Function at 0x44b540
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x2a8
lea rbp, [rsp + 0x80]
mov r13, r9
mov r15, r8
mov rbx, rdx
mov eax, ecx
and eax, 7
cmp eax, 5
jae 0x44b629
mov qword [rbp + 0x218], rcx
movsx eax, byte [rbx]
lea ecx, [rax - 0x20]
cmp eax, 0x60
cmovbe ecx, eax
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x44b593
cmp byte [rbx + 1], 0x3a
je 0x44b5bb
mov edx, 0x2f
mov rcx, rbx
call fcn.00449310
test rax, rax
jne 0x44b5bb
mov edx, 0x5c
mov rcx, rbx
call fcn.00449310
test rax, rax
je 0x44b7bf
xor r14d, r14d
mov edx, 0x5c
mov rcx, rbx
call fcn.004496b0
test rax, rax
lea rcx, [rax + 1]
cmove rcx, rbx
mov edx, 0x2e
call fcn.004496b0
mov rdi, rax
lea rsi, [rbp + 0xe0]
mov rcx, rsi
mov rdx, rbx
call fcn.0043a340
test rdi, rdi
je 0x44b63e
test r14d, r14d
je 0x44b685
lea rdx, [0x0045530a]
lea rcx, [rbp + 0xe0]
lea r8, [rbp - 0x30]
call fcn.0044b360
cmp byte [rbp - 0x30], 0
jne 0x44b6ad
jmp 0x44bb26
call fcn.00449970
mov dword [rax], 0x13
mov esi, 0xffffffff
jmp 0x44bbca
lea rcx, [rbp + 0xe0]
call fcn.0043a260
mov byte [rbp + rax + 0xe4], 0
mov dword [rbp + rax + 0xe0], 0x4558452e
test r14d, r14d
je 0x44b6e0
lea rdx, [0x0045530a]
lea rcx, [rbp + 0xe0]
lea r8, [rbp - 0x30]
call fcn.0044b360
cmp byte [rbp - 0x30], 0
jne 0x44b760
jmp 0x44b704
lea rcx, [rbp - 0x30]
lea rbx, [rbp + 0xe0]
mov rdx, rbx
call fcn.0043a340
mov edx, 4
mov rcx, rbx
call fcn.00440750
test eax, eax
jne 0x44bb26
lea rdx, [0x004552f0]
mov rcx, rdi
call fcn.00449460
test eax, eax
je 0x44badc
lea rdx, [0x004552f5]
mov rcx, rdi
call fcn.00449460
test eax, eax
jne 0x44b760
jmp 0x44badc
lea rcx, [rbp - 0x30]
lea rdi, [rbp + 0xe0]
mov rdx, rdi
call fcn.0043a340
mov edx, 4
mov rcx, rdi
call fcn.00440750
test eax, eax
je 0x44b760
lea rdi, [rbp + 0xe0]
mov rcx, rdi
mov rdx, rbx
call fcn.0043a340
mov rcx, rdi
call fcn.0043a260
test r14d, r14d
mov byte [rbp + rax + 0xe4], 0
mov dword [rbp + rax + 0xe0], 0x5441422e
je 0x44ba43
lea rdx, [0x0045530a]
lea rcx, [rbp + 0xe0]
lea r8, [rbp - 0x30]
call fcn.0044b360
cmp byte [rbp - 0x30], 0
jne 0x44badc
jmp 0x44ba67
mov rcx, qword [r15]
add r15, 8
xor edi, edi
xor edx, edx
mov r8, r15
call fcn.0044bc10
mov r14, rax
test r14, r14
je 0x44bb11
test r13, r13
je 0x44b7ba
mov r15, rdi
mov rbx, qword [r13]
test rbx, rbx
je 0x44b7cb
lea rsi, [r13 + 8]
mov edi, 1
mov rcx, rbx
nop dword [rax]
call fcn.0043a260
lea eax, [rdi + rax + 1]
movsxd rdi, eax
mov rcx, qword [rsi]
add rsi, 8
test rcx, rcx
jne 0x44b7a0
jmp 0x44b7d0
xor r15d, r15d
jmp 0x44b81e
mov r14d, dword [rbp + 0x290]
