Function at 0x140012cb0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x890]
sub rsp, 0x990
mov rax, qword [0x14004e100]
xor rax, rsp
mov qword [rbp + 0x880], rax
mov rsi, r9
movzx edi, r8b
mov byte [rsp + 0x51], r8b
movzx r14d, dl
mov byte [rsp + 0x50], dl
mov rbx, rcx
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x70], 0
lea rcx, [rbp + 0x60]
call fcn.140010f50
nop
mov r12, rax
cmp qword [rax + 0x18], 7
jbe 0x14001090b
mov r12, qword [rax]
mov r15, qword [rax + 0x10]
call fcn.140014944
mov r13d, eax
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xor eax, eax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 0xf
mov byte [rbp], al
mov dword [rsp + 0x70], 8
test r15, r15
je 0x140010a2b
cmp r15, 0x7fffffff
ja 0x140010f1c
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, r15d
mov rdx, r12
mov ecx, r13d
call fcn.1400149b4
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x140010f27
movsxd rcx, edi
mov rdx, qword [rbp + 0x10]
cmp rcx, rdx
ja 0x140010995
lea rax, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rax, qword [rbp]
mov qword [rbp + 0x10], rcx
mov byte [rax + rcx], 0
jmp 0x1400109f7
mov r14, rcx
sub r14, rdx
mov r8, qword [rbp + 0x18]
mov rax, r8
sub rax, rdx
cmp r14, rax
ja 0x1400109d7
mov qword [rbp + 0x10], rcx
lea rbx, [rbp]
cmp r8, 0xf
cmova rbx, qword [rbp]
add rbx, rdx
mov r8, r14
xor edx, edx
mov rcx, rbx
call fcn.140038ca0
mov byte [r14 + rbx], 0
mov rbx, qword [rsp + 0x60]
jmp 0x1400109f1
mov byte [rsp + 0x20], 0
mov r9, r14
movzx r8d, byte [rsp + 0x51]
mov rdx, r14
lea rcx, [rbp]
call fcn.1400023c0
movzx r14d, byte [rsp + 0x50]
lea r9, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova r9, qword [rbp]
mov dword [rsp + 0x20], edi
mov r8d, r15d
mov rdx, r12
mov ecx, r13d
call fcn.1400149b4
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140010f33
movzx edi, byte [rsp + 0x51]
lea rcx, [rbp + 0x60]
call fcn.1400046b0
mov rdx, rbx
lea rcx, [rbp + 0x40]
call fcn.140012570
nop
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rdx, qword [rbp + 0x40]
mov rbx, qword [rbp + 0x50]
mov r8, rbx
lea rcx, [rbp + 0x80]
call fcn.140038600
cmp rbx, 0x800
jae 0x140010f16
mov byte [rbp + rbx + 0x80], 0
test r14b, r14b
je 0x140010a85
test rsi, rsi
je 0x140010a85
mov bl, 1
jmp 0x140010a87
xor bl, bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xor r15d, r15d
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r15w
test bl, bl
je 0x140010bf3
mov qword [rsp + 0x60], rsi
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rsi + rax], 0
jne 0x140010ab6
mov qword [rsp + 0x68], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x60]
call fcn.140001620
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x140010b15
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010b10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f3d
call fcn.140015690
movups xmm1, xmmword [rbp + 0x60]
movups xmmword [rbp + 0x20], xmm1
movups xmm0, xmmword [rbp + 0x70]
movups xmmword [rbp + 0x30], xmm0
movq rdx, xmm0
test rdx, rdx
je 0x140010b90
lea rbx, [rbp + 0x20]
movq rcx, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 7
cmova rbx, rcx
lea rcx, [rdx + rdx]
lea rdx, [rbx + rcx]
sar rcx, 1
cmp rcx, 2
jl 0x140010ddb
mov eax, dword [rbx]
and eax, 0xffffffdf
sub eax, 0x3a0041
cmp eax, 0x1a
jae 0x140010ddb
cmp rcx, 3
jl 0x140010b90
movzx eax, word [rbx + 4]
cmp ax, 0x5c
je 0x140010dec
cmp ax, 0x2f
je 0x140010dec
xor bl, bl
lea rax, [0x14003c048]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 3
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x60]
call fcn.140001620
nop
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x20]
call fcn.140013110
lea rcx, [rbp + 0x20]
cmp rcx, rax
je 0x140010bea
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140010bdd
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.1400048a0
nop
lea rcx, [rbp + 0x60]
call fcn.1400046b0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x70], 0x68
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rax
movzx ecx, dil
shl ecx, 4
lea rax, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rax, qword [rbp]
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140010df3
lea rdx, str.CreateProcess_failed__
lea rcx, [0x14004f810]
call fcn.140001260
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.14000e700
mov rcx, rax
lea rdx, [0x14003c04c]
call fcn.140001260
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140006690
movzx edx, al
mov rcx, rbx
call fcn.140004f30
mov rcx, rbx
call fcn.140004b60
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x140010d18
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010d13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f43
call fcn.140015690
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r15w
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140010d64
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010d5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f49
call fcn.140015690
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x140010daf
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010daa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f10
call fcn.140015690
xor al, al
mov rcx, qword [rbp + 0x880]
xor rcx, rsp
call fcn.1400157b0
mov rbx, qword [rsp + 0x9d8]
add rsp, 0x990
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, rbx
call fcn.140004030
cmp rbx, rax
je 0x140010b90
mov bl, 1
jmp 0x140010b92
mov dil, 1
test bl, bl
je 0x140010e09
mov edx, dword [rbp - 0x78]
lea rcx, [rbp + 0x20]
call fcn.1400110b0
movzx edi, al
test r14b, r14b
jne 0x140010e1e
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x140010e74
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010e6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f43
call fcn.140015690
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r15w
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140010ec0
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010ebb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f49
call fcn.140015690
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x140010f07
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010f02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f10
call fcn.140015690
movzx eax, dil
jmp 0x140010db1
call fcn.14001c45c
nop
call fcn.140015e9c
nop
mov ecx, 0x16
call fcn.140004630
int3
shr rdi, 0x20
mov ecx, edi
call fcn.140004670
int3
shr rcx, 0x20
call fcn.140004670
nop
call fcn.14001c45c
nop
call fcn.14001c45c
nop
call fcn.14001c45c
int3
jmp 0x1400108a0