Function at 0x14004cc20
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov rax, rsp
push rbp
push rbx
push rdi
push r12
lea rbp, [rax - 0x208]
sub rsp, 0x2e8
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rax - 0x98], xmm11
movaps xmmword [rax - 0xa8], xmm13
mov rax, qword [0x1400e1700]
xor rax, rsp
mov qword [rbp + 0x150], rax
movaps xmm0, xmmword [0x1400d0dc0]
lea rcx, [rsp + 0x78]
movss xmm8, dword [0x1400d047c]
mov rbx, rdx
movups xmmword [rsp + 0x78], xmm0
mov qword [rsp + 0x60], r9
movss xmm6, dword [rsp + 0x64]
mov qword [rsp + 0x50], r8
movaps xmm9, xmm6
movss xmm11, dword [rsp + 0x50]
movaps xmm10, xmm6
addss xmm9, dword [0x1400d04ac]
movaps xmm7, xmm11
addss xmm10, xmm8
addss xmm7, dword [rsp + 0x60]
movss dword [rsp + 0x6c], xmm9
movss dword [rsp + 0x64], xmm10
movaps xmm0, xmm7
subss xmm0, xmm8
movss dword [rsp + 0x68], xmm0
movaps xmm0, xmm7
subss xmm0, dword [0x1400d04b0]
movss dword [rsp + 0x60], xmm0
call fcn.14000b3f0
movss xmm13, dword [0x1400d0414]
lea r8, [rsp + 0x68]
xor r12d, r12d
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x28], r12d
mov r9d, eax
mov rcx, rbx
movss dword [rsp + 0x20], xmm13
call fcn.140036e50
movaps xmm0, xmmword [0x1400d0ec0]
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b3f0
mov rcx, qword [0x1401d5190]
movaps xmm0, xmm7
mov r8d, eax
xorps xmm1, xmm1
subss xmm0, dword [0x1400d04a4]
addss xmm6, dword [0x1400d0488]
mov rcx, qword [rcx + 0x38]
movss dword [rsp + 0x68], xmm0
movss dword [rsp + 0x6c], xmm6
test eax, 0xff000000
je 0x14004cdd1
test rcx, rcx
jne 0x14004cd7e
mov rax, qword [rbx + 0x38]
mov rcx, qword [rax + 8]
movups xmm0, xmmword [rbx + 0x88]
mov r9, qword [rsp + 0x68]
lea rax, [0x1400cfc1d]
movss xmm2, dword [0x1400d0474]
mov rdx, rbx
mov byte [rsp + 0x48], r12b
movss dword [rsp + 0x40], xmm1
mov qword [rsp + 0x38], rax
lea rax, [0x1400cfc1c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
movups xmmword [rsp + 0x78], xmm0
call fcn.14003b760
mov rcx, qword [0x1401d5160]
movaps xmm0, xmm11
subss xmm0, dword [0x1400d04b0]
mov dl, reloc.WLDAP32.dll_Ordinal_50
mov dword [rsp + 0x68], 0x41a00000
xor dl, 0x51
mov dword [rsp + 0x6c], 0x41a00000
mov rax, qword [rcx + 0x1d18]
mov r8b, 0x3d
mov r9b, 0x3e
mov byte [rsp + 0x53], dl
mov r10b, Ordinal_35
mov byte [rsp + 0x50], 0x51
mov r11b, 0x34
lea rdx, [rsp + 0x68]
mov byte [rax + 0xd1], 1
xor r8b, 0x51
mov rax, qword [rcx + 0x1d18]
xor r9b, 0x51
xor r10b, 0x51
mov byte [rsp + 0x54], r8b
xor r11b, 0x51
mov byte [rsp + 0x55], r9b
xor edi, edi
mov byte [rsp + 0x56], r10b
movss xmm3, dword [rax + 0x50]
movss xmm2, dword [rax + 0x54]
subss xmm3, dword [rax + 0x9c]
subss xmm2, dword [rax + 0xa0]
mov byte [rsp + 0x57], r11b
mov byte [rsp + 0x58], dil
addss xmm3, xmm0
addss xmm2, xmm8
movss dword [rax + 0x118], xmm3
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
movss xmm0, dword [rax + 0x134]
maxss xmm1, xmm3
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
mov al, WSAStartup
movzx ecx, al
xor al, 0x51
