Function at 0x140073250
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
sub rsp, 0xe0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
movabs rdi, 0xda74bd4605f17afa
movabs rsi, 0x759d797bcb559921
movabs r14, 0xb081544aed0b0adc
movabs r15, 0xb510d32f52ad40b9
movabs r12, 0x10e90a029809ea56
movabs r13, 0x3b98adb10b79dc93
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
cmp byte [0x1401220f0], 0
jne 0x140073560
cmp byte [0x14017b991], 0
sete al
mov byte [0x14017b991], al
mov qword [rbp], rdi
test al, al
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
lea r8, [rbp + 0x20]
lea rdx, str.open
je 0x140073422
movabs rax, 0x48f6c4c6574beffe
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0xb0f2363cc37b78a8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x20], ymm1
xor r9d, r9d
xor ecx, ecx
vzeroupper
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov ecx, 0x20
call fcn.1400dfb70
mov qword [rbp + 0x20], rax
movdqa xmm0, xmmword [0x14010ff60]
movdqu xmmword [rbp + 0x30], xmm0
movups xmm0, xmmword [str.Fake_Lag_Actived_]
movups xmmword [rax], xmm0
movzx ecx, byte [0x14010f1b8]
mov byte [rax + 0x10], cl
mov byte [rax + 0x11], 0
mov r8d, 0x7d0
lea rdx, [rbp + 0x20]
call fcn.140065810
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140073418
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073413
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400738da
call fcn.1400dfdf4
mov ecx, 0x258
jmp 0x140073525
movabs rax, 0x59f6c4c6574beffe
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0xb0f2363cc37b78a8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x20], ymm1
xor r9d, r9d
xor ecx, ecx
vzeroupper
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov ecx, 0x20
call fcn.1400dfb70
mov qword [rbp + 0x20], rax
movdqa xmm0, xmmword [0x14010ff60]
movdqu xmmword [rbp + 0x30], xmm0
movups xmm0, xmmword [str.Fake_Lag_Actived_]
movups xmmword [rax], xmm0
movzx ecx, byte [0x14010f1b8]
mov byte [rax + 0x10], cl
mov byte [rax + 0x11], 0
mov r8d, 0x7d0
lea rdx, [rbp + 0x20]
call fcn.140065810
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140073520
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007351b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400738da
call fcn.1400dfdf4
mov ecx, 0x190
mov edx, 0xfa
call qword [sym.imp.KERNEL32.dll_Beep]
lea r11, [rsp + 0xe0]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x48f6c4c6574beffe
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0xb0f2363cc37b78a8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x20], ymm1
xor r9d, r9d
lea r8, [rbp + 0x20]
lea rdx, str.open
xor ecx, ecx
vzeroupper
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov ecx, 0x20
call fcn.1400dfb70
mov qword [rbp + 0x20], rax
movdqa xmm0, xmmword [0x14010ff60]
movdqu xmmword [rbp + 0x30], xmm0
movups xmm0, xmmword [str.Fake_Lag_Actived_]
movups xmmword [rax], xmm0
movzx ecx, byte [0x14010f1b8]
mov byte [rax + 0x10], cl
mov byte [rax + 0x11], 0
mov r8d, 0x7d0
lea rdx, [rbp + 0x20]
call fcn.140065810
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140073681
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007367c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400738da
call fcn.1400dfdf4
movdqa xmm0, xmmword [0x14010fef0]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
mov edx, 0xfa
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
movss xmm7, dword [0x14017af20]
lea rcx, [rbp]
call fcn.1400631f0
xorps xmm2, xmm2
cvtsi2ss xmm2, qword [rbp]
movaps xmm6, xmm2
xorps xmm0, xmm0
comiss xmm0, xmm7
ja 0x140073706
comiss xmm7, xmm0
jbe 0x1400736d0
mov al, 1
jmp 0x1400736dd
ucomiss xmm7, xmm0
jp 0x1400736db
jne 0x1400736db
xor al, al
jmp 0x1400736dd
mov al, 0x80
test al, al
jle 0x140073706
mulss xmm7, dword [0x14010fe44]
movss xmm1, dword [0x14010fe4c]
movaps xmm0, xmm1
subss xmm0, xmm7
comiss xmm0, xmm2
jbe 0x140073703
addss xmm6, xmm7
jmp 0x140073706
movaps xmm6, xmm1
movss xmm7, dword [0x14010fe48]
movss xmm8, dword [0x14010fe40]
lea rcx, [rbp]
call fcn.1400631f0
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rbp]
comiss xmm0, xmm6
ja 0x1400737a5
comiss xmm6, xmm0
jbe 0x140073737
mov al, 0xff
jmp 0x140073744
ucomiss xmm6, xmm0
jp 0x140073742
jne 0x140073742
xor al, al
jmp 0x140073744
mov al, 0x80
test al, al
jns 0x1400737a5
movaps xmm2, xmm6
subss xmm2, xmm0
comiss xmm7, xmm2
ja 0x14007377a
comiss xmm2, xmm7
jbe 0x14007375d
mov al, 1
jmp 0x14007376a
ucomiss xmm2, xmm7
jp 0x140073768
jne 0x140073768
xor al, al
jmp 0x14007376a
mov al, 0x80
test al, al
jle 0x14007377a
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140073717
movaps xmm0, xmm2
divss xmm0, xmm8
cvttss2si rcx, xmm0
xorps xmm1, xmm1
cvtsi2ss xmm1, rcx
mulss xmm1, xmm8
comiss xmm2, xmm1
jbe 0x14007379b
inc ecx
call sub.KERNEL32.dll_Sleep
jmp 0x140073717
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x59f6c4c6574beffe
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0xb0f2363cc37b78a8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x20], ymm1
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0x20]
lea rdx, str.open
xor ecx, ecx
vzeroupper
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov ecx, 0x20
call fcn.1400dfb70
mov qword [rbp + 0x20], rax
movdqa xmm0, xmmword [0x14010ff60]
movdqu xmmword [rbp + 0x30], xmm0
movups xmm0, xmmword [str.Fake_Lag_Actived_]
movups xmmword [rax], xmm0
movzx ecx, byte [0x14010f1b8]
mov byte [rax + 0x10], cl
mov byte [rax + 0x11], 0
mov r8d, 0x7d0
lea rdx, [rbp + 0x20]
call fcn.140065810
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140073520
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007351b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007351b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3