Function at 0x140136870
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov r12, rdx
mov qword [rsp + 0x70], rdx
mov rsi, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
mov dword [rbp + 0x44], eax
mov dword [rbp - 0x20], 0x68
xor r13d, r13d
mov qword [rbp - 0x38], r13
xor edx, edx
mov r8d, 0xb8
lea rcx, [rbp + 0x50]
call fcn.1401a8d80
lea r8, [rbp - 0x20]
mov rdx, rsi
lea rcx, [rbp + 0x50]
call fcn.140136140
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
xorps xmm1, xmm1
movups xmmword [rbp - 0x68], xmm1
mov qword [rbp - 0x58], rax
lea rdx, [rsi + 0x20]
cmp qword [rdx + 0x18], 8
jb 0x14013692b
mov r14, qword [rdx]
mov rcx, qword [rdx + 0x10]
lea rdi, [r14 + rcx*2]
jmp 0x140136936
mov rax, qword [rdx + 0x10]
lea rdi, [rdx + rax*2]
mov r14, rdx
movdqu xmmword [rbp - 0x68], xmm0
mov rax, r13
mov qword [rbp - 0x58], rax
sub rdi, r14
mov rbx, rdi
sar rbx, 1
cmp rdi, 2
jb 0x14013699c
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140136fba
lfence
add rbx, rbx
mov rcx, rbx
call fcn.140012d70
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
add rbx, rax
mov qword [rbp - 0x58], rbx
lfence
mov r8, rdi
mov rdx, r14
mov rcx, rax
call fcn.1401a9040
mov qword [rbp - 0x60], rbx
mov rax, qword [rbp - 0x58]
jmp 0x1401369a0
mov rbx, qword [rbp - 0x60]
mov word [rsp + 0x60], r13w
cmp rbx, rax
je 0x1401369b6
mov word [rbx], r13w
add qword [rbp - 0x60], 2
jmp 0x1401369c7
lea r8, [rsp + 0x60]
mov rdx, rbx
lea rcx, [rbp - 0x68]
call fcn.1400d66f0
cmp qword [rsi + 0x10], 0
jne 0x1401369d3
mov r10, r13
jmp 0x1401369e0
mov r10, rsi
cmp qword [rsi + 0x18], 8
jb 0x1401369e0
mov r10, qword [rsi]
cmp qword [rsi + 0x50], 0
jne 0x1401369ec
mov rcx, r13
jmp 0x1401369fa
lea rcx, [rsi + 0x40]
cmp qword [rcx + 0x18], 8
jb 0x1401369fa
mov rcx, qword [rcx]
mov r11, qword [rsi + 0x90]
mov edx, dword [rsi + 0x80]
lea rax, [rbp - 0x80]
xor r9d, r9d
test r11, r11
je 0x140136a53
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 0x100]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], r13
mov eax, dword [rbp + 0xf0]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r13
mov r8, qword [rbp - 0x68]
mov rdx, r10
mov rcx, r11
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x140136a8c
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x100]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r13
mov eax, dword [rbp + 0xf0]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
xor r8d, r8d
mov rdx, qword [rbp - 0x68]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rbx, qword [rbp - 0x78]
mov qword [rbp - 0x30], rbx
mov rdi, qword [rbp - 0x80]
mov qword [rbp - 0x38], rdi
test eax, eax
jne 0x140136beb
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x110]
call fcn.1401a8d80
call fcn.140138af0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], 2
lea rcx, [rbp + 0x120]
call fcn.14000f010
nop
mov rcx, qword [rbp + 0x110]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400d90b6.0]
cmp dword [rbp + 0x118], eax
setl byte [rbp + 0x218]
jl 0x140136b32
lea rdx, str.CreateProcess:
lea rcx, [rbp + 0x110]
call fcn.1400238a0
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x64], eax
lea rdx, [rsp + 0x64]
mov rcx, rsi
call fcn.1400122b0
mov byte [rbp + 0x218], 1
lea rcx, [rbp + 0x110]
call fcn.14000afe0
nop
test rbx, rbx
je 0x140136b4e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140136b9b
mov rax, qword [rbp - 0x58]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140136b8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140136fc0
call fcn.1401853a0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r13
mov rcx, qword [rbp + 0x78]
test rcx, rcx
je 0x140136baa
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x140136be4
mov rdx, qword [rbp + 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140136bdf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140136fc6
call fcn.1401853a0
xor bl, bl
jmp 0x140136f78
test rbx, rbx
je 0x140136bfa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140136c47