xor cl, 0x51
mov byte [rsp + 0x51], al
mov byte [rsp + 0x52], cl
lea rcx, [rsp + 0x51]
call fcn.1400429f0
test al, al
je 0x14004ced6
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov rax, qword [0x1401d5190]
cmp dword [rax + 0x100], 1
jne 0x14004d19d
cmp byte [rax + 0x114], dil
jne 0x14004d19d
movaps xmm0, xmmword [0x1400d0dc0]
lea rcx, [rsp + 0x78]
movaps xmm1, xmm7
mov qword [rsp + 0x2e0], rsi
subss xmm1, dword [0x1400d04b8]
subss xmm7, dword [0x1400d04d4]
mov qword [rsp + 0x2d8], r14
movss dword [rsp + 0x6c], xmm9
movss dword [rsp + 0x64], xmm10
movss dword [rsp + 0x68], xmm1
movss dword [rsp + 0x60], xmm7
mov qword [rsp + 0x2d0], r15
movups xmmword [rsp + 0x78], xmm0
call fcn.14000b3f0
mov r9d, eax
mov dword [rsp + 0x28], r12d
lea rdx, [rsp + 0x60]
movss dword [rsp + 0x20], xmm13
lea r8, [rsp + 0x68]
mov rcx, rbx
call fcn.140036e50
mov rcx, qword [0x1401d5160]
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x60]
mov dword [rsp + 0x68], 0x3f800000
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x6c], 0x3f800000
mov qword [rsp + 0x60], rdi
mov rax, qword [rcx + 0x1d18]
mov dword [rsp + 0x50], 0x41100000
mov dword [rsp + 0x54], 0x41100000
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
mov rcx, qword [0x1401d5190]
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, dword [0x1400d054c]
addss xmm2, dword [0x1400d0488]
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movaps xmm1, xmmword [0x1400d0f60]
movss dword [rax + 0x134], xmm0
xorps xmm0, xmm0
mov rcx, qword [rcx + 0xf0]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rbp - 0x68], xmm1
call fcn.140043db0
mov rcx, qword [0x1401d5160]
subss xmm11, dword [0x1400d04d4]
mov dword [rsp + 0x50], 0x41a00000
mov dword [rsp + 0x54], 0x41a00000
mov rax, qword [rcx + 0x1d18]
mov byte [rsp + 0x68], reloc.WLDAP32.dll_Ordinal_50
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x50]
subss xmm0, dword [rax + 0x9c]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm0, xmm11
addss xmm2, xmm8
movss dword [rax + 0x118], xmm0
movss dword [rax + 0x11c], xmm2
movss xmm1, dword [rax + 0x130]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm1
movss dword [rax + 0x134], xmm0
mov al, reloc.WS2_32.dll_recvfrom
movzx ecx, al
mov byte [rsp + 0x74], r12b
mov r8b, 0x5d
xor cl, 0x32
movzx r10d, r8b
mov byte [rsp + 0x6a], cl
mov dl, 0x5e
lea rcx, [rsp + 0x69]
xor dl, 0x32
mov bl, 0x46
movzx esi, bl
mov byte [rsp + 0x6b], dl
mov r9b, 0x55
lea rdx, [rsp + 0x50]
mov r11b, 0x47
xor r10b, 0x32
xor al, 0x32
mov byte [rsp + 0x6e], r10b
xor r8b, 0x32
mov byte [rsp + 0x69], al
xor r9b, 0x32
mov byte [rsp + 0x6c], r8b
xor r11b, 0x32
mov byte [rsp + 0x6d], r9b
mov dil, reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x6f], r11b
mov r14b, 0x5c
xor sil, 0x32
xor bl, 0x32
mov byte [rsp + 0x72], sil
xor dil, 0x32
mov byte [rsp + 0x70], bl
xor r14b, 0x32
mov byte [rsp + 0x71], dil
mov byte [rsp + 0x73], r14b
call fcn.1400429f0
mov r15, qword [rsp + 0x2d0]
test al, al
jne 0x14004d1e3
