Function at 0x140210420
Capabilities:
Create process on windows

Disassembly:
push rdi
sub rsp, 0x5a0
mov rax, qword [0x14059a600]
xor rax, rsp
mov qword [rsp + 0x590], rax
mov eax, dword [0x1406afe2c]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
cdq
mov ecx, 0xe10
idiv ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x50]
cdq
mov ecx, 0xe10
idiv ecx
mov eax, edx
cdq
mov ecx, reloc.WLDAP32.dll_Ordinal_60
idiv ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x50]
cdq
mov ecx, 0xe10
idiv ecx
mov eax, edx
cdq
mov ecx, reloc.WLDAP32.dll_Ordinal_60
idiv ecx
mov eax, edx
mov dword [rsp + 0x50], eax
lea rdx, [0x1406b0fe8]
lea rcx, [rsp + 0x200]
call fcn.14006cc30
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov r8, qword [rsp + 0x68]
lea rdx, str.MapType:
lea rcx, [rsp + 0x4f8]
call fcn.14006db50
nop
lea rcx, [rsp + 0x200]
call fcn.14006ca40
lea rdx, [0x1406b1050]
lea rcx, [rsp + 0x220]
call fcn.14006cc30
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x78], rax
mov r8, qword [rsp + 0x78]
lea rdx, str.GameType:
lea rcx, [rsp + 0x4d8]
call fcn.14006db50
nop
lea rcx, [rsp + 0x220]
call fcn.14006ca40
mov edx, dword [0x1406afe98]
lea rcx, [rsp + 0x240]
call fcn.14006c830
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov r8, qword [rsp + 0x88]
lea rdx, str.Kills:
lea rcx, [rsp + 0x4b8]
call fcn.14006db50
nop
lea rcx, [rsp + 0x240]
call fcn.14006ca40
mov edx, dword [rsp + 0x50]
lea rcx, [rsp + 0x1e0]
call fcn.14006c830
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xd0], rax
mov edx, dword [rsp + 0x54]
lea rcx, [rsp + 0x2e0]
call fcn.14006c830
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xa8], rax
mov r8, qword [rsp + 0xa8]
lea rdx, str.Game_Time_Remind:
lea rcx, [rsp + 0x2c0]
call fcn.14006db50
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], rax
lea r8, [0x140519e8c]
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x2a0]
call fcn.1400a2b60
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0xd8], rax
mov r8, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x280]
call fcn.1400a2bc0
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0xe8], rax
lea r8, [0x140519fdc]
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x260]
call fcn.1400a2b60
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0xf8], rax
lea r8, str._:alarm_clock:
mov rdx, qword [rsp + 0xf8]
lea rcx, [rsp + 0x498]
call fcn.1400a2b60
nop
lea rcx, [rsp + 0x260]
call fcn.14006ca40
nop
lea rcx, [rsp + 0x280]
call fcn.14006ca40
nop
lea rcx, [rsp + 0x2a0]
call fcn.14006ca40
nop
lea rcx, [rsp + 0x2c0]
call fcn.14006ca40
nop
lea rcx, [rsp + 0x2e0]
call fcn.14006ca40
nop
lea rcx, [rsp + 0x1e0]
call fcn.14006ca40
lea rcx, [0x1406e53a0]
call fcn.14006c8f0
mov qword [rsp + 0x120], rax
lea rcx, [rsp + 0x4d8]
call fcn.14006c8f0
mov r8, rax
lea rdx, [0x1406e5250]
lea rcx, [rsp + 0x320]
call fcn.140161e70
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x108], rax
lea r8, [0x1406e5270]
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x300]
call fcn.140162070
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x128], rax
mov r8, qword [rsp + 0x120]
mov rdx, qword [rsp + 0x128]
lea rcx, [rsp + 0x478]
call fcn.1400a2b60
nop
lea rcx, [rsp + 0x300]
call fcn.14006ca40
nop
lea rcx, [rsp + 0x320]
call fcn.14006ca40
lea rcx, [0x1406e53a0]
call fcn.14006c8f0
mov qword [rsp + 0x150], rax
lea rcx, [rsp + 0x4f8]
call fcn.14006c8f0
mov r8, rax
lea rdx, [0x1406e5250]
lea rcx, [rsp + 0x360]
