5
mov r8d, 0xd7b
mov edx, dword [r15 + 0x10]
mov rcx, r14
call fcn.140034060
mov ebx, eax
test eax, eax
js 0x14001a4f8
mov rcx, r14
call fcn.140034200
cmp dword [rsi + 0xa4], 2
jb 0x14001a4ec
mov eax, dword [r15 + 0x10]
mov dword [rsi + 0xc0], eax
mov rcx, r14
call fcn.140034150
cmp dword [rsi + 0xa4], 3
jne 0x14001a4ec
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [rsi + 0xb4], dil
jmp 0x14001a200
mov edx, ebx
lea rcx, str.Failed_to_attach_to_process__status_0x_X
call fcn.1400196b8
jmp 0x14001a17b
mov r8d, 0xd7b
mov edx, dword [rsi + 0xc0]
mov rcx, r14
call fcn.140034060
mov ebx, eax
test eax, eax
js 0x14001a538
mov rcx, r14
call fcn.1400342b0
test al, al
jne 0x14001a538
mov ebx, 0xc000010a
jmp 0x14001a540
test ebx, ebx
je 0x14001a5fc
mov edx, ebx
lea rcx, [rbp + 0x40]
call fcn.140028a30
nop
mov r8, rax
lea rdx, str.Can_not_attach_to_the_process._n
lea rcx, [rbp + 0x60]
call fcn.140017a58
nop
lea rcx, [rbp + 0x40]
call fcn.140007668
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x98], xmm1
mov r8d, 5
lea rdx, [0x1400b0c50]
lea rcx, [rbp + 0x88]
call fcn.140009374
nop
mov rcx, qword [r12]
lea r8, [rbp + 0x88]
lea rdx, [rbp + 0x60]
mov rcx, qword [rcx]
call fcn.140014754
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 8
jb 0x14001a5f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, r13
jb 0x14001a5ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a69a
call fcn.14006c550
nop
lea rcx, [rbp + 0x60]
jmp 0x14001a176
mov rbx, qword [r12 + 0x18]
xor edx, edx
cmp byte [rbx + 0x15], dil
je 0x14001a636
mov r8d, 0x250
lea rcx, [rbp + 0xb0]
call fcn.14006f000
mov rax, qword [rbx]
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call qword [rax + 0x80]
cmp dword [rbp + 0xbc], edi
jmp 0x14001a65f
mov r8d, 0x388
lea rcx, [rbp + 0xb0]
call fcn.14006f000
mov rax, qword [rbx]
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call qword [rax + 0x78]
cmp qword [rbp + 0xc8], rdi
setne al
test al, al
jne 0x14001a66e
mov rcx, r14
call fcn.140034200
xor eax, eax
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.14006c530
mov rbx, qword [rsp + 0x5a8]
add rsp, 0x550
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
nop
call fcn.14007d788
int3