Function at 0x140055bc0
Capabilities:
Create process on windows
Resume thread
Self delete
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa10]
sub rsp, 0xb10
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rbp + 0xa08], rax
xor edi, edi
mov r15, r8
mov r13, rdx
mov dword [rsp + 0x78], edi
mov r14, rcx
xor edx, edx
lea rcx, [rbp - 0x50]
mov esi, edi
lea r8d, [rdi + 0x70]
call fcn.140113400
cmp qword [0x14017afb0], rsi
mov dword [rbp - 0x50], 0x70
je 0x140055c32
cmp qword [0x14017afa8], rsi
je 0x140055c32
cmp qword [0x14017afb8], rsi
jne 0x140055c87
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1401517a0]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UpdateProcThreadAttribute
mov rcx, rbx
mov qword [0x14017afb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DeleteProcThreadAttributeList
mov rcx, rbx
mov qword [0x14017afa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14017afb8], rax
cmp dword [r15 + 0x2c], 1
mov ebx, edi
mov rax, qword [r15 + 0x38]
sete r12b
cmp qword [r15 + 0x30], rax
je 0x140055e44
sub rax, qword [r15 + 0x30]
sar rax, 3
cmp rax, 0x1fffffff
jbe 0x140055cd6
xor edx, edx
mov qword [r14], rdi
mov rcx, r14
call fcn.140033814
mov byte [r14 + 8], bl
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
jne 0x140056653
int3
mov rbx, qword [r15 + 0x30]
mov rdi, qword [r15 + 0x38]
cmp rbx, rdi
je 0x140055d6b
lea r12, str..._.._base_process_launch_win.cc
nop
mov rcx, qword [rbx]
mov edx, 1
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x140055d50
or esi, 2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp + 0x30]
mov dword [rbp + 0x28], 3
mov dword [rbp + 0x20], eax
call fcn.140069110
mov qword [rbp + 0x120], r12
mov dword [rbp + 0x128], 0xe6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0xe6
lea rcx, [rbp + 0x28]
mov rdx, r12
mov dword [rbp + 0x12c], eax
call fcn.140068670
test sil, 2
je 0x140055d62
and esi, 0xfffffffd
lea rcx, [rbp + 0x20]
call fcn.140068d80
add rbx, 8
cmp rbx, rdi
jne 0x140055cf0
xor edi, edi
cmp dword [rbp - 0x50], 0x70
jne 0x140055dc9
cmp qword [rbp + 0x18], rdi
jne 0x140055dc9
lea r9, [rsp + 0x78]
mov qword [rsp + 0x78], rdi
xor r8d, r8d
lea edx, [rdi + 1]
xor ecx, ecx
call qword [0x14017afb0]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140055dc9
call fcn.140111e80
lea r9, [rsp + 0x78]
mov qword [rbp + 0x18], rax
xor r8d, r8d
lea edx, [rdi + 1]
mov rcx, rax
call qword [0x14017afb0]
mov rcx, qword [rbp + 0x18]
test eax, eax
jne 0x140055df2
call fcn.140111880
mov qword [rbp + 0x18], rdi
test sil, 4
je 0x140055ddb
lea rcx, [rbp + 0x348]
call fcn.140068d80
xor edx, edx
mov qword [r14], rdi
mov rcx, r14
call fcn.140033814
mov byte [r14 + 8], 0
jmp 0x140055cc1
mov rax, qword [r15 + 0x38]
sub rax, qword [r15 + 0x30]
sar rax, 3
test rcx, rcx
je 0x140055edc
mov r9, qword [r15 + 0x30]
lea edx, [rax*8]
mov qword [rsp + 0x30], rdi
mov r8d, 0x20002
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdx
xor edx, edx
call qword [0x14017afa8]
test eax, eax
setne al
test al, al
je 0x140055edc
mov r12b, 1
mov ebx, 0x80000
cmp byte [r15 + 0x50], 0
lea rax, [0x140155fdc]