call fcn.140161e70
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x138], rax
lea r8, [0x1406e5270]
mov rdx, qword [rsp + 0x138]
lea rcx, [rsp + 0x340]
call fcn.140162070
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x158], rax
mov r8, qword [rsp + 0x150]
mov rdx, qword [rsp + 0x158]
lea rcx, [rsp + 0x458]
call fcn.1400a2b60
nop
lea rcx, [rsp + 0x340]
call fcn.14006ca40
nop
lea rcx, [rsp + 0x360]
call fcn.14006ca40
lea rcx, [0x1406e53a0]
call fcn.14006c8f0
mov qword [rsp + 0x180], rax
lea rcx, [rsp + 0x4b8]
call fcn.14006c8f0
mov r8, rax
lea rdx, [0x1406e5250]
lea rcx, [rsp + 0x3a0]
call fcn.140161e70
mov qword [rsp + 0x160], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x168], rax
lea r8, [0x1406e5270]
mov rdx, qword [rsp + 0x168]
lea rcx, [rsp + 0x380]
call fcn.140162070
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x188], rax
mov r8, qword [rsp + 0x180]
mov rdx, qword [rsp + 0x188]
lea rcx, [rsp + 0x438]
call fcn.1400a2b60
nop
lea rcx, [rsp + 0x380]
call fcn.14006ca40
nop
lea rcx, [rsp + 0x3a0]
call fcn.14006ca40
lea rcx, [0x1406e53a0]
call fcn.14006c8f0
mov qword [rsp + 0x1b0], rax
lea rcx, [rsp + 0x498]
call fcn.14006c8f0
mov r8, rax
lea rdx, [0x1406e5250]
lea rcx, [rsp + 0x3e0]
call fcn.140161e70
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x198], rax
lea r8, [0x1406e5270]
mov rdx, qword [rsp + 0x198]
lea rcx, [rsp + 0x3c0]
call fcn.140162070
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x1a8], rax
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x1b8], rax
mov r8, qword [rsp + 0x1b0]
mov rdx, qword [rsp + 0x1b8]
lea rcx, [rsp + 0x418]
call fcn.1400a2b60
nop
lea rcx, [rsp + 0x3c0]
call fcn.14006ca40
nop
lea rcx, [rsp + 0x3e0]
call fcn.14006ca40
lea rcx, [rsp + 0x478]
call fcn.14006c8f0
mov qword [rsp + 0x1c0], rax
lea rcx, [rsp + 0x458]
call fcn.14006c8f0
mov qword [rsp + 0x1c8], rax
lea rcx, [rsp + 0x438]
call fcn.14006c8f0
mov qword [rsp + 0x1d0], rax
lea rcx, [rsp + 0x418]
call fcn.14006c8f0
mov qword [rsp + 0x1d8], rax
lea rax, [rsp + 0x520]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [rsp + 0x520], 0x68
lea rax, [rsp + 0x400]
mov rdi, rax
xor eax, eax
mov ecx, Ordinal_27
rep stosb byte [rdi], al
lea rax, [rsp + 0x400]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x520]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x1c0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
lea rax, [rsp + 0x400]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x520]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x1c8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
lea rax, [rsp + 0x400]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x520]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x1d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
lea rax, [rsp + 0x400]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x520]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x1d8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
lea rcx, [0x14051a03c]
call fcn.1403eaa3c
lea rcx, [rsp + 0x418]
call fcn.14006ca40
nop
lea rcx, [rsp + 0x438]
call fcn.14006ca40
nop
lea rcx, [rsp + 0x458]
call fcn.14006ca40
nop
lea rcx, [rsp + 0x478]
call fcn.14006ca40
nop
lea rcx, [rsp + 0x498]
call fcn.14006ca40
nop
lea rcx, [rsp + 0x4b8]
call fcn.14006ca40
nop
lea rcx, [rsp + 0x4d8]
call fcn.14006ca40
nop
lea rcx, [rsp + 0x4f8]
call fcn.14006ca40
mov rcx, qword [rsp + 0x590]
xor rcx, rsp
call fcn.1403d5a60
add rsp, 0x5a0
pop rdi
ret