Function at 0x1401174f0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
jmp 0x1401174f0
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x268
lea rbp, [rsp + 0x50]
xor r12d, r12d
mov eax, dword [rcx]
xor r9d, r9d
mov dword [rbp + 0x12c], eax
mov rdi, r8
mov al, byte [0x1408bb067]
mov rsi, rdx
mov dword [0x14063c560], 0x44
mov qword [0x14063c568], r12
mov qword [0x14063c570], r12
mov qword [0x14063c578], r12
mov dword [0x14063c59c], r9d
mov word [0x14063c5a2], r9w
mov qword [0x14063c5a8], r12
cmp al, 0x53
je 0x14011759d
cmp al, 0x52
jne 0x14011757c
movabs rax, 0x52424542564e4957
mov qword [0x14063d988], rax
mov dword [0x14063d990], 0x4558452e
jmp 0x1401175b8
cmp al, 0x45
jne 0x1401175b8
movabs rax, 0x474f4a4f584e4957
mov qword [0x14063d988], rax
mov dword [0x14063d990], 0x4558452e
jmp 0x1401175b8
movabs rax, 0x45584542564e4957
mov qword [0x14063d988], rax
mov dword [0x14063d990], 0x4558452e
movsxd r13, dword [0x140898f40]
test r13, r13
lea rcx, [0x1408b3ee0]
lea rbx, [0x14063d988]
cmovle r13, r12
mov r14, rsp
mov qword [rbp + 0x1c8], r13
add r13, 0xc
mov rax, r13
mov qword [rbp + 0x1c0], rcx
mov qword [rbp + 0x1d0], rbx
mov qword [rbp + 0x1d8], 0xc
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140001e38
sub rsp, rax
lea rax, [rsp + 0x50]
mov r15, rax
lea rcx, [rbp + 0x1c0]
mov edx, 2
mov r8, r15
mov r9, r13
call fcn.1400048cc
mov rcx, r15
mov rdx, r13
call fcn.140001929
mov edx, eax
mov rax, r14
mov rsp, rax
test dl, 1
je 0x140117818
mov edx, 0xc
lea r13, [rbp + 0x200]
mov qword [r13 - 0x60], r13
lea rcx, [rbp + 0x1e0]
movsxd r13, dword [0x140898f40]
test r13, r13
mov qword [rbp + 0x140], rbx
lea r8, [rbp + 0x12c]
cmovle r13, r12
mov r10b, 0x22
mov r15d, 1
lea r9, [0x1408b3ee0]
lea r11, [0x1404d493c]
lea rbx, [rbp + 0x210]
mov dword [r8], 1
mov r14, rsp
mov byte [rcx + 0x20], r10b
mov qword [rcx - 0x38], r15
mov qword [r8 + 4], r9
mov qword [r8 + 0xc], r13
mov qword [r8 + 0x1c], 0xc
mov byte [rcx + 0x30], r10b
mov qword [r8 + 0x24], rbx
mov qword [r8 + 0x2c], r15
mov qword [rcx - 0x80], r11
mov qword [rcx - 0x78], r15
call fcn.140004390
mov edx, 0xc
lea rbx, [rbp + 0x1f0]
mov rcx, rbx
lea r8, [rbp + 0x1e0]
mov r9d, edx
call fcn.140002c52
movsxd rax, eax
add r13, rax
mov qword [rbp + 0x190], rsi
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x170], rbx
lea rbx, [0x1404d4940]
mov qword [rbp + 0x180], rbx
lea rsi, [r13 + rdi + 0xf]
mov rax, rsi
mov qword [rbp + 0x188], 1
mov qword [rbp + 0x198], rdi
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140001e38
sub rsp, rax
lea rax, [rsp + 0x50]
mov rbx, rax
lea rcx, [rbp + 0x130]
mov edx, 7
mov r8, rbx
mov r9, rsi
call fcn.1400048cc
mov edx, 0x12c
lea rdi, [rbp]
mov rcx, rdi
mov r8, rbx
mov r9, rsi
call fcn.1400042eb
mov edx, 2
lea rcx, [rbp + 0x1a0]
lea r8, [0x14063c5e0]
mov r9d, 0x1390
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0x12c
call fcn.1400048cc
mov rax, r14
mov rsp, rax
mov rdx, rsp
xor ecx, ecx
lea rax, [0x14063d970]
xor r8d, r8d
xor r9d, r9d
mov qword [rdx + 0x30], r12
mov qword [rdx + 0x38], r12
lea r12, [0x14063c560]
mov dword [rdx + 0x20], 0
mov dword [rdx + 0x28], 0x28
mov qword [rdx + 0x40], r12
mov qword [rdx + 0x48], rax
lea rdx, [0x14063c5e0]
call sub.KERNEL32.dll_CreateProcessA
mov rcx, qword [0x14063d970]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [0x14063d978]
call sub.KERNEL32.dll_CloseHandle
lea rcx, [0x14063d980]
call fcn.14000317f
jmp 0x1401178ae
movsxd rcx, dword [0x140898f40]
test rcx, rcx
mov qword [rbp + 0x20], rbx
lea rdx, [0x1404d4944]
cmovg r12, rcx
lea rdi, [0x1408b3ee0]
mov qword [rbp + 0x18], r12
add r12, 0x2c
mov rax, r12
lea rbx, [0x1404d495c]
mov qword [rbp], rdx
mov rsi, rsp
mov qword [rbp + 8], 0x15
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x28], 0xc
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], 0xb
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140001e38
sub rsp, rax
lea rax, [rsp + 0x50]
mov rbx, rax
lea rcx, [rbp]
mov edx, 4
mov r8, rbx
mov r9, r12
call fcn.1400048cc
mov rcx, rbx
mov rdx, r12
call fcn.1400040c0
mov rax, rsi
mov rsp, rax
lea rsp, [rbp + 0x218]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret