Function at 0x140001350
Capabilities:
Create process on windows
Terminate process
Timestomp file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x140018008]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov ecx, dword [0x140015810]
mov rax, 0xffffffffffffffff
add rcx, 2
cmovb rcx, rax
call fcn.140004da0
mov ebx, dword [0x140015810]
xor edx, edx
mov rcx, rax
mov rdi, rax
lea r8, [rbx + 2]
call fcn.1400039f0
mov r8d, ebx
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, rdi
call section..text
mov edx, dword [0x140015810]
lea r8, [0x1400156f0]
lea rcx, [rax + 2]
call fcn.140004a78
mov rdx, rdi
lea rcx, [rsp + 0xb0]
call fcn.140001660
mov rcx, rdi
call fcn.140004ae0
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x50]
call fcn.1400019a0
mov ecx, 0x10
call fcn.140002740
xorps xmm0, xmm0
mov rcx, rax
mov rbx, rax
movups xmmword [rax], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ecx, 8
call fcn.140002740
mov rdi, rax
mov rcx, rbx
xor eax, eax
mov rdx, rdi
mov qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rcx, [rsp + 0x50]
call fcn.140001610
xor esi, esi
mov rcx, rax
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov edx, pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
test rax, rax
je 0x1400015af
mov r9, rdi
mov r8, rdi
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [rsi + 0x18]
call fcn.140002740
mov rbx, rax
lea ecx, [rsi + 0x68]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
call fcn.140002740
mov r8, rax
lea rcx, [rsp + 0x50]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r8], xmm0
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
movups xmmword [r8 + 0x30], xmm0
movups xmmword [r8 + 0x40], xmm0
movups xmmword [r8 + 0x50], xmm0
mov qword [r8 + 0x60], rax
call fcn.140001610
mov qword [rsp + 0x48], rbx
mov rdx, rax
mov qword [rsp + 0x40], r8
xor r9d, r9d
mov qword [rsp + 0x38], rsi
xor r8d, r8d
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000154e
lea rcx, [rsp + 0x50]
call fcn.140001620
lea rcx, [rsp + 0xb0]
call fcn.140001620
xor eax, eax
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140002720
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.140001330
mov r8, rax
lea rdx, str.Failed_to_launch_ForzaHorizon5.exe._nError_code:
lea rcx, [rsp + 0x90]
call fcn.140001a10
lea rcx, [rsp + 0x70]
call fcn.140001620
lea rcx, [rsp + 0x90]
call fcn.140001610
mov rdx, rax
lea r8, str.Error
xor ecx, ecx
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x90]
call fcn.140001330
mov r8, rax
lea rdx, str.Failed_to_get_handle_of_ForzaHorizon5.exe._nError_code:
lea rcx, [rsp + 0x70]
call fcn.140001a10
lea rcx, [rsp + 0x90]
call fcn.140001620
lea rcx, [rsp + 0x70]
call fcn.140001610
mov rdx, rax
lea r8, str.Error
xor ecx, ecx
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]