Function at 0x14000dac0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rdi
sub rsp, 0x2b0
xor eax, eax
test eax, eax
je 0x14000dce0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp al, byte [rcx + 0x400ff]
add byte [rsi + 0x12], bh
mov eax, edi
call 0x13ff4838c
mov bl, 0x65
add byte [rbx], bh
adc al, 0x24
setne dl
test dl, dl
je 0x14000db09
mov edx, 0x200445c
add byte [rdx], al
invalid
add al, byte [rax]
add ah, ah
cld
add byte [rax], r8b
add bl, ah
adc al, byte [rax]
add dword [rax], eax
add eax, 0x756c6156
add al, byte gs:[rax]
cld
push rax
mov eax, dword [rbp - 4]
push rax
mov eax, dword [rbp - 4]
push rax
mov eax, dword [rbp - 4]
push rax
mov eax, dword [rbp + 0x65]
insd dword [rdi], dx
outsb dx, byte gs:[rsi]
jb 0x14000dba2
invalid
outsd dx, dword [rsi]
jne 0x14000dc17
invalid
invalid
xor eax, eax
test eax, eax
je 0x14000def7
nop
nop
nop
nop
nop
nop
or al, 0x89
jg 0x14000dd05
mov eax, edi
call fcn.14000db8c
mov edx, esi
mov eax, edi
insd dword [rdi], dx
invalid
insb byte [rdi], dx
imul esp, dword [rdi + 0x6e], 0x746e656d
adc bh, byte [rcx + 0x53]
invalid
xor eax, eax
test eax, eax
je 0x14000e10e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
clc
test rsi, r14
jl 0x14000df3e
xor r11d, ebx
mov eax, dword [rdi + 0x44]
mov edx, ebx
call 0x142625330
add byte [rdx + rbp + 0x40], dl
add byte [rax + rax], al
add byte [rax], al
add al, byte [rsi]
jo 0x14000df92
cld
mov eax, dword [rax + 0xc]
mov dword [rbp - 0xc], eax
mov byte [rbp - 8], 0x11
lea eax, [rbp - 0xc]
push rax
insb byte [rdi], dx
add byte [rcx], ch
jp 0x14000df46
hlt
add byte gs:[rbx], dl
add byte gs:[rax + rax + 0x75], dh
add byte [rdx + rcx*4 - 0x6eb3ffb6], dl
add byte [rax - 0x6f], spl
add byte [rcx + r10*4 + 0x4a], sil
add byte [rsp + rax], bh
add byte [rbx - 0x2b36173d], cl
invalid
imul r13d, dword [rsi + 0x69], 0x64656873
invalid
call fcn.14000c930
test eax, eax
jne 0x14000ea1a
xor eax, eax
test eax, eax
je 0x14000e332
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
mov ebx, eax
push rsi
mov eax, dword [rbp - 4]
mov ecx, 1
mov edx, dword [0x14707e8bf]
invalid
mov r8d, 0x208
lea rdx, [rsp + 0xa0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
test eax, eax
je 0x14000e55f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push rbp
mov al, 5
call fcn.14000dd28
pop rcx
push rbp
mov al, 6
call 0x1af00dd28
add byte [rax], ah
add byte [rbp], ah
js 0x14000e378
invalid
mov dword [rsp + 0x30], 0x70
lea rax, [rsp + 0x34]
mov rdi, rax
xor eax, eax
mov ecx, 0x6c
rep stosb byte [rdi], al
mov eax, 0x72
mov word [rsp + 0x20], ax
mov eax, 0x75
mov word [rsp + 0x22], ax
mov eax, 0x6e
mov word [rsp + 0x24], ax
mov eax, 0x61
mov word [rsp + 0x26], ax
mov eax, 0x73
mov word [rsp + 0x28], ax
xor eax, eax
mov word [rsp + 0x2a], ax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x60], 1
xor eax, eax
test eax, eax
je 0x14000e7f0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop rsi
pop rbx
ret
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x2b0
pop rdi
ret