Function at 0x1400014a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov rax, rdx
mov r15, rdx
xor edx, edx
mov r13d, r9d
mov r12d, edx
lea r8d, [rdx + 1]
test rax, rax
je 0x1400014e9
cmp word [rax], dx
je 0x1400014e9
lea rax, [rax + 2]
add r12d, r8d
cmp word [rax], dx
jne 0x1400014dd
mov rbx, qword [rsp + 0x140]
test rbx, rbx
je 0x140001512
cmp word [rbx], dx
je 0x140001512
mov rax, rbx
mov ecx, edx
lea rax, [rax + 2]
add ecx, r8d
cmp word [rax], dx
jne 0x140001500
lea r14d, [rcx + 2]
jmp 0x140001515
mov r14d, edx
mov rdi, qword [rsp + 0x148]
mov rbp, rdx
mov dword [rsp + 0x128], edx
mov dword [rsp + 0x54], edx
test rdi, rdi
je 0x14000153a
mov dword [rsp + 0x50], r8d
cmp word [rdi], dx
jne 0x14000153e
mov dword [rsp + 0x50], edx
mov eax, 0x7d00
mov dword [rsp + 0x140], edx
cmp r12d, eax
ja 0x14000183f
cmp r13d, eax
ja 0x14000183f
cmp r14d, eax
ja 0x14000183f
lea eax, [r12 + 4]
add eax, r14d
add eax, r13d
mov dword [rsp + 0x148], eax
cmp eax, 0x3fffffff
jae 0x14000183f
lea edx, [rax + 1]
xor ecx, ecx
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x14000183f
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rsp + 0x148]
mov eax, 1
inc r8d
mov dword [rsp + 0x70], 0x68
mov rdx, r15
mov dword [rsp + 0xac], eax
mov rcx, rsi
mov word [rsp + 0xb0], ax
call fcn.140002ef0
lea rdx, str.__1_
call fcn.140002d80
mov r15, rax
test rax, rax
jne 0x140001626
lea rdx, [0x1400099cc]
mov rcx, rsi
call fcn.140002d80
mov r15, rax
test rax, rax
jne 0x140001626
mov eax, r12d
lea r15, [rsi + rax*2]
mov eax, 0x20
cmp word [r15 - 2], ax
je 0x14000163d
mov word [r15], ax
add r15, 2
jmp 0x14000163d
cmp word [r15], 0x22
mov eax, 2
lea ecx, [rax + 2]
cmove eax, ecx
mov dword [rsp + 0x128], eax
test r14d, r14d
je 0x14000171c
lea edx, [r13 + 8]
mov rcx, rbx
call fcn.140002f6c
xor edx, edx
mov rbp, rax
test rax, rax
je 0x14000171c
cmp word [rbx], 0x22
jne 0x14000167c
mov ecx, r14d
mov dword [rsp + 0x140], 1
cmp word [rbx + rcx*2 - 6], 0x22
je 0x140001683
mov dword [rsp + 0x140], edx
test r13d, r13d
je 0x140001717
lea ebx, [r13 + 4]
mov rcx, rbp
add ebx, r14d
mov r14d, 0xffffffff
mov r8d, ebx
cmp word [rax], dx
je 0x1400016b2
add rcx, 2
add r8d, r14d
je 0x1400016c0
cmp word [rcx], dx
jne 0x1400016a4
lea rdx, [0x1400099d4]
call fcn.140002ef0
xor edx, edx
mov rax, qword [rsp + 0x130]
mov r8d, ebx
mov rcx, rbp
test rax, rax
je 0x1400016f1
cmp word [rbp], dx
je 0x1400016e7
add rcx, 2
add r8d, r14d
je 0x1400016f1
cmp word [rcx], dx
jne 0x1400016d9
mov rdx, rax
call fcn.140002ef0
xor edx, edx
mov rcx, rbp
cmp word [rbp], dx
je 0x140001708
add rcx, 2
add ebx, r14d
je 0x140001717
cmp word [rcx], dx
jne 0x1400016fa
mov r8d, ebx
lea rdx, [0x1400099dc]
call fcn.140002ef0
mov rax, rbp
jmp 0x140001724
mov rax, qword [rsp + 0x130]
mov ecx, dword [rsp + 0x140]
mov r9, r15
mov r14d, dword [rsp + 0x148]
mov edx, r12d
mov dword [rsp + 0x30], ecx
mov r8d, r14d
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov eax, dword [rsp + 0x128]
mov dword [rsp + 0x20], eax
call fcn.140002fe0
xor r15d, r15d
test eax, eax
je 0x140001828
lea r12d, [r15 + 1]
mov rax, rsi
mov ecx, r15d
cmp word [rsi], r15w
je 0x140001780
lea rax, [rax + 2]
add ecx, r12d
cmp word [rax], r15w
jne 0x140001773
mov eax, ecx
mov edx, 0x20
lea rcx, [rsi + rax*2]
cmp rcx, rsi
jbe 0x1400017a5
lea rax, [rcx - 2]
mov rcx, rax
cmp word [rax], dx
jne 0x1400017a5
mov word [rax], r15w
cmp rax, rsi
ja 0x140001790
mov r13d, 0xffffffff
cmp dword [rsp + 0x50], r15d
jne 0x14000192d
mov ecx, r13d
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov rax, qword [rsp + 0x120]
test rax, rax
je 0x140001828
lea rcx, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rcx
xor r8d, r8d
lea rcx, [rsp + 0x70]
mov rdx, rsi
mov qword [rsp + 0x40], rcx
mov rcx, rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140001828
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x54], r12d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test rbp, rbp
je 0x14000183f
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [rsp + 0x54]
mov rbx, qword [rsp + 0x138]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx eax, word [rdi]
test ax, ax
je 0x1400017b6
mov rbx, rdi
jmp 0x14000187b
add rbx, 2
test ax, ax
je 0x140001882
movzx eax, word [rbx]
cmp ax, dx
jne 0x14000186f
jmp 0x140001885
mov rbx, r15
sub rbx, rdi
sar rbx, 1
test rbx, rbx
jle 0x1400017b6
cmp rbx, r13
jg 0x14000193b
mov rdx, rdi
mov rcx, rsi
call fcn.140002d80
mov rcx, rsi
mov edx, r15d
cmp word [rsi], r15w
je 0x1400018c1
lea rcx, [rcx + 2]
add edx, r12d
cmp word [rcx], r15w
jne 0x1400018b4
mov dword [rsp + 0x30], r15d
mov r9, rax
mov qword [rsp + 0x28], r15
mov r8d, r14d
mov rcx, rsi
mov dword [rsp + 0x20], ebx
call fcn.140002fe0
test eax, eax
je 0x140001828
lea rcx, [rbx + 1]
cmp rcx, rbx
jl 0x14000193b
mov eax, 2
mul rcx
test rdx, rdx
jne 0x14000193b
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x14000193b
test rax, rax
jns 0x14000191c
neg rax
cmp rax, rdi
ja 0x14000193b
sub rdi, rax
jmp 0x140001928
lea rcx, [rax + rdi]
cmp rcx, rdi
jb 0x14000193b
mov rdi, rcx
mov edx, 0x20
test rdi, rdi
jne 0x14000185e
jmp 0x1400017b6
call fcn.1400031b0
int3