Function at 0x14004b690
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x190
xorps xmm0, xmm0
movaps xmmword [rsp + 0x120], xmm0
movaps xmmword [rsp + 0x150], xmm0
movaps xmmword [rsp + 0x170], xmm0
movaps xmmword [rsp + 0x160], xmm0
movaps xmmword [rsp + 0x140], xmm0
movaps xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x180], 0
mov dword [rsp + 0x120], 0x70
mov dword [rsp + 0x15c], 0x80000
movaps xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], 0
mov dword [rsp + 0x5c], 0
lea r9, [rsp + 0x5c]
xor ecx, ecx
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_InitializeProcThreadAttributeList
mov esi, dword [rsp + 0x5c]
mov edx, 8
mov rcx, rsi
call fcn.1400cf720
test al, al
je 0x14004ba9e
movzx eax, byte [0x140120b70]
mov edx, 8
mov rcx, rsi
call fcn.14004bac0
test rax, rax
je 0x14004b914
mov rsi, rax
lea r9, [rsp + 0x5c]
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_InitializeProcThreadAttributeList
test eax, eax
je 0x14004b914
movabs rax, 0x10000220000000
mov qword [rsp + 0xb8], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], 8
lea r9, [rsp + 0xb8]
mov r8d, 0x20007
mov rcx, rsi
xor edx, edx
call sub.KERNEL32.dll_UpdateProcThreadAttribute
test eax, eax
je 0x14004b914
movabs rbx, 0x8000000000000000
mov qword [rsp + 0x188], rsi
lea rcx, [rsp + 0x88]
call fcn.1400b5400
cmp qword [rsp + 0x88], rbx
je 0x14004ba9e
movups xmm0, xmmword [rsp + 0x88]
movups xmm1, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call fcn.1400bd7c0
mov r8, rdx
lea rdi, [rsp + 0x108]
mov rcx, rdi
mov rdx, rax
call fcn.1400bdb90
mov qword [rsp + 0xc0], rdi
lea rax, [0x1400118a0]
mov qword [rsp + 0xc8], rax
lea rax, [0x1400f76b8]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], 2
mov qword [rsp + 0xa8], 0
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], 1
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x88]
call fcn.1400cd360
mov rdx, qword [rsp + 0x108]
cmp rdx, rbx
je 0x14004b8b7
test rdx, rdx
je 0x14004b8b7
mov rcx, qword [rsp + 0x110]
mov r8d, 1
call fcn.14004bad0
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x14004b8d1
mov rcx, qword [rsp + 0x68]
mov r8d, 1
call fcn.14004bad0
mov rdi, qword [rsp + 0x100]
test rdi, rdi
js 0x14004baaf
mov rbx, qword [rsp + 0xf8]
je 0x14004b923
movzx eax, byte [0x140120b70]
mov r15d, 1
mov edx, 1
mov rcx, rdi
call fcn.14004bac0
test rax, rax
je 0x14004bab2
mov r14, rax
jmp 0x14004b929
add rsp, 0x190
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r14d, 1
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.1400ea9f0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x60]
call fcn.1400372f0
mov rax, qword [rsp + 0x68]
mov byte [rax + rdi], 0
inc rdi
mov qword [rsp + 0x70], rdi
movzx eax, byte [0x140120b70]
mov ecx, 3
mov edx, 1
call fcn.14004bac0
test rax, rax
je 0x14004baa0
mov rdi, rax
mov byte [rax + 2], 0
mov word [rax], 0x4855
movzx eax, byte [0x140120b70]
mov ecx, 3
mov edx, 1
call fcn.14004bac0
test rax, rax
je 0x14004baa0
movzx ecx, byte [rdi + 2]
mov byte [rax + 2], cl
movzx ecx, word [rdi]
mov word [rax], cx
mov qword [rsp + 0x88], 3
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 3
mov edx, 3
mov r8d, 1
mov rcx, rdi
call fcn.14004bad0
lea rcx, [rsp + 0x88]
call fcn.1400372f0
mov rax, qword [rsp + 0x90]
mov byte [rax + 3], 0
mov qword [rsp + 0x98], 4
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x90]
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x80000
mov dword [rsp + 0x20], 0
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateProcessA
mov rcx, rsi
call sub.KERNEL32.dll_DeleteProcThreadAttributeList
mov edi, dword [rsp + 0x5c]
mov edx, 8
mov rcx, rdi
call fcn.1400cf720
test al, al
je 0x14004ba9e
mov r8d, 8
mov rcx, rsi
mov rdx, rdi
call fcn.14004bad0
nop dword [rax + rax]
mov ecx, 0x12c
xor edx, edx
call fcn.1400b4530
jmp 0x14004ba90
ud2
mov ecx, 1
mov edx, 3
call fcn.14006d9c0
xor r15d, r15d
mov rcx, r15
mov rdx, rdi
call fcn.14006d9c0
int3