mov rsi, qword [rsp + 0x2e0]
mov r14, qword [rsp + 0x2d8]
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1400b8870
lea r11, [rsp + 0x2e8]
movaps xmm6, xmmword [r11 - 0x28]
movaps xmm7, xmmword [r11 - 0x38]
movaps xmm8, xmmword [r11 - 0x48]
movaps xmm9, xmmword [r11 - 0x58]
movaps xmm10, xmmword [r11 - 0x68]
movaps xmm11, xmmword [r11 - 0x78]
movaps xmm13, xmmword [r11 - 0x88]
mov rsp, r11
pop r12
pop rdi
pop rbx
pop rbp
ret
lea r8, str.SOFTWARESAPPHIRE
call fcn.14005ac90
lea rdx, [0x1400cb42e]
mov rsi, rax
lea rcx, [rsp + 0x78]
call fcn.1400017b0
mov dl, reloc.WLDAP32.dll_Ordinal_22
mov byte [rsp + 0x60], 0x79
xor dl, 0x79
mov r8b, reloc.WS2_32.dll_select
xor r8b, 0x79
mov byte [rsp + 0x62], dl
mov r9b, Ordinal_30
mov byte [rsp + 0x63], r8b
xor r9b, 0x79
lea r8, [rsp + 0x61]
mov cl, reloc.WS2_32.dll_listen
mov byte [rsp + 0x64], r9b
mov r10b, reloc.WS2_32.dll_socket
xor r11d, r11d
xor cl, 0x79
mov byte [rsp + 0x66], r11b
xor r10b, 0x79
mov byte [rsp + 0x61], cl
mov r9, rax
mov byte [rsp + 0x65], r10b
mov rdx, rsi
call fcn.14005ae70
lea rdx, [0x1400cb42e]
lea rcx, [rsp + 0x78]
call fcn.1400017b0
mov r8b, listen
mov byte [rsp + 0x50], 0x69
movzx edi, r8b
mov byte [rsp + 0x59], r12b
xor r8b, 0x69
mov dl, reloc.WLDAP32.dll_Ordinal_26
xor dl, 0x69
mov byte [rsp + 0x53], r8b
mov r9b, reloc.WLDAP32.dll_Ordinal_27
mov byte [rsp + 0x52], dl
xor r9b, 0x69
lea r8, [rsp + 0x51]
mov cl, 0x1c
mov byte [rsp + 0x54], r9b
mov r10b, 7
mov r11b, 8
xor cl, 0x69
xor r10b, 0x69
xor r11b, 0x69
mov byte [rsp + 0x51], cl
mov bl, 4
mov byte [rsp + 0x55], r10b
xor bl, 0x69
mov byte [rsp + 0x56], r11b
xor dil, 0x69
mov byte [rsp + 0x57], bl
mov r9, rax
mov byte [rsp + 0x58], dil
mov rdx, rsi
call fcn.14005ae70
lea rdx, [0x1400cb42e]
lea rcx, [rsp + 0x78]
call fcn.1400017b0
mov r8b, Ordinal_50
mov byte [rsp + 0x50], 0x43
movzx r9d, r8b
mov cl, 0x33
xor r8b, 0x43
xor cl, 0x43
mov dl, Ordinal_35
mov byte [rsp + 0x51], cl
xor dl, 0x43
mov byte [rsp + 0x53], r8b
xor r9b, 0x43
mov byte [rsp + 0x52], dl
mov byte [rsp + 0x54], r9b
mov r10b, 0x34
mov r11b, Ordinal_45
mov bl, Ordinal_50
mov dil, Ordinal_41
xor r10b, 0x43
mov byte [rsp + 0x59], r12b
xor r11b, 0x43
mov byte [rsp + 0x55], r10b
xor bl, 0x43
mov byte [rsp + 0x56], r11b
xor dil, 0x43
mov byte [rsp + 0x57], bl
mov r9, rax
mov byte [rsp + 0x58], dil
lea r8, [rsp + 0x51]
mov rdx, rsi
call fcn.14005ae70
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, 0x104
lea rdx, [rbp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.1400017b0
xorps xmm0, xmm0
mov dword [rbp - 0x50], 0x68
lea rcx, [rbp + 0x20]
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
call fcn.1400069f0
mov rdx, rax
xor r9d, r9d
lea rax, [rbp - 0x68]
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor ecx, ecx
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14004d401
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x64
lea rcx, [rsp + 0x50]
call fcn.140006c60
mov rcx, rax
call fcn.140006c70
call fcn.14005cf40
int3