Function at 0x140007a00
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xf8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rcx + 8]
lea r15, [rax*4 + 2]
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r14, [0x140027a70]
nop word cs:[rax + rax]
mov ecx, dword [r14 + r12*4 + 0x10]
cmp ecx, eax
je 0x140007a87
mov ecx, dword [r14 + r12*4 + 0x14]
cmp ecx, eax
je 0x140007a78
mov ecx, dword [r14 + r12*4 + 0x18]
cmp ecx, eax
je 0x140007a7d
mov ecx, dword [r14 + r12*4 + 0x1c]
cmp ecx, eax
je 0x140007a83
add r12, 4
cmp r12, 0x80
jne 0x140007a40
mov eax, 0xffffffff
jmp 0x140007a8a
inc r12
jmp 0x140007a87
add r12, 2
jmp 0x140007a87
add r12, 3
mov eax, r12d
shl rax, 4
mov rcx, qword [rax + r14 + 0x218]
mov r8, qword [rax + r14 + 0x210]
add r8, rcx
add r15, rcx
mov qword [rax + r14 + 0x218], r15
lea rcx, [rsp + 0x50]
mov rdx, rbx
call fcn.140004910
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsp + 0x90], ymm0
vmovups ymmword [rsp + 0xd0], ymm0
vmovups ymmword [rsp + 0xb0], ymm0
mov qword [rsp + 0xf0], 0
mov dword [rsp + 0x90], 0x68
lea rax, [0x140019e50]
mov qword [rsp + 0xa0], rax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140007b3f
mov rax, qword [rsp + 0x58]
mov word [rcx + rax], 0
mov qword [rsp + 0xa8], rcx
vxorps xmm0, xmm0, xmm0
vmovaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdx, qword [rdi + 8]
test rdx, rdx
jne 0x140007b5b
mov word [rcx + rax], 0
jmp 0x140007ba8
vxorps xmm0, xmm0, xmm0
vmovaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x140007ba8
lea rbx, [rdx*4 + 2]
xor r15d, r15d
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop
mov ecx, dword [r14 + r15*4 + 0x10]
cmp ecx, eax
je 0x140007beb
mov ecx, dword [r14 + r15*4 + 0x14]
cmp ecx, eax
je 0x140007bdc
mov ecx, dword [r14 + r15*4 + 0x18]
cmp ecx, eax
je 0x140007be1
mov ecx, dword [r14 + r15*4 + 0x1c]
cmp ecx, eax
je 0x140007be7
add r15, 4
cmp r15, 0x80
jne 0x140007b70
mov eax, 0xffffffff
jmp 0x140007bee
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
vmovups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor edx, edx
jmp 0x140007c81
inc r15
jmp 0x140007beb
add r15, 2
jmp 0x140007beb
add r15, 3
mov eax, r15d
shl rax, 4
mov rcx, qword [rax + r14 + 0x218]
mov r8, qword [rax + r14 + 0x210]
add r8, rcx
add rbx, rcx
mov qword [rax + r14 + 0x218], rbx
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.140004910
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140007c3b
mov rax, qword [rsp + 0x88]
mov word [rdx + rax], 0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140007c50
mov rax, qword [rsp + 0x58]
mov word [rcx + rax], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r8d, r8d
xor r9d, r9d
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test rsi, rsi
je 0x140007c9d
mov rcx, qword [rsp + 0x60]
mov qword [rsi], rcx
add rsp, 0xf8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret