Function at 0x140001260
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push r12
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov rsi, rcx
mov qword [rbp - 0x30], rax
movaps xmmword [rbp - 0x60], xmm0
xor r12d, r12d
movups xmmword [rbp - 0x50], xmm0
mov ecx, 0xfffffff5
mov dword [rsp + 0x70], 0x68
movups xmmword [rbp - 0x80], xmm0
mov word [rbp - 0x50], r12w
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x40], xmm0
psrldq xmm0, 0xc
movd eax, xmm0
or eax, 1
mov dword [rbp - 0x54], eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff4
mov qword [rbp - 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
mov qword [rbp - 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r15, qword [rsi + 0x10]
movabs rcx, 0x7fffffffffffffff
or dword [rbp - 0x54], 0x100
mov qword [rbp - 0x40], rax
mov rax, rcx
sub rax, r15
cmp rax, 3
jb 0x1400014ec
cmp qword [rsi + 0x18], 0xf
mov qword [rsp + 0x148], rbx
mov qword [rsp + 0x150], rdi
mov qword [rsp + 0x110], r14
jbe 0x140001339
mov rsi, qword [rsi]
lea r14, [r15 + 3]
mov ebx, 0xf
lea rdi, [rbp - 0x20]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x20], xmm0
movdqu xmmword [rbp - 0x10], xmm1
cmp r14, rbx
jbe 0x1400013d4
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001396
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.140003ac0
test rax, rax
je 0x1400014ab
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400013d0
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1400013b0
mov rdi, r12
jmp 0x1400013d0
cmp rcx, 0x1000
jb 0x1400013c8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400014f2
jmp 0x140001377
call fcn.140003ac0
mov rdi, rax
mov qword [rbp - 0x20], rdi
mov r8, r15
mov qword [rbp - 0x10], r14
mov rdx, rsi
mov qword [rbp - 8], rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [0x1400054f8]
lea rdx, [rbp - 0x20]
mov word [rdi + r15], ax
movzx eax, byte [0x1400054fa]
mov byte [rdi + r15 + 2], al
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov byte [rdi + r14], r12b
cmp qword [rbp - 8], 0xf
mov qword [rsp + 0x38], r12
cmova rdx, qword [rbp - 0x20]
xor r9d, r9d
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov dword [rsp + 0x28], r12d
xor ecx, ecx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140001477
mov rcx, qword [rsp + 0x58]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x140001479
xor bl, bl
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400014b7
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400014b2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400014b2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d44
mov rdi, qword [rsp + 0x150]
movzx eax, bl
mov rbx, qword [rsp + 0x148]
mov r14, qword [rsp + 0x110]
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140003aa0
add rsp, 0x118
pop r15
pop r12
pop rsi
pop rbp
ret
call fcn.140001210
int3
call fcn.140001170
int3