Function at 0x14001a0e0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push rbx
push rbp
sub rsp, 0x908
mov rax, qword [0x1400a2078]
xor rax, rsp
mov qword [rsp + 0x8e0], rax
lea rdx, [rsp + 0xe1]
call fcn.140019df0
mov rbx, rax
test rax, rax
jne 0x14001a119
lea eax, [rbx + 1]
jmp 0x14001a437
xorps xmm0, xmm0
mov qword [rsp + 0x928], rsi
xor eax, eax
mov qword [rsp + 0x938], r12
mov qword [rsp + 0xd0], rax
xor esi, esi
mov eax, 5
mov qword [rsp + 0x900], r13
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x70], WSAGetLastError
xor edx, edx
movups xmmword [rsp + 0xb0], xmm0
mov word [rsp + 0xb0], ax
lea ebp, [rsi + 1]
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x8f8], r14
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0x8f0], r15
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0x50], 0
movups xmmword [rsp + 0xc0], xmm0
movsx eax, byte [rbx]
test eax, eax
je 0x14001a1c3
mov rcx, rbx
nop word [rax + rax]
cmp eax, 0x20
lea rcx, [rcx + 1]
movsx eax, byte [rcx]
cmovle esi, ebp
inc edx
test eax, eax
jne 0x14001a1b0
movsxd r15, edx
test esi, esi
je 0x14001a1db
mov word [r15 + rbx], 0x22
add r15, 2
dec rbx
mov byte [rbx], 0x22
movzx eax, byte [rbx]
mov rcx, rbx
mov r14, rbx
test al, al
je 0x14001a20b
movabs rdx, 0x200000000801
inc rcx
sub al, 0x2f
cmp al, 0x2d
ja 0x14001a204
bt rdx, rax
jae 0x14001a204
mov r14, rcx
movzx eax, byte [rcx]
test al, al
jne 0x14001a1f2
sub r14, rbx
movsxd r9, esi
mov qword [rsp + 0x930], rdi
lea r13, [r9 + r14]
lea r12, [r13*2 + 0x1b]
add r12, r15
cmp r12, 0x800
jbe 0x14001a281
mov rcx, r12
mov rdi, rbx
call fcn.14005608c
mov qword [rsp + 0x50], rax
mov rbx, rax
test rax, rax
jne 0x14001a25d
mov edx, r12d
lea rcx, str.malloc__ld__failed
call fcn.140019410
jmp 0x14001a405
mov rcx, rax
sub rcx, rdi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi]
mov byte [rcx + rdi], al
lea rdi, [rdi + 1]
test al, al
jne 0x14001a270
movsxd r9, esi
lea r12, [rbx + 1]
movsxd rdx, r15d
add r12, r15
lea rax, [r13 + 0xd]
lea rax, [rbx + rax*2]
test r15d, r15d
js 0x14001a2c0
mov r8, rbx
lea rcx, [rdx + rax]
sub r8, rax
inc rdx
nop word [rax + rax]
movzx eax, byte [rcx + r8]
mov byte [rcx], al
lea rcx, [rcx - 1]
sub rdx, rbp
jne 0x14001a2b0
movsd xmm0, qword [str.alic_run.exe]
lea rdi, [r14 + rbx]
movsd qword [rdi], xmm0
lea rcx, [r9 + rbx]
mov eax, dword [0x140092658]
lea rdx, [0x140092660]
mov dword [rdi + 8], eax
movzx eax, byte [0x14009265c]
mov byte [rdi + 0xc], al
call fcn.14004c9b0
test rax, rax
je 0x14001a326
mov rcx, rax
call fcn.14004d150
lea r8, [r13 + 0xb]
mov rdx, rbx
mov rcx, r12
call fcn.140044760
mov word [r12 + r13 + 0xb], 0x2022
test esi, esi
je 0x14001a340
mov byte [r15 + rbx - 1], 0
inc rbx
jmp 0x14001a340
mov rdx, r12
mov rbx, rdi
sub rdx, rdi
mov rcx, rdi
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14001a332
mov rdx, rbp
mov ecx, 2
call fcn.140055eb0
mov rdx, rbx
lea rcx, str.Invoking___s_
mov rdi, rax
call fcn.140019410
mov rcx, rax
call fcn.14004cf30
xor esi, esi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rdx, r12
mov qword [rsp + 0x38], rsi
mov rcx, rbx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14001a3bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
lea rcx, str.CreateProcess___s___failure__nError_code__ld
mov r8d, eax
call fcn.140019410
jmp 0x14001a3d7
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, esi
mov rdx, rdi
mov ecx, 2
call fcn.140055eb0
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x14001a3f6
mov rcx, rax
call fcn.1400543f0
test ebp, ebp
jne 0x14001a405
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdi, qword [rsp + 0x930]
mov eax, ebp
mov r13, qword [rsp + 0x900]
mov r12, qword [rsp + 0x938]
mov r14, qword [rsp + 0x8f8]
mov rsi, qword [rsp + 0x928]
mov r15, qword [rsp + 0x8f0]
mov rcx, qword [rsp + 0x8e0]
xor rcx, rsp
call fcn.140042470
add rsp, 0x908
pop rbp
pop rbx
ret