mov dword [rbp - 0x14], 1
cmove rax, qword [rbp - 0x40]
cmp byte [r15 + 0x28], 0
mov qword [rbp - 0x40], rax
mov eax, edi
sete al
mov word [rbp - 0x10], ax
mov rax, qword [r15 + 0x60]
test rax, rax
jne 0x140055e83
cmp qword [r15 + 0x68], rax
jne 0x140055e83
cmp qword [r15 + 0x70], rax
je 0x140055e9e
mov qword [rbp], rax
mov rax, qword [r15 + 0x68]
mov qword [rbp + 8], rax
mov rax, qword [r15 + 0x70]
mov qword [rbp + 0x10], rax
mov dword [rbp - 0x14], 0x101
cmp qword [r15 + 0x58], 0
je 0x140055eb6
or ebx, 4
call fcn.140070410
cmp dword [rax], 5
jge 0x140055eb6
bts ebx, 0x18
mov edi, ebx
bts edi, 0x18
cmp byte [r15 + 0x78], 0
cmove edi, ebx
xor eax, eax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
cmp qword [r15 + 0x18], rax
jne 0x140055f04
mov ebx, eax
jmp 0x140055f12
test sil, 8
je 0x140055eee
lea rcx, [rbp + 0x238]
call fcn.140068d80
xor edx, edx
mov qword [r14], rdi
mov rcx, r14
call fcn.140033814
mov byte [r14 + 8], dil
jmp 0x140055cc1
cmp qword [r15 + 0x20], 8
lea rbx, [r15 + 8]
jb 0x140055f12
mov rbx, qword [rbx]
or r9, 0xffffffffffffffff
mov qword [rbp + 0x9c0], 7
xor r8d, r8d
mov qword [rbp + 0x9b8], rax
mov rdx, r13
mov word [rbp + 0x9a8], ax
lea rcx, [rbp + 0x9a8]
call fcn.140029d5c
mov rdx, qword [r15 + 0x48]
test rdx, rdx
je 0x140056195
xor r8d, r8d
mov qword [rbp - 0x70], 0
lea rcx, [rbp - 0x70]
bts edi, 0xa
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
jne 0x14005601f
test sil, 0x10
je 0x140055f81
lea rcx, [rbp + 0x458]
call fcn.140068d80
xor ebx, ebx
xor edx, edx
mov rcx, r14
mov qword [r14], rbx
call fcn.140033814
mov byte [r14 + 8], bl
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
jne 0x140055fa0
int3
mov rax, qword [rbp + 0x9c0]
cmp rax, 8
jb 0x14005600c
mov rcx, qword [rbp + 0x9a8]
lea rdx, [rax + 1]
movabs rax, 0x7fffffffffffffff
cmp rdx, rax
ja 0x140056698
lea rax, [rdx + rdx]
cmp rax, 0x1000
jb 0x140056007
test cl, 0x1f
jne 0x14005669e
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400566a4
sub rcx, rax
cmp rcx, 8
jb 0x1400566aa
cmp rcx, 0x27
ja 0x1400566b0
mov rcx, rax
call fcn.140111e78
mov qword [rbp + 0x9b8], rbx
mov word [rbp + 0x9a8], bx
jmp 0x140056648
cmp qword [rbp + 0x9c0], 8
lea rax, [rbp - 0x68]
mov qword [rsp + 0x50], rax
lea r8, [rbp + 0x9a8]
cmovae r8, qword [rbp + 0x9a8]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov rax, qword [rbp - 0x70]
xor edx, edx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
movzx ecx, r12b
xor r12d, r12d
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], ecx
mov rcx, qword [r15 + 0x48]
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov rcx, qword [rbp - 0x70]
mov ebx, eax
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
test ebx, ebx
jne 0x1400562f5
test sil, 0x40
je 0x1400560a2
and esi, 0xffffffbf
lea rcx, [rbp + 0x568]
call fcn.140068d80
test sil, 0x20
je 0x140056107
mov rax, qword [rbp + 0x9e0]
cmp rax, 0x10
jb 0x1400560fc
mov rcx, qword [rbp + 0x9c8]
inc rax
cmp rax, 0x1000
jb 0x1400560f7
test cl, 0x1f
jne 0x1400566b6
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400566bc
sub rcx, rax
cmp rcx, 8
jb 0x1400566c2
cmp rcx, 0x27