mov rax, qword [rbp - 0x58]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140136c36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140136fc0
call fcn.1401853a0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r13
mov rcx, qword [rbp + 0x78]
test rcx, rcx
je 0x140136c56
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x140136c90
mov rdx, qword [rbp + 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140136c8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140136fc6
call fcn.1401853a0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r13
lfence
mov ecx, 8
call fcn.140012d70
mov qword [rbp - 0x50], rax
lea rdx, [rax + 8]
mov qword [rbp - 0x40], rdx
lfence
mov qword [rax], rdi
mov qword [rbp - 0x48], rdx
lea r8, [rsi + 0x88]
mov rax, qword [r8]
test rax, rax
je 0x140136ce7
cmp rdx, qword [rbp - 0x40]
je 0x140136cde
mov qword [rdx], rax
add qword [rbp - 0x48], 8
jmp 0x140136ce7
lea rcx, [rbp - 0x50]
call fcn.140132260
xor bl, bl
mov r14d, r13d
mov r15d, 0x13c8
mov rdi, qword [rbp - 0x38]
cmp dword [rsi + 0xa0], r13d
jle 0x140136e43
mov r15d, 1
mov r13d, 0x13c8
mov r12d, 0x13c0
test bl, bl
jne 0x140136e35
lea rcx, [rbp - 0x50]
call fcn.1401357a0
movzx ebx, bl
test al, al
cmovne ebx, r15d
cmp r14d, dword [rsi + 0xa4]
jl 0x140136e25
test bl, bl
jne 0x140136e25
mov edx, r15d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x140136e23
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x220]
call fcn.1401a8d80
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov eax, dword [r13 + rbx]
test al, 1
jne 0x140136d98
or eax, 1
mov dword [r13 + rbx], eax
xor eax, eax
mov qword [r12 + rbx], rax
call fcn.140138a70
mov qword [r12 + rbx], rax
mov rax, qword [r12 + rbx]
mov qword [rbp + 0x220], rax
mov dword [rbp + 0x228], 2
lea rcx, [rbp + 0x230]
call fcn.14000f010
nop
mov rcx, qword [rbp + 0x220]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400d90b6.0]
cmp dword [rbp + 0x228], eax
setl byte [rbp + 0x328]
jl 0x140136e11
lea rdx, str.TerminateProcess:
lea rcx, [rbp + 0x220]
call fcn.140032540
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.1400122b0
mov byte [rbp + 0x328], 1
lea rcx, [rbp + 0x220]
call fcn.14000afe0
mov r15d, 1
mov bl, 1
inc r14d
cmp r14d, dword [rsi + 0xa0]
jl 0x140136d15
mov r12, qword [rsp + 0x70]
xor r13d, r13d
mov r15d, 0x13c8
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x140136f22
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x330]
call fcn.1401a8d80
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov ecx, r15d
mov eax, dword [rcx + rbx]
mov edx, 0x13c0
mov esi, edx
test al, 1
jne 0x140136e9d
or eax, 1
mov dword [rcx + rbx], eax
xor eax, eax
mov qword [rdx + rbx], rax
call fcn.140138a70
mov qword [rsi + rbx], rax
mov rax, qword [rsi + rbx]
mov qword [rbp + 0x330], rax
mov dword [rbp + 0x338], 2
lea rcx, [rbp + 0x340]
call fcn.14000f010
nop
mov rcx, qword [rbp + 0x330]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400d90b6.0]
cmp dword [rbp + 0x338], eax
setl byte [rbp + 0x438]
jl 0x140136f16
lea rdx, str.GetExitCodeProcess__:
lea rcx, [rbp + 0x330]
call fcn.140012150
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x6c], eax
lea rdx, [rsp + 0x6c]
mov rcx, rbx
call fcn.1400122b0
mov byte [rbp + 0x438], 1
lea rcx, [rbp + 0x330]
call fcn.14000afe0
cmp dword [r12], 0
sete bl
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140136f78
mov rax, qword [rbp - 0x40]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140136f67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140136fb4
call fcn.1401853a0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r13
test rdi, rdi
je 0x140136f87
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
movzx eax, bl
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.140185380
mov rbx, qword [rsp + 0x5a0]
add rsp, 0x550
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1401b3c00
nop
call fcn.140013c60
int3
call fcn.1401b3c00
nop
call fcn.1401b3c00
int3