Function at 0x140002830
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x238
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1b0], 0xfffffffffffffffe
mov r15, rcx
xorps xmm0, xmm0
movaps xmmword [rbp + 0x60], xmm0
movaps xmmword [rbp + 0x50], xmm0
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x70], 0
movaps xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], 0
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
lea rcx, [0x1400a2c44]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400028e9
mov rsi, qword [sym.imp.KERNEL32.dll_Sleep]
nop word cs:[rax + rax]
nop
mov ecx, 0x3e8
call rsi
jmp 0x1400028e0
movabs rax, 0x6c642e3233696467
mov qword [rbp + 0x148], rax
mov word [rbp + 0x150], 0x6c
movabs rax, 0x72656e774f7463
mov qword [rbp + 0x11f], rax
movabs rax, 0x63656a624f746553
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0x118]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140002959
mov rsi, qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov ecx, 0x3e8
call rsi
jmp 0x140002950
lea rdx, [0x140111409]
lea rcx, [rbp + 0xb8]
call fcn.1400037c0
lea rdx, [0x140112017]
lea rcx, [rbp + 0x128]
call fcn.1400037c0
lea rcx, [0x140155320]
lea rbx, [rbp + 0xb8]
mov rdx, rbx
call fcn.1400039b0
lea rdx, [0x14011dee1]
mov rcx, rax
call fcn.140003b80
lea rdi, [rbp + 0x128]
mov rcx, rax
mov rdx, rdi
call fcn.1400039b0
lea rdx, [0x1400a2c50]
mov rcx, rax
call fcn.140003b80
mov r14, rax
mov eax, 0xc3e48b3b
nop dword [rax]
cmp eax, 0xc3e48b3b
je 0x1400029e0
cmp eax, 0x1effa19e
jne 0x1400029d0
jmp 0x1400029e7
mov eax, 0x1effa19e
jmp 0x1400029d0
mov qword [rbp + 0x170], rdi
mov rax, qword [rbp + 0x170]
mov ecx, 0x2d9e6757
nop word [rax + rax]
cmp ecx, 0x2d9e6757
je 0x140002a12
cmp ecx, 0x6f524936
jne 0x140002a00
jmp 0x140002a19
mov ecx, 0x6f524936
jmp 0x140002a00
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x180]
mov edx, 0xa32c697b
lea rax, [rbp + 0x108]
lea rcx, [rbp + 0xf8]
xorps xmm0, xmm0
nop dword [rax]
cmp edx, 0xa32c697b
je 0x140002a52
cmp edx, 0x8fd72d6c
jne 0x140002a40
jmp 0x140002ac6
mov qword [rbp + 0x170], rcx
mov edx, 0x45466497
jmp 0x140002a80
mov qword [rbp + 0x180], rdx
mov rdx, qword [rbp + 0x180]
mov qword [rdx], 0
mov edx, 0x96ce4060
nop word [rax + rax]
cmp edx, 0x96ce4060
je 0x140002ab9
cmp edx, 0x45466497
jne 0x140002a80
mov rdx, qword [rbp + 0x170]
mov edi, 0xfea8605f
nop dword [rax]
cmp edi, 0xfea8605f
je 0x140002ab2
cmp edi, 0x3963043f
jne 0x140002aa0
jmp 0x140002a60
mov edi, 0x3963043f
jmp 0x140002aa0
movups xmmword [rax], xmm0
mov edx, 0x8fd72d6c
jmp 0x140002a40
mov eax, 0x9ed97e8d
nop dword [rax + rax]
cmp eax, 0x46ccd845
je 0x140002ae5
cmp eax, 0x9ed97e8d
jne 0x140002ad0
mov eax, 0x46ccd845
jmp 0x140002ad0
lea rcx, [rbp + 0xf8]
lea rdx, [rbp + 0x128]
call fcn.1400060b0
mov eax, 0xc3e48b3b
nop dword [rax]
cmp eax, 0xc3e48b3b
je 0x140002b10
cmp eax, 0x1effa19e
