Function at 0x14004d920
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rax - 0x548]
sub rsp, 0x630
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x1402b3030]
xor rax, rsp
mov qword [rbp + 0x510], rax
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0x3a0], xmm0
movdqa xmm1, xmmword [0x140291260]
movdqu xmmword [rbp + 0x3b0], xmm1
mov byte [rbp + 0x3a0], r14b
lea rax, [rbp + 0x158]
mov qword [rbp - 0x20], rax
lea rdx, [rbp + 0x158]
call fcn.14004cec0
mov rbx, rax
mov dword [rbp - 0x38], 0xe83e5290
mov dword [rbp - 0x34], 0x9b425b3e
mov dword [rbp - 0x30], 0x2f1d204c
mov dword [rbp - 0x2c], 0xd2b9d5e2
mov dword [rbp - 0x28], 0xe737e1ec
mov word [rbp - 0x24], 0x1dae
mov qword [rsp + 0x58], r14
mov rax, qword [rsp + 0x58]
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x58]
movzx edx, byte [rbp + rcx - 0x38]
sub dl, byte [rbp + rax - 0x2d]
mov byte [rsp + 0x50], dl
movzx ecx, byte [rsp + 0x50]
mov rax, qword [rsp + 0x58]
mov byte [rbp + rax + 0x3e8], cl
mov rax, qword [rsp + 0x58]
inc rax
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
cmp rax, 0xb
jb 0x14004d9d0
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe0], xmm1
mov r8d, 0xa
lea rdx, [rbp + 0x3e8]
lea rcx, [rbp + 0xd0]
call fcn.14006a3d0
nop
lea rdx, [rbp + 0x190]
call fcn.14004cdc0
nop
lea r9, [rbp + 0xd0]
mov r8, rax
lea rcx, [rbp + 0x138]
call fcn.1400656a0
nop
lea r9, [rbp + 0x3a0]
mov r8, rbx
lea rdx, [rbp + 0x138]
call fcn.14007af90
movzx ebx, al
lea rcx, [rbp + 0x190]
call fcn.14005ec80
nop
lea rcx, [rbp + 0xd0]
call fcn.14005ec80
test bl, bl
je 0x14004e380
mov qword [rbp + 0x208], r14
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x350]
call fcn.140062150
nop
mov dword [rbp - 0x48], 0xa2fa52ea
mov dword [rbp - 0x44], 0xcd928a67
mov dword [rbp - 0x40], 0x2f88ed74
mov dword [rbp - 0x3c], 0xcd241bfe
mov qword [rsp + 0x58], r14
mov rax, qword [rsp + 0x58]
nop word [rax + rax]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x58]
movzx edx, byte [rbp + rcx - 0x48]
sub dl, byte [rbp + rax - 0x40]
mov byte [rsp + 0x50], dl
movzx ecx, byte [rsp + 0x50]
mov rax, qword [rsp + 0x58]
mov byte [rbp + rax + 0x3e0], cl
mov rax, qword [rsp + 0x58]
inc rax
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
cmp rax, 8
jb 0x14004daf0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x68], r14
mov r8d, 7
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp + 0x50]
call fcn.14006a3d0
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x350]
call fcn.14005b620
lea rdx, [rbp + 0x360]
mov rcx, rax
call fcn.140061980
nop
mov dword [rbp + 0x10], 0x575
movabs rax, 0x1000000000000000
mov qword [rbp + 8], rax
mov qword [rbp + 0x330], 1
lea rax, [rbp + 8]
mov qword [rbp + 0x338], rax
lea rax, [0x1401f87e8]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
movaps xmm0, xmmword [rbp + 0x330]
movdqa xmmword [rbp + 0x330], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
lea r8, [rbp + 0x330]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x310]
call fcn.140062280
lea rdx, [rbp + 0x310]
cmp qword [rbp + 0x328], 0x10
cmovae rdx, qword [rbp + 0x310]
lea rcx, [rbp + 0x360]
cmp qword [rbp + 0x378], 0x10
cmovae rcx, qword [rbp + 0x360]
mov r8, qword [rbp + 0x370]
cmp r8, qword [rbp + 0x320]
jne 0x14004dc32
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004dc32
xor bl, bl
jmp 0x14004dc34
mov bl, 1
lea rcx, [rbp + 0x310]
call fcn.14005ec80
test bl, bl
je 0x14004e35f
mov dword [rbp - 0x70], 0x9dd766ad
mov dword [rbp - 0x6c], 0xb7262842
mov dword [rbp - 0x68], 0x9c62b1d7
mov dword [rbp - 0x64], 0x68439520
mov dword [rbp - 0x60], 0x73f6588a
mov dword [rbp - 0x5c], 0x6c3ce3c
mov dword [rbp - 0x58], 0xf9506176
mov dword [rbp - 0x54], 0xd733bf30