ja 0x1400566c8
mov rcx, rax
call fcn.140111e78
mov qword [rbp + 0x9e0], 0xf
xor edx, edx
mov qword [r14], r12
mov rcx, r14
call fcn.140033814
mov byte [r14 + 8], r12b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
jne 0x140056124
int3
mov rax, qword [rbp + 0x9c0]
cmp rax, 8
jb 0x140056639
mov rcx, qword [rbp + 0x9a8]
lea rdx, [rax + 1]
movabs rax, 0x7fffffffffffffff
cmp rdx, rax
ja 0x1400566ce
lea rax, [rdx + rdx]
cmp rax, 0x1000
jb 0x140056634
test cl, 0x1f
jne 0x1400566d4
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400566da
sub rcx, rax
cmp rcx, 8
jb 0x1400566e0
cmp rcx, 0x27
jbe 0x140056631
jmp 0x1400566e6
cmp qword [rbp + 0x9c0], 8
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x48], rcx
lea rdx, [rbp + 0x9a8]
cmovae rdx, qword [rbp + 0x9a8]
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x40], rcx
xor r9d, r9d
movzx eax, r12b
xor r8d, r8d
mov qword [rsp + 0x38], rbx
xor r12d, r12d
mov qword [rsp + 0x30], r12
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400562f5
bt esi, 8
jae 0x140056203
btr esi, 8
lea rcx, [rbp + 0x678]
call fcn.140068d80
test sil, sil
jns 0x140056267
mov rax, qword [rbp + 0xa00]
cmp rax, 0x10
jb 0x14005625c
mov rcx, qword [rbp + 0x9e8]
inc rax
cmp rax, 0x1000
jb 0x140056257
test cl, 0x1f
jne 0x1400566ec
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400566f2
sub rcx, rax
cmp rcx, 8
jb 0x1400566f8
cmp rcx, 0x27
ja 0x1400566fe
mov rcx, rax
call fcn.140111e78
mov qword [rbp + 0xa00], 0xf
xor edx, edx
mov qword [r14], r12
mov rcx, r14
call fcn.140033814
mov byte [r14 + 8], r12b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test rax, rax
jne 0x140056284
int3
mov rax, qword [rbp + 0x9c0]
cmp rax, 8
jb 0x140056639
mov rcx, qword [rbp + 0x9a8]
lea rdx, [rax + 1]
movabs rax, 0x7fffffffffffffff
cmp rdx, rax
ja 0x140056704
lea rax, [rdx + rdx]
cmp rax, 0x1000
jb 0x140056634
test cl, 0x1f
jne 0x14005670a
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140056710
sub rcx, rax
cmp rcx, 8
jb 0x140056716
cmp rcx, 0x27
jbe 0x140056631
jmp 0x14005671c
mov rdx, qword [rbp - 0x68]
lea rcx, [rsp + 0x60]
xorps xmm0, xmm0
mov qword [rsp + 0x70], 0
movdqu xmmword [rsp + 0x60], xmm0
call fcn.140033814
mov rdx, qword [rbp - 0x60]
lea rcx, [rsp + 0x68]
call fcn.140033814
mov eax, dword [rbp - 0x58]
mov rcx, qword [r15 + 0x58]
mov dword [rsp + 0x70], eax
mov eax, dword [rbp - 0x54]
mov dword [rsp + 0x74], eax
test rcx, rcx
je 0x1400564fa
mov rdx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x1400564ef
bt esi, 9
jae 0x140056367
btr esi, 9
lea rcx, [rbp + 0x130]
call fcn.140068220
lea rcx, [rsp + 0x60]
call fcn.140077b80
mov rdx, rax
mov qword [rbp - 0x80], r12
lea rcx, [rbp - 0x80]
mov rbx, rax
call fcn.140033814
mov byte [rbp - 0x78], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rbx, rax
jne 0x140056394
int3
cmp byte [rbp - 0x78], 0
je 0x1400563a2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x1400563a6
mov rax, qword [rbp - 0x80]
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne al
test al, al
je 0x140056429
cmp byte [rbp - 0x78], 0
je 0x1400563cb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x1400563cf
mov rax, qword [rbp - 0x80]
mov edx, 0xea60
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400563f3
bt esi, 0xa
jae 0x1400563f3
lea rcx, [rbp + 0x788]
call fcn.140068d80
cmp byte [rbp - 0x78], 0
je 0x140056401
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x140056405
mov rax, qword [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov rcx, qword [0x14017c138]
test rcx, rcx
je 0x14005643b
mov r8d, 1
mov edx, eax
call fcn.14007b1b0
jmp 0x14005643b
bt esi, 0xb
jae 0x14005643b
lea rcx, [rbp + 0x898]
call fcn.140068d80
xor edx, edx
mov rcx, r14
call fcn.14004dd90
lea rcx, [rbp - 0x80]
call fcn.1400337b0
lea rcx, [rsp + 0x60]
call fcn.1400337b0
lea rcx, [rsp + 0x68]
call fcn.1400337b0
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x70], 0
call fcn.1400337b0
lea rcx, [rsp + 0x60]
call fcn.1400337b0
mov rdx, qword [rbp + 0x9c0]
cmp rdx, 8
jb 0x140056639
mov rcx, qword [rbp + 0x9a8]
inc rdx
movabs rax, 0x7fffffffffffffff
cmp rdx, rax
ja 0x140056722
lea rax, [rdx + rdx]
cmp rax, 0x1000
jb 0x140056634
test cl, 0x1f
jne 0x140056728
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14005672e
sub rcx, rax
cmp rcx, 8
jb 0x140056734
cmp rcx, 0x27
jbe 0x140056631
jmp 0x14005673a
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp byte [r15], 0
je 0x14005650e
mov rcx, qword [rsp + 0x60]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x14017c138]
test rcx, rcx
je 0x140056526
mov edx, dword [rsp + 0x70]
mov r8, r13
call fcn.14007aed0
mov rbx, qword [rsp + 0x60]
mov dword [rsp + 0x70], r12d
mov qword [rsp + 0x60], r12
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14005657d
call fcn.14006b020
mov rcx, qword [0x14017c0e0]
mov rdi, rax
mov rsi, qword [rbp + 0xa48]
test rcx, rcx
jne 0x140056566
call fcn.14006da40
mov rcx, qword [0x14017c0e0]
mov r10, qword [rcx]
lea r8, [rsp + 0x60]
mov r9, rsi
mov qword [rsp + 0x20], rdi
mov rdx, rbx
call qword [r10 + 0x10]
mov rdx, rbx
mov qword [r14], r12
mov rcx, r14
call fcn.140033814
mov byte [r14 + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rbx, rax
jne 0x14005659c
int3
lea rcx, [rsp + 0x60]
call fcn.1400337b0
lea rcx, [rsp + 0x68]
call fcn.1400337b0
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x70], 0
call fcn.1400337b0
lea rcx, [rsp + 0x60]
call fcn.1400337b0
mov rax, qword [rbp + 0x9c0]
cmp rax, 8
jb 0x140056639
mov rcx, qword [rbp + 0x9a8]
lea rdx, [rax + 1]
movabs rax, 0x7fffffffffffffff
cmp rdx, rax
ja 0x140056740
lea rax, [rdx + rdx]
cmp rax, 0x1000
jb 0x140056634
test cl, 0x1f
jne 0x140056746
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14005674c
sub rcx, rax
cmp rcx, 8
jb 0x140056752
cmp rcx, 0x27
ja 0x140056758
mov rcx, rax
call fcn.140111e78
mov word [rbp + 0x9a8], r12w
mov qword [rbp + 0x9b8], r12
mov qword [rbp + 0x9c0], 7
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x14005666b
call qword [0x14017afb8]
mov rcx, qword [rbp + 0x18]
call fcn.140111880
mov rax, r14
mov rcx, qword [rbp + 0xa08]
xor rcx, rsp
call fcn.140111850
mov rbx, qword [rsp + 0xb68]
add rsp, 0xb10
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3