Function at 0x140002030
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x140098080]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov r15, rcx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
lea rcx, [rsp + 0x70]
call fcn.140001b50
nop
movzx eax, byte [rbp - 0x70]
test al, al
jne 0x140002090
mov esi, 1
jmp 0x140002b0d
lea rdx, [rsp + 0x70]
lea rcx, str.App_use_wsudo_bridge:__s
call fcn.1400036b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x14008ea00]
movdqu xmmword [rbp + 0x20], xmm1
mov word [rbp + 0x10], r13w
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
lea rax, str.__parent
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 8
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140002e90
lea rdx, [rbp + 0xc0]
mov ecx, edi
call fcn.1400011d0
lea rcx, [rbp + 0xc0]
sub rax, rcx
sar rax, 1
lea rcx, [rbp + 0xc0]
mov qword [rbp + 0xb0], rcx
mov qword [rbp + 0xb8], rax
movaps xmm0, xmmword [rbp + 0xb0]
movaps xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140002e90
lea rcx, [rbp + 0x70]
call fcn.140001910
nop
cmp qword [rbp + 0x80], 0
je 0x1400021c7
lea rax, str.__pwd
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 5
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140002e90
lea rax, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova rax, qword [rbp + 0x70]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x80]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140002e90
movzx edx, byte [r15 + 0x131]
lea rcx, [rbp + 0xb0]
call fcn.1400034f0
mov qword [rsp + 0x68], 0xa
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], r13w
mov dword [rsp + 0x30], 4
mov rdx, qword [rbp + 0xb8]
add rdx, 0xa
jne 0x14000221d
mov qword [rbp + 0x40], rdx
mov word [rbp + rdx*2 + 0x30], r13w
jmp 0x140002255
cmp rdx, 7
ja 0x14000223d
mov qword [rbp + 0x40], rdx
movzx eax, r13w
lea rdi, [rbp + 0x30]
mov rcx, rdx
rep stosw word [rdi], ax
mov word [rbp + rdx*2 + 0x30], r13w
jmp 0x140002255
mov word [rsp + 0x20], r13w
mov r9, rdx
movzx r8d, byte [rsp + 0x50]
lea rcx, [rbp + 0x30]
call fcn.140003d10
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova rcx, qword [rbp + 0x30]
movups xmm0, xmmword [str.__visible]
movups xmmword [rcx], xmm0
mov eax, dword [0x140066830]
mov dword [rcx + 0x10], eax
add rcx, 0x14
mov r8, qword [rbp + 0xb8]
test r8, r8
je 0x140002296
add r8, r8
mov rdx, qword [rbp + 0xb0]
call fcn.140056950
nop
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova rax, qword [rbp + 0x30]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140002e90
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x140002310
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000230b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002b86
call fcn.14003bb8c
mov ecx, 2
call fcn.1400415a8
mov rcx, rax
call fcn.14004912c
mov ecx, eax
call fcn.1400490b4
mov dword [rsp + 0x30], r13d
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
cmp eax, 1
jne 0x14000237a
cmp dword [rsp + 0x30], 0
je 0x14000237a
lea rax, str.__attach
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 8
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140002e90
mov r14d, 6
cmp byte [r15 + 0x135], 0
jne 0x1400023d6
cmp byte [r15 + 0x134], 0
jne 0x1400023a8
cmp byte [r15 + 0x136], 0
je 0x1400023d6
cmp byte [r15 + 0x131], 0
jne 0x1400023d6
lea rax, str.__wait
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r14
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140002e90
cmp byte [0x14009a598], 0
je 0x140002411
lea rax, str.__verbose
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 9
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140002e90
movzx ecx, byte [r15 + 0x130]
sub ecx, r14d
je 0x140002430
cmp ecx, 1
jne 0x1400024a1
lea rdi, str.trustedinstaller
jmp 0x140002437
lea rdi, [0x140066788]
lea rax, [0x140066874]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140002e90
mov qword [rsp + 0x30], rdi
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], 0
jne 0x140002475
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140002e90
cmp qword [r15 + 0xe0], 0
je 0x140002523
lea rax, str.__cwd
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 5
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140002e90
lea rcx, [r15 + 0xd0]
cmp qword [r15 + 0xe8], 7
jbe 0x1400024f5
mov rcx, qword [r15 + 0xd0]
mov rax, qword [r15 + 0xe0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140002e90
mov rbx, qword [r15 + 0x98]
mov r12, qword [r15 + 0xa0]
cmp rbx, r12
je 0x1400026ef
lea rcx, [0x14006688c]
movabs rdx, 0x7fffffffffffffff
movabs rax, 0x7ffffffffffffffe
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], r13
mov rsi, qword [rbx + 0x10]
mov r14, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140002575
mov r14, qword [rbx]
cmp rsi, rax
ja 0x140002b9e
cmp rsi, 7
ja 0x14000259d
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], 7
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x30], xmm0
jmp 0x140002637
mov rdi, rsi
or rdi, 7
cmp rdi, rax
jbe 0x1400025e8
mov rdi, rax
lea rcx, [rdx + rdx]
cmp rcx, 0x1000
jb 0x14000260c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002b98
mov rcx, rax
call fcn.14003bb50