mov word [rbp - 0x50], 0x8a03
lea rdx, [rbp + 0x380]
lea rcx, [rbp - 0x70]
call fcn.14005acc0
nop
mov rcx, rax
call fcn.14005ccf0
mov rbx, rax
mov dword [rbp + 8], 0x575
lea r8, [rbp + 0x360]
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x110]
call fcn.14004e3c0
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.140062270
movups xmm6, xmmword [rax]
mov dword [rbp + 0x270], 0x48ca6238
mov dword [rbp + 0x274], 0xfb079fe1
mov dword [rbp + 0x278], 0x9d94338d
mov dword [rbp + 0x27c], 0x1a8bd3c6
mov dword [rbp + 0x280], 0x50361a68
mov dword [rbp + 0x284], 0xeed96df8
mov dword [rbp + 0x288], 0x54152c9f
mov dword [rbp + 0x28c], 0x6d76d505
mov dword [rbp + 0x290], 0x58068035
mov dword [rbp + 0x294], 0xc385a354
mov dword [rbp + 0x298], 0xf949dfb8
mov dword [rbp + 0x29c], 0xb9072a78
mov dword [rbp + 0x2a0], 0x82dd98c6
mov dword [rbp + 0x2a4], 0xefe685d2
mov dword [rbp + 0x2a8], 0x73c37204
mov dword [rbp + 0x2ac], 0x32bfaf04
mov dword [rbp + 0x2b0], 0x8d9c5834
mov dword [rbp + 0x2b4], 0x77921f17
mov dword [rbp + 0x2b8], 0x78e7c3ea
mov dword [rbp + 0x2bc], 0xf712defc
mov dword [rbp + 0x2c0], 0x71d3aaf4
mov dword [rbp + 0x2c4], 0x2887a63b
mov dword [rbp + 0x2c8], 0xa62a2b13
mov dword [rbp + 0x2cc], 0xffb91572
mov dword [rbp + 0x2d0], 0x8ceed5ae
mov dword [rbp + 0x2d4], 0x5ce4ab08
mov dword [rbp + 0x2d8], 0xa4e2b0c4
mov dword [rbp + 0x2dc], 0xccf6565d
mov dword [rbp + 0x2e0], 0xf3389a14
mov dword [rbp + 0x2e4], 0x4b54112e
mov dword [rbp + 0x2e8], 0x1590d57e
mov dword [rbp + 0x2ec], 0x4d4d9bc9
mov dword [rbp + 0x2f0], 0x6e126878
mov dword [rbp + 0x2f4], 0xe48a7224
mov dword [rbp + 0x2f8], 0x9f004f09
mov dword [rbp + 0x2fc], 0xce125943
mov dword [rbp + 0x300], 0xf7202de6
mov dword [rbp + 0x304], 0x765715a4
mov dword [rbp + 0x308], 0x7ffdc754
mov word [rbp + 0x30c], 0x12b0
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x270]
call fcn.14005ad70
nop
movaps xmmword [rsp + 0x60], xmm6
lea rdx, [rbp + 0x258]
mov rcx, rax
call fcn.14005cd00
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x330], xmm0
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x3c0]
call fcn.140062280
mov rcx, rax
call fcn.14005ccf0
mov rdx, rax
call fcn.140099500
mov r9d, 0x41
mov r8, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, eax
lea rcx, [rbp + 0x3c0]
call fcn.140049da0
nop
lea rcx, [rbp + 0xb0]
call fcn.140049da0
nop
lea rcx, [rbp + 0x380]
call fcn.140049da0
cmp ebx, 1
jne 0x14004e353
mov r8d, 0x104
lea rdx, [rbp + 0x400]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x310]
call fcn.140062490
nop
mov dword [rbp - 0x18], 0x52f07bed
mov dword [rbp - 0x14], 0xd8d0fe71
mov dword [rbp - 0x10], 0xee8006bf
mov dword [rbp - 0xc], 0xd86b8a10
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 0x18]
call fcn.14005ac10
mov rbx, rax
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x310]
call fcn.140048cc0
nop
lea rdx, [rbp + 0xf0]
mov rcx, rax
call fcn.140048b00
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x1b0]
call fcn.140061960
nop
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.140061b00
nop
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x310]
call fcn.140048bf0
nop
lea r8, [rbp + 0xb0]
mov rdx, rax
lea rcx, [rbp + 0x380]
call fcn.140048ee0
nop
lea rcx, [rbp + 0x170]
call fcn.140049060
nop
lea rcx, [rbp + 0xb0]
call fcn.140049060
nop
lea rcx, [rbp + 0x1b0]
call fcn.140049da0
nop
lea rcx, [rbp + 0xf0]
call fcn.140049da0
nop
lea rcx, [rbp + 0x70]
call fcn.140049060
nop
lea rcx, [rbp + 0x90]
call fcn.140049da0
lea rax, [rbp + 0x30]
mov qword [rbp - 0x20], rax
lea rcx, [rbp + 0x30]
call fcn.14005b0f0
mov rsi, rax
lea rax, [rbp + 0x210]
mov qword [rbp + 0x3e0], rax
lea rcx, [rbp + 0x210]
call fcn.14005b040
mov rdi, rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x58], rax
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x380]
call fcn.140048b00
mov rbx, rax
mov dword [rsp + 0x60], 0xc5bf7784
mov dword [rsp + 0x64], 0x2a2c81d9
mov dword [rsp + 0x68], 0xd6702101
mov dword [rsp + 0x6c], 0x820bf1f
mov dword [rsp + 0x70], 0x126d5748
mov dword [rsp + 0x74], 0xb5a2c6cb
mov dword [rsp + 0x78], 0xbfb46807
lea rdx, [rbp + 0x110]
lea rcx, [rsp + 0x60]
call fcn.14005ab60
mov rdx, rax
lea rcx, [rbp + 0x350]
call fcn.14005b620
lea rdx, [rbp - 0x70]
mov rcx, rax
call fcn.140061980
nop
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov rdx, rax
call fcn.14007bc80
mov dword [rsp + 0x60], 0x8e414e0f
mov dword [rsp + 0x64], 0xf8048399
mov dword [rsp + 0x68], 0xe8059385
mov dword [rsp + 0x6c], 0xed54944a
mov dword [rsp + 0x70], 0xb525676
mov dword [rsp + 0x74], 0x64a50dda
mov dword [rsp + 0x78], 0x29d90be1
mov dword [rsp + 0x7c], 0xa38c2227
mov dword [rbp - 0x80], 0x74a42f15
mov dword [rbp - 0x7c], 0x7bf141e5
mov dword [rbp - 0x78], 0xdddee60d
mov dword [rbp - 0x74], 0x6431ac78
lea rdx, [rbp + 0x110]
lea rcx, [rsp + 0x60]
call fcn.14005aab0
nop
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.140061b00
nop
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x310]
call fcn.140048bf0
nop
lea r8, [rbp + 0x30]
mov rdx, rax
lea rcx, [rbp + 0x330]
call fcn.140048ee0
nop
lea rcx, [rbp - 0x70]
call fcn.140049060
nop
lea rcx, [rbp + 0x30]
call fcn.140049060
nop
lea rcx, [rbp + 0x110]
call fcn.140049da0
lea rax, [rbp + 0x90]
mov qword [rbp - 0x20], rax
lea rdx, [0x1402b5528]
lea rcx, [rbp + 0x90]
call fcn.14005cdb0
mov rbx, rax
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x70]
call fcn.140049070
nop
mov r8, rbx
mov rdx, rax
call fcn.14007f6a0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x274], xmm0
movups xmmword [rbp + 0x284], xmm0
movups xmmword [rbp + 0x294], xmm0
movups xmmword [rbp + 0x2a4], xmm0
movups xmmword [rbp + 0x2b4], xmm0
movups xmmword [rbp + 0x2c4], xmm0
mov dword [rbp + 0x2d4], eax
mov dword [rbp + 0x270], WSAGetLastError
movups xmmword [rbp + 0x258], xmm0
mov qword [rbp + 0x268], rax
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x380]
call fcn.140048b00
mov rdi, rax
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x310]
call fcn.140048b00
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 8], eax
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x330]
call fcn.140048b00
nop
lea rcx, str._________
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], reloc.WS2_32.dll_recvfrom
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 8]
mov r8, rax
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x3c0]
call fcn.1400624d0
nop
lea rcx, [rbp + 0x90]
call fcn.140049da0
nop
lea rcx, [rbp + 0x70]
call fcn.140049da0
nop
lea rcx, [rbp + 0xf0]
call fcn.140049da0
lea rcx, [rbp + 0x3c0]
call fcn.14005ccf0
mov rdx, rax
lea rax, [rbp + 0x258]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x270]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14004e320
mov rcx, qword [rbp + 0x258]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x260]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x3c0]
call fcn.140049da0
nop
lea rcx, [rbp + 0x330]
call fcn.140049060
nop
lea rcx, [rbp + 0x380]
call fcn.140049060
nop
lea rcx, [rbp + 0x310]
call fcn.140049060
mov ecx, 0xdead
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [rbp + 0x360]
call fcn.14005ec80
nop
movzx edx, byte [rbp + 0x350]
lea rcx, [rbp + 0x358]
call fcn.14005e510
nop
lea rcx, [rbp + 0x3a0]
call fcn.14005ec80
mov rcx, qword [rbp + 0x510]
xor rcx, rsp
call fcn.14014d450
lea r11, [rsp + 0x630]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret