Function at 0x1400cd780
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov qword [rsp + 0x98], r9
mov qword [rsp + 0xa0], rdx
mov rax, rcx
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x2e8]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0xb8], rax
mov byte [rsp + 0xc7], r8b
mov qword [rsp + 0xc8], rcx
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x1e0], rcx
mov ecx, dword [rax]
mov dword [rsp + 0x1d0], ecx
mov qword [rsp + 0x1d8], rax
lea rcx, [rsp + 0xe8]
call fcn.1400f0af0
mov eax, dword [rsp + 0xe8]
mov dword [rsp + 0x74], eax
mov rcx, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0xf8]
mov r8, qword [rsp + 0x100]
mov r9d, dword [rsp + 0x108]
mov r10d, dword [rsp + 0x10c]
mov r11d, dword [rsp + 0x110]
mov esi, dword [rsp + 0x114]
mov edi, dword [rsp + 0x118]
mov ebx, dword [rsp + 0x11c]
mov ebp, dword [rsp + 0x120]
mov r14d, dword [rsp + 0x124]
mov r15w, word [rsp + 0x128]
mov r12w, word [rsp + 0x12a]
mov r13, qword [rsp + 0x130]
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x1c8], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x1b8], rax
mov eax, dword [rsp + 0x74]
mov qword [rsp + 0x1b0], r13
mov word [rsp + 0x1aa], r12w
mov word [rsp + 0x1a8], r15w
mov dword [rsp + 0x1a4], r14d
mov dword [rsp + 0x1a0], ebp
mov dword [rsp + 0x19c], ebx
mov dword [rsp + 0x198], edi
mov dword [rsp + 0x194], esi
mov dword [rsp + 0x190], r11d
mov dword [rsp + 0x18c], r10d
mov dword [rsp + 0x188], r9d
mov qword [rsp + 0x180], r8
mov qword [rsp + 0x178], rdx
mov qword [rsp + 0x170], rcx
mov dword [rsp + 0x168], eax
mov eax, dword [rsp + 0x168]
mov dword [rsp + 0x8c], eax
mov rdx, qword [rsp + 0x170]
mov r8, qword [rsp + 0x178]
mov r9, qword [rsp + 0x180]
mov r10d, dword [rsp + 0x188]
mov r11d, dword [rsp + 0x18c]
mov esi, dword [rsp + 0x190]
mov edi, dword [rsp + 0x194]
mov ebx, dword [rsp + 0x198]
mov ebp, dword [rsp + 0x19c]
mov r14d, dword [rsp + 0x1a0]
mov r15d, dword [rsp + 0x1a4]
mov r12w, word [rsp + 0x1a8]
mov r13w, word [rsp + 0x1aa]
mov rcx, qword [rsp + 0x1b0]
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x268], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x260], rax
mov eax, dword [rsp + 0x8c]
mov qword [rsp + 0x258], rcx
mov rcx, qword [rsp + 0x98]
mov word [rsp + 0x252], r13w
mov word [rsp + 0x250], r12w
mov dword [rsp + 0x24c], r15d
mov dword [rsp + 0x248], r14d
mov dword [rsp + 0x244], ebp
mov dword [rsp + 0x240], ebx
mov dword [rsp + 0x23c], edi
mov dword [rsp + 0x238], esi
mov dword [rsp + 0x234], r11d
mov dword [rsp + 0x230], r10d
mov qword [rsp + 0x228], r9
mov qword [rsp + 0x220], r8
mov qword [rsp + 0x218], rdx
mov dword [rsp + 0x210], eax
mov dword [rsp + 0x210], 0x68
mov dword [rsp + 0x24c], 0x100
mov rdx, qword [0x1402c3520]
call fcn.1400cdde0
mov qword [rsp + 0x260], rax
call fcn.1400118d0
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rax]
call fcn.1400cdde0
mov qword [rsp + 0x268], rax
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x90], rax
