Function at 0x140021210
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rax, qword [0x140190038]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp dword [rsp + 0xc0], 0
je 0x14002127d
xor r14d, r14d
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d2660
mov eax, r14d
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rsi
call fcn.14001f6b0
mov qword [r15], 0
mov r14d, 1
jmp 0x14002123a
mov rcx, rsi
mov r8, rbx
call fcn.14001f7d0
jmp 0x140021261
mov rbx, r9
mov ebp, r8d
mov rsi, rcx
mov r15, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0xb0]
cmp r8d, 0x10f
jle 0x1400212d0
cmp ebp, 0x800
je 0x140021270
cmp ebp, 0x113
je 0x140021354
cmp ebp, 0x110
jne 0x140021414
mov rcx, rsi
call fcn.14001ddd0
mov qword [r15], 1
jmp 0x140021268
cmp ebp, 2
je 0x140021259
cmp ebp, 0x14
je 0x14002138c
cmp ebp, 0x84
jne 0x140021414
xorps xmm0, xmm0
lea rbx, [rsp + 0x30]
movaps xmmword [rbx], xmm0
mov rcx, qword [rsi + 8]
mov rdx, rbx
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsi + 0x68]
mov dword [rbx + 0xc], eax
mov rcx, qword [rsi + 8]
mov rdx, rbx
call qword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x140021328
lea rdx, [rsp + 0x38]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, edi
sar eax, 0x10
movsx edx, di
shl rax, 0x20
or rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_PtInRect]
xor ecx, ecx
test eax, eax
setne cl
add rcx, rcx
mov qword [r15], rcx
jmp 0x140021268
mov dword [rsi + 0x48], 1
cmp rbx, 2
jne 0x140021383
mov edx, dword [rsi + 0x7fc]
cmp edx, dword [rsi + 0x800]
jge 0x140021383
inc edx
mov dword [rsi + 0x7fc], edx
lea rcx, [rsi + 0x228]
call fcn.140026740
mov qword [r15], 0
jmp 0x1400213a5
mov dword [rsi + 0x48], 1
mov rcx, rsi
mov rdx, rbx
call fcn.14001f510
mov qword [r15], 1
mov r14d, 1
cmp dword [rsi + 0x48], 0
jne 0x14002123a
lea r12, [rsp + 0x30]
mov dword [r12], 1
mov qword [rsp + 0x20], r12
mov rcx, rsi
mov edx, ebp
mov r8, rbx
mov r9, rdi
call fcn.1400215e0
mov qword [r15], rax
mov r14d, 1
cmp dword [r12], 0
jne 0x14002123a
jmp 0x140021237
cmp ebp, 0x111
jne 0x1400214b5
cmp eax, 0x3f9
jne 0x1400214b5
mov rcx, rsi
call fcn.14001f8e0
jmp 0x140021261
movzx eax, bx
cmp ebp, 0x111
jne 0x1400213f0
cmp eax, 0x3ee
jne 0x1400213f0
mov dword [rsp + 0x30], 1
mov r14, qword [rsi + 0x808]
test r14, r14
je 0x1400214b0
mov eax, 1
lock xadd dword [r14], eax
test eax, eax
jle 0x1400215d3
cmp eax, 0x7fffffff
je 0x1400215d6
mov rax, qword [rsi + 0x808]
mov rax, qword [rax + 8]
mov rcx, r14
call qword [0x1401bc008]
lock dec dword [r14]
je 0x14002156a
cmp dword [rsp + 0x30], 0
sete r12b
movzx r14d, bx
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, r14d
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov qword [r15], 0
mov r14d, 1
test r12b, r12b
je 0x14002123a
jmp 0x1400213b5
xor r12d, r12d
jmp 0x14002147e
cmp ebp, 0x111
jne 0x140021509
cmp eax, 0x3f1
jne 0x140021509
cmp byte [rsi + 0x7f8], 0
jne 0x140021261
lea rdi, [rsi + 0x288]
mov rcx, rdi
call fcn.140023bb0
xor al, 1
mov rcx, rdi
mov edx, eax
call fcn.140023dd0
mov rcx, rdi
call fcn.140023bb0
movzx edx, al
mov rcx, qword [rsi + 0x1b0]
call qword [sym.imp.USER32.dll_EnableWindow]
jmp 0x140021261
cmp ebp, 0x111
jne 0x140021543
cmp eax, 0x3f0
jne 0x140021543
xor esi, esi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], 5
lea r8, str.https:__123llq.com_license_
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [r15], rsi
jmp 0x140021268
cmp ebp, 0x111
jne 0x140021577
cmp eax, 0x3f4
jne 0x140021577
xor esi, esi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], 5
lea r8, str.https:__123llq.com_privacy_
jmp 0x14002152e
mov rcx, r14
call fcn.140048ce0
jmp 0x140021475
cmp ebp, 0x111
jne 0x140021593
cmp eax, 0x3f2
jne 0x140021593
mov rcx, rsi
call fcn.14001ff20
jmp 0x140021261
cmp ebp, 0x111
jne 0x1400215af
cmp eax, 0x3fa
jne 0x1400215af
mov rcx, rsi
call fcn.140020180
jmp 0x140021261
cmp ebp, 0x111
jne 0x1400213b5
cmp eax, 0x3fb
jne 0x1400213b5
mov rcx, rsi
call fcn.1400206e0
jmp 0x140021261
int3
int3