Function at 0x140003bf0
Capabilities:
Create process on windows

Disassembly:
push rdi
push rbx
sub rsp, 0x1a8
mov r9d, dword [0x14000d104]
test r9d, r9d
jne 0x140004055
nop
nop
nop
nop
nop
nop
nop
add byte [rax], al
invalid
call fcn.1400024d0
test eax, eax
jne 0x1400044df
mov r8d, dword [0x14000d104]
test r8d, r8d
jne 0x1400044be
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
or eax, 0x830f0fff
or al, 6
add al, 3
or esi, edi
invalid
lea rbx, [rsp + 0x90]
xor ecx, ecx
mov r8d, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1400048e0
mov edx, dword [0x14000d104]
test edx, edx
jne 0x1400048d5
nop
nop
nop
add byte [rax], al
xor ecx, dword [rax + rax]
push 0x20600
add byte [rax], al
add eax, 0x8048d00
or edx, eax
add cl, byte [rbx]
retf 9
add rsp, 0x1a8
pop rbx
pop rdi
ret
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0xd
mov qword [rsp + 0x24], 0
mov qword [rsp + 0x88], 0
movq xmm1, rbx
rep stosq qword [rdi], rax
lea rax, str.runas
mov dword [rsp + 0x20], 0x70
movq xmm0, rax
mov dword [rsp + 0x50], 1
mov ecx, dword [0x14000d104]
punpcklqdq xmm0, xmm1
movaps xmmword [rsp + 0x30], xmm0
test ecx, ecx
jne 0x140004d88
nop
nop
nop
nop
add dword [rsi], ecx
mov eax, dword [rsp + rcx]
and al, 0
or al, 0x6a
add byte [rdx], al
push rcx
or al, 7
xchg byte [rax + rcx], al
or ecx, dword [rdx + rax + 4]
or al, 6
add al, 0x89
add byte [0x14000495f], cl
add byte [rax], cl
add eax, 0x840f00ff
add cl, byte [rax]
add dword [rax], eax
add byte [rax], al
or byte [rbx], cl
invalid
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x140005200
mov eax, dword [0x14000d104]
test eax, eax
jne 0x1400051f5
nop
nop
nop
nop
nop
nop
nop
sub byte [rax], al
or byte [rcx + 0xe], dl
or byte [rdx + 0xa], al
or al, 0
add byte [rax], al
or dword [rsp + rax], 0xc
add ecx, dword [rbp + 0x8010b05]
or byte [rax + rax + 0xa], al
sbb byte [rdi + rcx], al
or byte [r11], al
or ecx, dword [rbp + 0xf]
or byte [rcx + 0x80c0804], cl
or eax, dword [rsi]
or byte [rbx], al
clc
femms
push rax
or byte [0x1a4045d2c], cl
or al, byte [rbx]
add byte [rax], al
add byte [rax], al
add byte [rax], al
mov esp, dword [rcx + rax + 4]
add byte [rax], r8b
mov byte [rcx], al
add al, 0x44
add byte [rax], al
and ecx, dword [0x14fefd803]
pcmpeqw mm0, qword [rax]
or al, 0x8d
add al, 0xb
cld
add eax, 0x30be806
sbb dword [rsi], ecx
or byte [rax], al
or ecx, dword [rsi]
add al, 0
add byte [rax + 0xb], ch
or al, 0xd8
add eax, 0xb0e0004
enter 0xb08, 0xffffffffffffffc3
or byte [rcx], al
rol dword [rdx], 2
adc dword [rcx], ecx
add byte [rbx], ch
add ecx, dword [rdx]
test byte [rcx + rcx], cl
je 0x140004e37
add cl, byte [rdx + 0x3010a04]
mov al, byte [rdx + rcx]
add dword [rbx], eax
or cl, byte [rax]
add dword [rbx], ecx
or byte [rcx], cl
pop rsp
add al, byte [rax + riz]
add al, 0xc
lea eax, [rsp + rcx]
and al, 5
add byte [rbx], dh
or al, 0
add eax, 0xa06c30d
add cl, byte [rsi]
or esi, esp
invalid
xor ecx, ecx
call sub.msvcrt.dll_exit
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x14000d104]
test edx, edx
jne 0x140005680
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add cl, byte [rax]
or esi, dword [rsi]
or byte [rbx], cl
add dword [r9*4 + 0x3460c00], r8d
or ebx, ecx
or byte [rbx], cl
cmp eax, 0x417080b
or dword [rax], eax
invalid
cmp eax, 0x4c7
jne 0x1400048d5
jmp 0x1400051f5