Function at 0x140001d30
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x14006b040]
xor rax, rsp
mov qword [rbp], rax
cmp byte [0x14006b2d0], 0
je 0x140002219
xorps xmm2, xmm2
movss xmm0, dword [0x14006b0c0]
movss xmm1, dword [0x14006b0c4]
mov rcx, qword [0x14006bf30]
mov eax, dword [rcx + 0x1dc0]
or eax, 1
mov dword [rcx + 0x1dc0], eax
unpcklps xmm0, xmm1
movsd qword [rcx + 0x1dd4], xmm0
xorps xmm1, xmm1
unpcklps xmm1, xmm2
movsd qword [rcx + 0x1ddc], xmm1
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
movss xmm0, dword [0x14006b2c8]
movss xmm1, dword [0x14006b2cc]
movss dword [rcx + 0x1de4], xmm0
movss dword [rcx + 0x1de8], xmm1
mov dword [rcx + 0x1dc8], 1
or eax, 0x42
mov dword [rcx + 0x1dc0], eax
mov dword [rcx + 0x1e20], 0x3f800000
mov r8d, 0x60
lea rdx, [0x14006b2d0]
lea rcx, str.Silence_menu
call fcn.140010e10
call fcn.14004bc90
test al, al
je 0x140002214
lea rcx, str.Login
call fcn.14004dbb0
test al, al
je 0x1400020f5
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140061290]
movdqu xmmword [rbp - 0x10], xmm1
mov byte [rbp - 0x20], 0
lea rcx, [rbp - 0x20]
call fcn.1400017b0
lea r15, str.license111111
test al, al
je 0x140001e9d
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova r8, qword [rbp - 0x20]
mov edx, 0x100
mov r9d, edx
lea rcx, [0x14006be10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov r9d, 0xff
lea r8, [0x14006be10]
mov edx, r9d
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
lea rcx, str.Enter_your_license_key:
call fcn.140043cc0
mov qword [rsp + 0x40], 0
xor esi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x100
lea r8, [0x14006be10]
xor edx, edx
lea rcx, str.License_Key
call fcn.140048dc0
mov qword [rsp + 0x40], rsi
lea rdx, [rsp + 0x40]
lea rcx, str.Login
call fcn.1400445e0
lea r14, str.Idle...
test al, al
je 0x140002092
mov r9d, 0xff
lea r8, [0x14006be10]
mov edx, r9d
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r15 + rbx], sil
jne 0x140001f41
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x140002242
cmp rbx, 0xf
ja 0x140001f8b
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 0xf
mov r8, rbx
mov rdx, r15
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x48], sil
jmp 0x14000201d
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x140001fc4
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140050520
test rax, rax
je 0x14000205c
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001ffc
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
test rcx, rcx
je 0x140001ffc
cmp rcx, 0x1000
jb 0x140001ff4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002248
jmp 0x140001fa5
call fcn.140050520
mov rsi, rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rdi
mov r8, rbx
mov rdx, r15
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
lea rcx, [rsp + 0x48]
call fcn.1400012b0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140002068
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002063
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002063
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400507a4
mov r8d, 0xd
lea rdx, str.Logging_in...
mov rcx, r14
call fcn.140003440
mov r8d, 0xe
lea rdx, str.Login_complete
mov rcx, r14
call fcn.140003440
cmp qword [0x14006b108], 0xf
cmova r14, qword [str.Idle...]
mov rdx, r14
lea rcx, str.Status:__s
call fcn.140043cc0
call fcn.14004dcd0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400020f5
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400020f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400020f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400507a4
lea rcx, str.Inject
call fcn.14004dbb0
test al, al
je 0x14000220f
mov qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
lea rcx, str.Inject
call fcn.1400445e0
lea rdi, [0x14006b0d0]
test al, al
je 0x1400021eb
mov r8d, 0x18
lea rdx, str.Injection_in_progress...
mov rcx, rdi
call fcn.140003440
mov dword [rsp + 0x70], 0x70
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
mov qword [rbp - 0x2c], rax
mov dword [rbp - 0x24], eax
lea rax, str.runas
mov qword [rbp - 0x80], rax
lea rax, str.silence.exe
mov qword [rbp - 0x78], rax
mov dword [rbp - 0x60], 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x1400021d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Failed_to_start_process._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400035a0
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140003780]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8d, 0x12
lea rdx, str.Injection_complete
mov rcx, rdi
call fcn.140003440
cmp qword [0x14006b0e8], 0xf
cmova rdi, qword [0x14006b0d0]
mov rdx, rdi
lea rcx, str.Status:__s
call fcn.140043cc0
call fcn.14004dcd0
call fcn.14004c120
call fcn.1400140c0
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140050500
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400011d0
nop
call fcn.140001130
int3