mov rcx, rax
test rax, rax
je 0x140002b92
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002611
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, rdx
ja 0x140002b98
add rcx, rcx
jne 0x1400025b0
mov rax, r13
jmp 0x140002611
call fcn.14003bb50
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rdi
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.140056950
lea rcx, [0x14006688c]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 2
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x60], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x10]
call fcn.140002e90
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova rax, qword [rbp + 0x30]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x10]
call fcn.140002e90
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x1400026dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400026d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002b92
call fcn.14003bb8c
add rbx, 0x20
cmp rbx, r12
jne 0x14000253a
mov r14d, 6
lea rcx, [r15 + 0xb0]
cmp qword [r15 + 0xc8], 7
jbe 0x140002707
mov rcx, qword [r15 + 0xb0]
mov rax, qword [r15 + 0xc0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x10]
call fcn.140002e90
mov esi, 1
mov ebx, esi
mov rcx, qword [r15 + 0x80]
mov rax, qword [r15 + 0x88]
sub rax, rcx
sar rax, 5
cmp rax, rbx
jbe 0x1400027bd
mov edi, 0x20
nop dword [rax + rax]
lea rax, [rcx + rdi]
mov rcx, rax
cmp qword [rax + 0x18], 7
jbe 0x140002771
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x10]
call fcn.140002e90
inc rbx
add rdi, 0x20
mov rcx, qword [r15 + 0x80]
mov rax, qword [r15 + 0x88]
sub rax, rcx
sar rax, 5
cmp rbx, rax
jb 0x140002760
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
lea rax, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rax, qword [rsp + 0x70]
mov qword [rbp - 0x48], rax
lea rax, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova rax, qword [rbp + 0x10]
mov qword [rbp - 0x40], rax
lea rax, str.runas
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x60], 0x70
mov qword [rbp - 0x58], r13
mov dword [rbp - 0x30], r13d
mov dword [rbp - 0x5c], 0x40
lea rcx, [rbp - 0x60]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, esi
je 0x140002a3e
lea rbx, [0x1400665d0]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r13
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xb0]
call fcn.140001310
nop
mov ecx, 2
call fcn.1400415a8
mov rdi, rax
mov word [rbp + 0x40], r14w
lea rax, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova rax, qword [rbp + 0xb0]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
movdqa xmm1, xmmword [0x14008ea00]
movdqu xmmword [rbp + 0xa0], xmm1
mov word [rbp + 0x90], r13w
lea rax, [rbp + 0x90]
mov qword [rsp + 0x30], rax
lea rax, str.unable_create_process__s
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x18
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
mov r9, rsi
lea r8, [rbp + 0x30]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.14002c160
test al, al
jne 0x14000296a
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x68], r13
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp + 0x50]
call fcn.140003be0
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 7
jbe 0x140002980
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002963
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002b8c
call fcn.14003bb8c
jmp 0x140002980
movups xmm0, xmmword [rbp + 0x90]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rbp + 0xa0]
movups xmmword [rbp + 0x60], xmm1
lea rax, [rbp + 0x50]
cmp qword [rbp + 0x68], 7
cmova rax, qword [rbp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.14002ffa0
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x1400029f6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002ba4
call fcn.14003bb8c
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 7
jbe 0x140002a5d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002baa
call fcn.14003bb8c
jmp 0x140002a5d
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edi, eax
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
call fcn.140001670
mov esi, eax
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x140002aa0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002bb0
call fcn.14003bb8c
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], r13w
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x140002af7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002af2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002bb6
call fcn.14003bb8c
movdqa xmm0, xmmword [0x14008ea00]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], r13w
movzx eax, byte [rbp - 0x70]
test al, al
je 0x140002b4e
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x140002b4e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002b80
call fcn.14003bb8c
mov eax, esi
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.14003bb30
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140041a3c
nop
call fcn.140041a3c
nop
call fcn.140041a3c
nop
call fcn.140041a3c
int3
call fcn.140001110
int3
call fcn.1400011b0
nop
call fcn.140041a3c
nop
call fcn.140041a3c
nop
call fcn.140041a3c
nop
call fcn.140041a3c
int3