call fcn.1400119e0
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rax]
call fcn.1400cdde0
mov qword [rsp + 0x270], rax
lea rcx, [rsp + 0xd0]
call fcn.1400f0d80
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xd8]
mov edx, dword [rsp + 0xe0]
mov r8d, dword [rsp + 0xe4]
mov dword [rsp + 0x164], r8d
mov dword [rsp + 0x160], edx
mov qword [rsp + 0x158], rcx
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x158]
mov edx, dword [rsp + 0x160]
mov r8d, dword [rsp + 0x164]
mov dword [rsp + 0x20c], r8d
mov dword [rsp + 0x208], edx
mov qword [rsp + 0x200], rcx
mov qword [rsp + 0x1f8], rax
mov rcx, qword [rsp + 0x1e0]
mov eax, 1
cmp eax, dword [rcx]
jne 0x1400cdba4
jmp 0x1400cdbb9
mov rcx, qword [rsp + 0x1e0]
call fcn.140090ad0
mov qword [rsp + 0x1e0], rax
mov rcx, qword [rsp + 0x1e0]
call fcn.1400404c0
mov qword [rsp + 0x58], rax
mov ecx, 1
call fcn.14008ff60
mov cl, byte [rsp + 0xc7]
mov edi, eax
call fcn.1400cde90
mov rsi, rax
mov ecx, 0x384
call fcn.140081340
mov rdx, qword [rsp + 0x58]
mov r11, rax
xor eax, eax
mov r9d, eax
lea r10, [rsp + 0x210]
lea rax, [rsp + 0x1f8]
mov rcx, r9
mov r8, r9
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x28], 0x400
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], rax
call sub.KERNEL32.dll_CreateProcessW
cmp eax, 0
jne 0x1400cdc85
call fcn.140082100
mov dword [rsp + 0x1d0], 0x590
mov dword [rsp + 0x1d8], eax
mov ecx, dword [rsp + 0x1d8]
call fcn.140082520
mov dword [rsp + 0x1ec], eax
mov edx, dword [rsp + 0x1ec]
mov ecx, 0xd
call fcn.14009fcc0
test al, 1
jne 0x1400cdd85
jmp 0x1400cdd9c
mov rcx, qword [rsp + 0x200]
call fcn.1400f1120
mov rcx, qword [rsp + 0x260]
call fcn.1400f1120
mov rcx, qword [rsp + 0x268]
call fcn.1400f1120
mov rcx, qword [rsp + 0x270]
call fcn.1400f1120
mov rcx, qword [rsp + 0xc8]
mov rax, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0x1f8]
mov r8, qword [rsp + 0x200]
mov r9d, dword [rsp + 0x208]
mov r10d, dword [rsp + 0x20c]
mov dword [rcx + 0x14], r10d
mov dword [rcx + 0x10], r9d
mov qword [rcx + 8], r8
mov qword [rcx], rdx
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edx, dword [rsp + 0x1d8]
mov r8, qword [rsp + 0x1e0]
lea rcx, [0x1401b5120]
call fcn.14009d8b0
mov rcx, rax
call fcn.140001ea0
mov rdx, qword [rsp + 0x1e0]
lea rcx, [0x1401b5150]
lea r8, [0x1401b5178]
call fcn.140020730
mov rcx, rax
mov edx, dword [rsp + 0x1d8]
call fcn.1400c0970
mov rcx, rax
call fcn.140011610
mov al, byte [rsp + 0x1eb]
mov byte [rsp + 0x57], al
jmp 0x1400cddc7
mov edx, dword [rsp + 0x1ec]
mov ecx, 8
call fcn.14009fcc0
mov byte [rsp + 0x57], al
jmp 0x1400cddc7
mov edx, dword [rsp + 0x1ec]
mov ecx, 0xd
call fcn.14009fcc0
mov byte [rsp + 0x56], al
jmp 0x1400cddb1
mov edx, dword [rsp + 0x1ec]
mov ecx, 2
call fcn.14009fcc0
mov byte [rsp + 0x56], al
mov al, byte [rsp + 0x56]
mov cl, al
and cl, 1
mov byte [rsp + 0x1eb], cl
test al, 1
jne 0x1400cdd61
jmp 0x1400cdd6e
mov al, byte [rsp + 0x57]
test al, 1
jne 0x1400cdd0c
jmp 0x1400cdd2f