jne 0x140002b00
jmp 0x140002b17
mov eax, 0x1effa19e
jmp 0x140002b00
mov qword [rbp + 0x170], rbx
mov rax, qword [rbp + 0x170]
mov ecx, 0x2d9e6757
nop word [rax + rax]
cmp ecx, 0x2d9e6757
je 0x140002b42
cmp ecx, 0x6f524936
jne 0x140002b30
jmp 0x140002b49
mov ecx, 0x6f524936
jmp 0x140002b30
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x180]
mov edx, 0xa32c697b
lea rax, [rbp + 0xe8]
lea rcx, [rbp + 0xd8]
xorps xmm0, xmm0
nop dword [rax]
cmp edx, 0xa32c697b
je 0x140002b82
cmp edx, 0x8fd72d6c
jne 0x140002b70
jmp 0x140002bf6
mov qword [rbp + 0x170], rcx
mov edx, 0x45466497
jmp 0x140002bb0
mov qword [rbp + 0x180], rdx
mov rdx, qword [rbp + 0x180]
mov qword [rdx], 0
mov edx, 0x96ce4060
nop word [rax + rax]
cmp edx, 0x96ce4060
je 0x140002be9
cmp edx, 0x45466497
jne 0x140002bb0
mov rdx, qword [rbp + 0x170]
mov ebx, 0xfea8605f
nop dword [rax]
cmp ebx, 0xfea8605f
je 0x140002be2
cmp ebx, 0x3963043f
jne 0x140002bd0
jmp 0x140002b90
mov ebx, 0x3963043f
jmp 0x140002bd0
movups xmmword [rax], xmm0
mov edx, 0x8fd72d6c
jmp 0x140002b70
mov eax, 0x9ed97e8d
nop dword [rax + rax]
cmp eax, 0x46ccd845
je 0x140002c15
cmp eax, 0x9ed97e8d
jne 0x140002c00
mov eax, 0x46ccd845
jmp 0x140002c00
lea rcx, [rbp + 0xd8]
lea rdx, [rbp + 0xb8]
call fcn.1400060b0
lea rcx, [rbp + 0x180]
lea rdx, [rbp + 0xd8]
lea r8, [rbp + 0xf8]
call fcn.140024360
lea rdx, [rbp + 0x180]
mov rcx, r14
call fcn.1400039b0
mov rdi, rax
mov eax, 0xb13e0fc5
lea r14, [rbp + 0x170]
cmp eax, 0xf46a805
je 0x140002dbd
cmp eax, 0xb13e0fc5
jne 0x140002c60
mov qword [rbp + 0x160], rdi
mov rax, qword [rbp + 0x160]
mov rax, qword [rax]
add rax, 4
mov qword [rbp + 0x158], rax
mov esi, 0x1703ad1d
nop word cs:[rax + rax]
nop dword [rax]
cmp esi, 0xe911bc22
je 0x140002dab
cmp esi, 0x1703ad1d
jne 0x140002ca0
mov rax, qword [rbp + 0x158]
movsxd rbx, dword [rax]
mov rsi, qword [rbp + 0x160]
add rbx, 0x40
mov eax, 0xe9f7ca8b
nop
cmp eax, 0x770b0ed3
je 0x140002d34
cmp eax, 0xe9f7ca8b
jne 0x140002cd0
mov rax, qword [rsi + rbx]
mov ecx, 0x4cc5b1ff
nop word [rax + rax]
cmp ecx, 0x44830642
je 0x140002d20
cmp ecx, 0x4cc5b1ff
jne 0x140002cf0
mov rcx, qword [rax + 8]
mov qword [rbp + 0x168], rcx
mov rcx, qword [rbp + 0x168]
mov qword [rbp + 0x178], rcx
mov ecx, 0x44830642
jmp 0x140002cf0
mov rcx, qword [rbp + 0x168]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, 0x770b0ed3
jmp 0x140002cd0
mov rcx, r14
call fcn.14000bdd0
mov rbx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0x40]
mov qword [rbp + 0x168], rax
mov eax, 0x7458fd92
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x8bb32f6c
je 0x140002d89
cmp eax, 0x7458fd92
jne 0x140002d60
mov rax, qword [rbp + 0x168]
mov rcx, rbx
mov dl, 0xa
call rax
mov byte [rbp + 0x1af], al
mov eax, 0x8bb32f6c
jmp 0x140002d60
mov bl, byte [rbp + 0x1af]
mov rcx, r14
call fcn.14000bfc0
mov esi, 0xe911bc22
mov rcx, rdi
mov edx, ebx
call fcn.14000ba20
jmp 0x140002ca0
