Function at 0x14000944c
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0xe8]
sub rsp, 0x1d0
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140035010]
xor rax, rsp
mov qword [rbp + 0xc0], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
xor esi, esi
mov qword [rsp + 0x78], rsi
lea rax, [rbp - 0x68]
mov qword [rsp + 0x60], rax
mov rdx, rcx
lea rcx, [rbp - 0x68]
call fcn.140005408
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400084d0
mov rbx, qword [rsp + 0x68]
cmp rbx, qword [rsp + 0x70]
je 0x14000975d
or r14d, 0xffffffff
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140005408
nop
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x60]
call fcn.140005408
nop
mov rdi, qword [rsp + 0x50]
xor edx, edx
lea r8d, [rdx + 0x20]
lea rcx, [rbp + 0x10]
call fcn.140010f90
mov dword [rbp + 0x10], 0x20
mov qword [rbp + 0x18], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
mov dword [rbp + 0xb0], 0xaac56b
mov dword [rbp + 0xb4], 0x11d0cd44
mov dword [rbp + 0xb8], 0xc000c28c
mov dword [rbp + 0xbc], 0xee95c24f
xor edx, edx
lea r8d, [rdx + 0x50]
lea rcx, [rbp - 0x40]
call fcn.140010f90
mov dword [rbp - 0x40], 0x50
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], 2
mov dword [rbp - 0x20], 1
mov dword [rbp - 0x10], esi
mov qword [rbp - 8], rsi
mov qword [rbp], rsi
mov qword [rbp + 8], 0x100
lea rax, [rbp + 0x10]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0xb0]
xor ecx, ecx
call qword [sym.imp.WINTRUST.dll_WinVerifyTrust]
test eax, eax
jne 0x14000970b
call fcn.140005e30
test rax, rax
je 0x140009814
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x70], rax
call fcn.140005e30
test rax, rax
je 0x140009830
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x78], rax
lea r9, [rsp + 0x58]
lea r8, [rbp - 0x78]
lea rdx, [rbp - 0x70]
mov rcx, qword [rsp + 0x50]
call fcn.140007970
cmp dword [rsp + 0x58], esi
je 0x1400096ca
call fcn.140005e30
test rax, rax
je 0x140009825
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x50]
lea rdx, str.__s___s
lea rcx, [rbp - 0x80]
call fcn.14000d16c
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp + 0x40]
call fcn.140010f90
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x60], rsi
mov dword [rbp + 0x40], 0x68
mov word [rbp + 0x80], si
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdi, qword [rbp - 0x80]
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14000969d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400096ad
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rdi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1400096ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1400096eb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x14000970b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
add rbx, 0x28
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x140009731
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x140009752
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
cmp rbx, qword [rsp + 0x70]
jne 0x1400094c9
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x1400097ed
mov rdi, qword [rsp + 0x70]
cmp rbx, rdi
je 0x14000978b
mov rcx, rbx
call fcn.140009364
add rbx, 0x28
cmp rbx, rdi
jne 0x140009775
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
sub rcx, rbx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400097d7
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000981f
mov rcx, rbx
call fcn.14000f3f4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rsi
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.14000f3d0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140005bc4
nop
call fcn.140013934
nop
mov ecx, 0x80004005
call fcn.140005bc4
nop
mov ecx, 0x80004005
call fcn.140005bc4
int3