Function at 0x140005c10
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x140de80c0]
xor rax, rsp
mov qword [rbp + 0x30], rax
movzx ebx, dl
xor edi, edi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rax
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x40], 0x68
mov dword [rbp - 4], 1
mov word [rbp], di
lea rax, [0x140066d38]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0xd
mov rdx, rcx
cmp qword [rcx + 0x18], 7
jbe 0x140005ca1
mov rdx, qword [rcx]
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rax
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsp + 0x78], xmm0
movabs rax, 0xc000000000000000
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x50], 1
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.14000fe00
mov eax, ebx
shl eax, 4
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140005e28
mov rcx, qword [rbp - 0x78]
test bl, bl
jne 0x140005d68
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x50]
call fcn.140004120
mov rbx, qword [rsp + 0x50]
mov rax, rbx
movabs rcx, 0x7fffffffc46535ff
cmp rbx, rcx
jge 0x140005da2
add rbx, 0x3b9aca00
jmp 0x140005dac
movabs rbx, 0x7fffffffffffffff
mov esi, 0xff
movabs rdi, 0x4e94914f0000
movabs r14, 0x431bde82d7b634db
lea rcx, [rsp + 0x50]
call fcn.140004120
mov rax, qword [rsp + 0x50]
cmp rbx, rax
je 0x140005e28
mov ecx, 1
cmovl ecx, esi
test cl, cl
jle 0x140005e28
mov rcx, rbx
sub rcx, rax
cmp rcx, rdi
jge 0x140005e1c
mov rax, r14
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140005e13
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140005dc5
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140005dc5
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x140005e64
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e8d
call fcn.140023340
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140023320
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.14002ace8
int3