mov rcx, rdi
call fcn.140008a10
mov eax, 0xf46a805
jmp 0x140002c60
mov qword [rbp + 0x170], rdi
mov rax, qword [rbp + 0x170]
mov eax, 0xaa1db4e0
lea rdi, [rbp + 0x180]
nop word [rax + rax]
cmp eax, 0x474cb0c6
je 0x140002dfd
cmp eax, 0xaa1db4e0
jne 0x140002de0
mov rcx, rdi
call fcn.140005ce0
mov eax, 0x474cb0c6
jmp 0x140002de0
mov eax, 0x7f12af15
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x88768b9
je 0x140002e5c
cmp eax, 0x7f12af15
jne 0x140002e10
mov eax, 0x2591ae7b
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x2591ae7b
je 0x140002e40
cmp eax, 0x9b2075ae
jne 0x140002e30
jmp 0x140002e47
mov eax, 0x9b2075ae
jmp 0x140002e30
mov qword [rbp + 0x170], rdi
mov rax, qword [rbp + 0x170]
mov eax, 0x88768b9
jmp 0x140002e10
mov dword [rbp + 0x168], 0
mov ecx, 0x66
mov edx, 0x58
call fcn.1400250e0
mov dword [rbp + 0x168], 0x568bd
lea rcx, str.05687fe8_eb00_0000_7326_9668a51fe57a
lea r8, [rbp + 0x168]
mov edx, 0x568b
call fcn.1400251e0
mov edx, dword [rbp + 0x168]
mov rcx, rax
call fcn.140025f60
mov rdi, rax
test rax, rax
je 0x14000333c
lea rdx, [0x1400d4371]
lea rcx, [rbp + 0x80]
call fcn.1400037c0
lea rdx, [0x1400aeef6]
lea rcx, [rbp - 0x10]
call fcn.1400037c0
lea rcx, [rbp + 0x158]
lea rdx, [rbp - 0x30]
lea r8, [rbp - 0x10]
lea r9, [rbp + 0x80]
call fcn.140025f90
mov eax, 0xaa1db4e0
lea rbx, [rbp - 0x30]
nop dword [rax + rax]
cmp eax, 0x474cb0c6
je 0x140002f1d
cmp eax, 0xaa1db4e0
jne 0x140002f00
mov rcx, rbx
call fcn.140005ce0
mov eax, 0x474cb0c6
jmp 0x140002f00
mov eax, 0x7f12af15
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x88768b9
je 0x140002f7c
cmp eax, 0x7f12af15
jne 0x140002f30
mov eax, 0x2591ae7b
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x2591ae7b
je 0x140002f60
cmp eax, 0x9b2075ae
jne 0x140002f50
jmp 0x140002f67
mov eax, 0x9b2075ae
jmp 0x140002f50
mov qword [rbp + 0x180], rbx
mov rax, qword [rbp + 0x180]
mov eax, 0x88768b9
jmp 0x140002f30
mov rcx, rdi
call fcn.140027720
mov rcx, r15
call fcn.1400043a0
mov rax, qword [0x14004e02c]
mov qword [rbp + 0x190], rax
movups xmm0, xmmword [str.I_understand_Unions_]
movaps xmmword [rbp + 0x180], xmm0
lea rcx, [0x1400a2c48]
call fcn.140002020
movsx edx, byte [rbp + 0x180]
lea rdi, str._c_
mov rcx, rdi
call fcn.140002020
movsx edx, byte [rbp + 0x181]
mov rcx, rdi
call fcn.140002020
movsx edx, byte [rbp + 0x182]
mov rcx, rdi
call fcn.140002020
movsx edx, byte [rbp + 0x183]
mov rcx, rdi
call fcn.140002020
movsx edx, byte [rbp + 0x184]
mov rcx, rdi
call fcn.140002020
movsx edx, byte [rbp + 0x185]
mov rcx, rdi
call fcn.140002020
movsx edx, byte [rbp + 0x186]
mov rcx, rdi
call fcn.140002020
movsx edx, byte [rbp + 0x187]
mov rcx, rdi
call fcn.140002020
movsx edx, byte [rbp + 0x188]
mov rcx, rdi
call fcn.140002020
movsx edx, byte [rbp + 0x189]
mov rcx, rdi
call fcn.140002020
movsx edx, byte [rbp + 0x18a]
mov rcx, rdi
call fcn.140002020
movsx edx, byte [rbp + 0x18b]
mov rcx, rdi
call fcn.140002020
movsx edx, byte [rbp + 0x18c]
mov rcx, rdi
call fcn.140002020
movsx edx, byte [rbp + 0x18d]
mov rcx, rdi
call fcn.140002020
movsx edx, byte [rbp + 0x18e]
mov rcx, rdi
call fcn.140002020
movsx edx, byte [rbp + 0x18f]
mov rcx, rdi
call fcn.140002020
movsx edx, byte [rbp + 0x190]
mov rcx, rdi
call fcn.140002020
movsx edx, byte [rbp + 0x191]
mov rcx, rdi
call fcn.140002020
movsx edx, byte [rbp + 0x192]
mov rcx, rdi
call fcn.140002020
movsx edx, byte [rbp + 0x193]
lea rcx, str._c__n
call fcn.140002020
lea rcx, [0x14011e0ea]
lea rdx, [rbp + 0x180]
call fcn.140002020
mov word [rsp + 0x20], 4
lea r9, [0x14011dee3]
mov rcx, r15
mov edx, 0xa
mov r8d, 0xa
call fcn.1400026c0
mov word [rsp + 0x20], 4
lea r9, str._____________________________________
mov rcx, r15
mov edx, 0xa
mov r8d, 0xb
call fcn.1400026c0
mov word [rsp + 0x20], 4
lea r9, str.__________1.
mov rcx, r15
mov edx, 0xa
mov r8d, 0xc
call fcn.1400026c0
mov word [rsp + 0x20], 4
lea r9, str.__________2.
mov rcx, r15
mov edx, 0xa
mov r8d, 0xd
call fcn.1400026c0
mov word [rsp + 0x20], 4
lea r9, str.__________3.
mov rcx, r15
mov edx, 0xa
mov r8d, 0xe
call fcn.1400026c0
mov word [rsp + 0x20], 4
lea r9, str.__________4.
mov rcx, r15
mov edx, 0xa
mov r8d, 0xf
call fcn.1400026c0
mov word [rsp + 0x20], 4
lea r9, str._____________________________________
mov rcx, r15
mov edx, 0xa
mov r8d, 0x10
call fcn.1400026c0
mov word [rsp + 0x20], 4
lea r9, [0x14011dee3]
mov rcx, r15
mov edx, 0xa
mov r8d, 0x11
call fcn.1400026c0
mov eax, 0xaa1db4e0
lea rsi, [rbp + 0x128]
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x474cb0c6
je 0x14000323d
cmp eax, 0xaa1db4e0
jne 0x140003220
mov rcx, rsi
call fcn.140005ce0
mov eax, 0x474cb0c6
jmp 0x140003220
mov eax, 0x7f12af15
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x88768b9
je 0x14000329c
cmp eax, 0x7f12af15
jne 0x140003250
mov eax, 0x2591ae7b
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x2591ae7b
je 0x140003280
cmp eax, 0x9b2075ae
jne 0x140003270
jmp 0x140003287
mov eax, 0x9b2075ae
jmp 0x140003270
mov qword [rbp + 0x180], rsi
mov rax, qword [rbp + 0x180]
mov eax, 0x88768b9
jmp 0x140003250
mov eax, 0xaa1db4e0
lea rsi, [rbp + 0xb8]
nop dword [rax + rax]
cmp eax, 0x474cb0c6
je 0x1400032cd
cmp eax, 0xaa1db4e0
jne 0x1400032b0
mov rcx, rsi
call fcn.140005ce0
mov eax, 0x474cb0c6
jmp 0x1400032b0
mov eax, 0x7f12af15
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x88768b9
je 0x14000332c
cmp eax, 0x7f12af15
jne 0x1400032e0
mov eax, 0x2591ae7b
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x2591ae7b
je 0x140003310
cmp eax, 0x9b2075ae
jne 0x140003300
jmp 0x140003317
mov eax, 0x9b2075ae
jmp 0x140003300
mov qword [rbp + 0x128], rsi
mov rax, qword [rbp + 0x128]
mov eax, 0x88768b9
jmp 0x1400032e0
add rsp, 0x238
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov ecx, 1
call fcn.14002fbe4
int3