Function at 0x14000b150
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov rsi, rcx
mov rax, qword [0x140029090]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x14002b6f4]
mov ecx, dword [0x14002b6f0]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rbp - 1]
cmp ecx, 0xa
setl byte [rbp - 2]
mov eax, 0xe0928aa0
mov r14, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15d, 0xbfd75afa
mov r12, qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov r13d, 0xb941923d
mov edi, 0x8853ee29
jmp 0x14000b1f0
mov eax, dword [0x14002b6f4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x43915f9e
mov ecx, 0xde40610
cmove eax, ecx
cmp dword [0x14002b6f0], 0xa
cmovl eax, ecx
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0xed2b39c0
jle 0x14000b270
cmp eax, 0x2d064953
jg 0x14000b2b0
cmp eax, 0x201bafbb
jg 0x14000b33f
cmp eax, 0xed2b39c1
je 0x14000b3fc
cmp eax, 0xde40610
jne 0x14000b1f0
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call r14
add rsp, 0x20
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax + 8]
sub rsp, 0x20
call r14
add rsp, 0x20
mov eax, dword [0x14002b6f4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x43915f9e
cmove eax, r15d
cmp dword [0x14002b6f0], 0xa
cmovl eax, r15d
jmp 0x14000b1f0
cmp eax, 0xbfd75af9
jle 0x14000b300
cmp eax, 0xd3565dd8
jg 0x14000b35f
cmp eax, 0xbfd75afa
je 0x14000b408
cmp eax, 0xc545cea1
jne 0x14000b1f0
mov eax, 0x97f24eaa
jmp 0x14000b1f0
cmp eax, 0x468e2242
jg 0x14000b394
cmp eax, 0x2d064954
je 0x14000b417
cmp eax, 0x43915f9e
jne 0x14000b1f0
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call r14
add rsp, 0x20
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax + 8]
sub rsp, 0x20
call r14
add rsp, 0x20
mov eax, 0xde40610
jmp 0x14000b1f0
cmp eax, 0xb457137e
jg 0x14000b3db
cmp eax, 0x8853ee29
je 0x14000b447
cmp eax, 0x97f24eaa
jne 0x14000b1f0
mov eax, dword [0x14002b6f4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc545cea1
mov ecx, 0xed2b39c1
jmp 0x14000b1d5
cmp eax, 0x201bafbc
je 0x14000b465
cmp eax, 0x21af9734
jne 0x14000b1f0
mov eax, 0x8853ee29
jmp 0x14000b1f0
cmp eax, 0xd3565dd9
je 0x14000b1bc
cmp eax, 0xe0928aa0
jne 0x14000b1f0
movzx ecx, byte [rbp - 1]
cmp byte [rbp - 2], 0
mov eax, 0x468e2243
mov edx, 0x201bafbc
cmovne eax, edx
test cl, cl
cmovne eax, edx
jmp 0x14000b1f0
cmp eax, 0x468e2243
je 0x14000b5aa
cmp eax, 0x7247b3f8
jne 0x14000b1f0
mov dword [rbp - 0x24], ebx
mov rax, qword [rbp - 0x20]
mov rax, qword [rbp - 0x18]
mov eax, dword [0x14002b6f4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x21af9734
cmove eax, edi
cmp dword [0x14002b6f0], 0xa
cmovl eax, edi
jmp 0x14000b1f0
cmp eax, 0xb941923d
jne 0x14000b6a7
cmp byte [rbp - 3], 0
mov eax, 0x2d064954
mov ecx, 0xd3565dd9
cmovne eax, ecx
jmp 0x14000b1f0
mov eax, 0x7247b3f8
xor ebx, ebx
jmp 0x14000b1f0
mov eax, 0x7247b3f8
mov ebx, 1
jmp 0x14000b1f0
mov eax, dword [0x14002b6f4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x97f24eaa
mov ecx, 0xc545cea1
cmovne eax, ecx
cmp dword [0x14002b6f0], 9
mov ecx, 0x97f24eaa
cmovle eax, ecx
jmp 0x14000b1f0
mov eax, dword [0x14002b6f4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x21af9734
mov ecx, 0xb457137f
jmp 0x14000b1d5
mov eax, 0x70
call fcn.14000d850
sub rsp, rax
mov rcx, rsp
mov eax, 0x20
call fcn.14000d850
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x18], rcx
mov rax, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov rax, qword [rbp - 0x18]
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0
mov qword [rax + 0x20], 0
mov qword [rax + 0x28], 0
mov qword [rax + 0x30], 0
mov qword [rax + 0x38], 0
mov qword [rax + 0x40], 0
mov qword [rax + 0x48], 0
mov qword [rax + 0x50], 0
mov qword [rax + 0x58], 0
mov qword [rax + 0x60], 0
mov qword [rax], 0
mov dword [rcx], 0x68
mov dword [rcx + 0x3c], 1
mov word [rcx + 0x40], 5
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x10], 0
mov qword [rax + 8], 0
mov qword [rax], 0
mov rax, qword [rbp - 0x10]
sub rsp, 0x50
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call r12
add rsp, 0x50
test eax, eax
setne byte [rbp - 3]
mov eax, dword [0x14002b6f4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x468e2243
cmove eax, r13d
cmp dword [0x14002b6f0], 0xa
cmovl eax, r13d
jmp 0x14000b1f0
mov eax, 0x70
call fcn.14000d850
sub rsp, rax
mov rcx, rsp
mov eax, 0x20
call fcn.14000d850
sub rsp, rax
mov rax, rsp
mov qword [rcx], 0
mov qword [rcx + 0x38], 0
mov qword [rcx + 0x40], 0
mov qword [rcx + 0x60], 0
mov qword [rcx + 0x58], 0
mov qword [rcx + 0x50], 0
mov qword [rcx + 0x48], 0
mov qword [rcx + 0x30], 0
mov qword [rcx + 0x28], 0
mov qword [rcx + 0x20], 0
mov qword [rcx + 0x18], 0
mov qword [rcx + 0x10], 0
mov qword [rcx + 8], 0
mov dword [rcx], 0x68
mov dword [rcx + 0x3c], 1
mov word [rcx + 0x40], 5
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov qword [rax], 0
sub rsp, 0x50
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call r12
add rsp, 0x50
mov eax, 0x201bafbc
jmp 0x14000b1f0
cmp eax, 0xb457137f
jne 0x14000b1f0
mov esi, dword [rbp - 0x24]
mov rcx, qword [rbp]
xor rcx, rbp
sub rsp, 0x20
call fcn.14000d8c0
add rsp, 0x20
mov eax, esi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret