Function at 0x1400e0893
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
jmp 0x14011c670
push r13
push rbp
push rsi
push rdi
sub rsp, 0x868
lea r13, [rsp + 0x50]
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
lea rdi, [rsp + 0x50]
mov ecx, 0x176
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1409d3c80]
xor rax, r13
mov qword [rbp + 0x7e8], rax
lea rcx, [0x1409f310a]
call fcn.1400e5ded
nop
call fcn.1400e5ab4
nop
lea rax, [rbp + 0x574]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x594]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x574]
movzx r8d, byte [rbp + 0x594]
movzx edx, byte [rbp + 0x5b4]
lea rcx, [rbp + 0x500]
call fcn.1400f2320
mov rcx, rax
call fcn.1400e2f9e
mov qword [rbp + 8], rax
lea rdx, [0x1402bf838]
lea rcx, [rbp + 0x28]
call fcn.1400e2a8f
nop
lea rdx, [0x1402bf888]
lea rcx, [rbp + 0x68]
call fcn.1400e2a8f
nop
mov qword [rbp + 0xa8], 0
lea rcx, [rbp + 0x68]
call fcn.1400e492f
movzx eax, al
test eax, eax
je 0x14011c763
lea rcx, [rbp + 0x68]
call fcn.1400e0898
mov qword [rbp + 0xa8], rax
jmp 0x14011c783
lea rcx, [rbp + 0x28]
call fcn.1400e492f
movzx eax, al
test eax, eax
je 0x14011c783
lea rcx, [rbp + 0x28]
call fcn.1400e0898
mov qword [rbp + 0xa8], rax
mov rcx, qword [rbp + 8]
call fcn.1400e4272
mov qword [rbp + 0xc8], rax
cmp qword [rbp + 0xc8], 0
jne 0x14011c7c5
mov dword [rbp + 0x5d4], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.1400e1158
nop
lea rcx, [rbp + 0x28]
call fcn.1400e1158
mov eax, dword [rbp + 0x5d4]
jmp 0x14011cd86
mov rcx, qword [rbp + 0xc8]
call fcn.1400e593d
mov dword [rbp + 0xe4], eax
cmp dword [rbp + 0xe4], 0
jne 0x14011c821
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0xc8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov dword [rbp + 0x5f4], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.1400e1158
nop
lea rcx, [rbp + 0x28]
call fcn.1400e1158
mov eax, dword [rbp + 0x5f4]
jmp 0x14011cd86
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x110]
call fcn.1400e4614
nop
mov dword [rbp + 0x110], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x198]
call fcn.1400e4614
nop
lea rax, [rbp + 0x198]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x110]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rbp + 0x1c4], eax
cmp dword [rbp + 0x1c4], 0
jne 0x14011c8ef
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.1400e153b
nop
mov dword [rbp + 0x614], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.1400e1158
nop
lea rcx, [rbp + 0x28]
call fcn.1400e1158
mov eax, dword [rbp + 0x614]
jmp 0x14011cd86
lea rdx, [rbp + 0x1e4]
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
nop
mov qword [rbp + 0x208], 0
mov qword [rbp + 0x210], 0
cmp dword [rbp + 0x1e4], 0
je 0x14011c9be
lea rdx, [rbp + 0x198]
lea rcx, [rbp + 0x668]
call fcn.1400e2d32
lea rcx, [rbp + 0x638]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x208]
lea rcx, [rbp + 0x638]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
cmp qword [rbp + 0x210], 0
je 0x14011c97d
cmp qword [rbp + 0x208], 0
jne 0x14011c9b9
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.1400e153b
nop
mov dword [rbp + 0x694], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.1400e1158
nop
lea rcx, [rbp + 0x28]
call fcn.1400e1158
mov eax, dword [rbp + 0x694]
jmp 0x14011cd86
jmp 0x14011ca50
lea rdx, [rbp + 0x198]
lea rcx, [rbp + 0x6e8]
call fcn.1400e1fe5
lea rcx, [rbp + 0x6b8]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x208]
lea rcx, [rbp + 0x6b8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
cmp qword [rbp + 0x210], 0
je 0x14011ca14
cmp qword [rbp + 0x208], 0
jne 0x14011ca50
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.1400e153b
nop
mov dword [rbp + 0x714], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.1400e1158
nop
lea rcx, [rbp + 0x28]
call fcn.1400e1158
mov eax, dword [rbp + 0x714]
jmp 0x14011cd86
mov rcx, qword [rbp + 0xc8]
call fcn.1400e578a
mov dword [rbp + 0x234], eax
cmp dword [rbp + 0x234], 0
je 0x14011ca74
cmp dword [rbp + 0x1e4], 0
je 0x14011ca86
cmp dword [rbp + 0x234], 0
jne 0x14011caae
cmp dword [rbp + 0x1e4], 0
je 0x14011caae
mov dword [rbp + 0x734], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.1400e1158
nop
lea rcx, [rbp + 0x28]
call fcn.1400e1158
mov eax, dword [rbp + 0x734]
jmp 0x14011cd86
cmp dword [rbp + 0x234], 0
je 0x14011cacb
mov rcx, qword [rbp + 0xc8]
call fcn.1400e045b
mov dword [rbp + 0x254], eax
jmp 0x14011cadd
mov rcx, qword [rbp + 0xc8]
call fcn.1400e0df7
mov dword [rbp + 0x254], eax
cmp dword [rbp + 0x254], 0xffffffff
jne 0x14011cb22
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.1400e153b
nop
mov dword [rbp + 0x754], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.1400e1158
nop
lea rcx, [rbp + 0x28]
call fcn.1400e1158
mov eax, dword [rbp + 0x754]
jmp 0x14011cd86
cmp dword [rbp + 0x1e4], 0
je 0x14011cb46
mov rdx, qword [rbp + 0x210]
mov rcx, qword [rbp + 0x198]
call fcn.1400e3f6b
mov dword [rbp + 0x274], eax
jmp 0x14011cb5f
mov rdx, qword [rbp + 0x210]
mov rcx, qword [rbp + 0x198]
call fcn.1400e60b8
mov dword [rbp + 0x274], eax
cmp dword [rbp + 0x274], 0xffffffff
jne 0x14011cba4
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.1400e153b
nop
mov dword [rbp + 0x774], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.1400e1158
nop
lea rcx, [rbp + 0x28]
call fcn.1400e1158
mov eax, dword [rbp + 0x774]
jmp 0x14011cd86
mov eax, dword [rbp + 0x274]
cmp dword [rbp + 0x254], eax
je 0x14011cbee
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.1400e153b
nop
mov dword [rbp + 0x794], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.1400e1158
nop
lea rcx, [rbp + 0x28]
call fcn.1400e1158
mov eax, dword [rbp + 0x794]
jmp 0x14011cd86
cmp dword [rbp + 0x234], 0
je 0x14011cc0b
mov rcx, qword [rbp + 0xc8]
call fcn.1400e53c0
mov dword [rbp + 0x294], eax
jmp 0x14011cc1d
mov rcx, qword [rbp + 0xc8]
call fcn.1400e25bc
mov dword [rbp + 0x294], eax
cmp dword [rbp + 0x234], 0
je 0x14011cc46
cmp dword [rbp + 0x294], 0
jne 0x14011cc46
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.1400e2585
test eax, eax
jne 0x14011ccc1
cmp dword [rbp + 0x234], 0
je 0x14011cc6f
cmp dword [rbp + 0x294], 0
je 0x14011cc6f
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.1400e18bf
test eax, eax
jne 0x14011ccc1
cmp dword [rbp + 0x234], 0
jne 0x14011cc98
cmp dword [rbp + 0x294], 0
jne 0x14011cc98
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.1400e0ab9
test eax, eax
jne 0x14011ccc1
cmp dword [rbp + 0x234], 0
jne 0x14011ccfd
cmp dword [rbp + 0x294], 0
je 0x14011ccfd
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.1400e328c
test eax, eax
je 0x14011ccfd
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x198]
call fcn.1400e29ae
nop
mov dword [rbp + 0x7b4], 0
lea rcx, [rbp + 0x68]
call fcn.1400e1158
nop
lea rcx, [rbp + 0x28]
call fcn.1400e1158
mov eax, dword [rbp + 0x7b4]
jmp 0x14011cd86
cmp qword [rbp + 0xc8], 0
je 0x14011cd20
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0xc8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
cmp qword [rbp + 0x1a0], 0
je 0x14011cd38
mov rcx, qword [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rbp + 0x198], 0
je 0x14011cd63
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov dword [rbp + 0x7d4], 0xffffffff
lea rcx, [rbp + 0x68]
call fcn.1400e1158
nop
lea rcx, [rbp + 0x28]
call fcn.1400e1158
mov eax, dword [rbp + 0x7d4]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, reloc.OLEAUT32.dll_SysStringLen
call fcn.1400e4d5d
mov rax, rdi
mov rcx, qword [rbp + 0x7e8]
xor rcx, r13
call fcn.1400e2d2d
lea rsp, [r13 + 0x818]
pop rdi
pop rsi
pop rbp
pop r13
ret