jmp 0x44b5be
mov edi, 1
mov rcx, rdi
call fcn.00434cf0
test rax, rax
lea rsi, [rbp + 0xe0]
mov rdi, r15
mov r15, rax
je 0x44b9f9
test rbx, rbx
mov rax, r15
je 0x44b81b
add r13, 8
mov rax, r15
nop dword [rax]
mov rcx, rax
mov rdx, rbx
call fcn.0043a290
inc rax
mov rbx, qword [r13]
add r13, 8
test rbx, rbx
jne 0x44b800
mov byte [rax], 0
call qword [0x00463ef0]
xorps xmm0, xmm0
movaps xmmword [rbp + 0xe0], xmm0
movaps xmmword [rbp + 0x120], xmm0
movaps xmmword [rbp + 0x130], xmm0
movaps xmmword [rbp + 0x110], xmm0
movaps xmmword [rbp + 0x100], xmm0
movaps xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x140], 0
mov dword [rbp + 0xe0], 0x68
mov word [rbp + 0x120], 0xa
cmp dword [0x00466420], 0
je 0x44b8a8
xor ecx, ecx
call qword [0x0045eac0]
mov word [rbp + 0x122], ax
movzx ecx, ax
call fcn.00434cf0
mov qword [rbp + 0x128], rax
test rax, rax
je 0x44b9f9
mov rcx, rax
call qword [0x0045eac0]
mov dword [rbp + 0x1e8], 0x18
mov qword [rbp + 0x1f0], 0
mov dword [rbp + 0x1f8], 1
mov rbx, qword [rbp + 0x218]
mov eax, ebx
shr eax, 1
and eax, 8
test bl, 0x20
mov ecx, 0x10
cmove ecx, eax
mov eax, ebx
and eax, 0x40
mov edx, ebx
shr edx, 5
and edx, 4
lea edx, [rdx + rax*8]
or edx, ecx
lea eax, [rbx*4]
and eax, 0x1000
test bh, 2
mov ecx, 0x800
cmove ecx, eax
mov eax, ebx
shl eax, 0xf
and eax, 0x4000000
or eax, ecx
or eax, edx
mov ecx, 0x20
test bh, 0x20
jne 0x44b940
mov ecx, 0x40
test bh, 0x10
jne 0x44b940
mov ecx, 0x80
test bh, 0x40
jne 0x44b940
mov ecx, ebx
shr ecx, 7
and ecx, 0x100
or eax, ecx
test dil, dil
lea rcx, [rbp - 0x30]
cmovne rcx, r12
lea rdx, [rbp + 0x200]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x20], 1
lea r8, [rbp + 0x1e8]
mov rdx, r14
mov r9, r8
call sub.KERNEL32_CreateProcessA
cmp eax, 1
jne 0x44ba16
mov rax, qword [rbp + 0x218]
cmp eax, 0x10
mov ebx, 4
cmovne ebx, eax
mov eax, ebx
and al, 7
cmp al, 4
ja case.default.0x44b9c4
mov eax, ebx
and eax, 7
lea rcx, [0x0044bbfc]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
test bh, 1
jne case.0x44b9c4.1
mov rcx, qword [rbp + 0x200]
call sub.KERNEL32_CloseHandle
mov ecx, dword [rbp + 0x210]
mov rdx, qword [rbp + 0x200]
call qword [0x00463f50]
mov esi, eax
test bl, bl
jns 0x44bba6
jmp 0x44bbba
call fcn.00449970
mov dword [rax], 8
mov rcx, r14
call fcn.00434d00
mov esi, 0xffffffff
jmp 0x44bbca
call sub.KERNEL32_GetLastError
movzx eax, ax
cmp eax, 0x59
je 0x44bb42
cmp eax, 8
je 0x44bb3b
cmp eax, 1
jne 0x44bb49
mov esi, 0x13
jmp 0x44bb4e
lea rcx, [rbp - 0x30]
lea rdi, [rbp + 0xe0]
mov rdx, rdi
call fcn.0043a340
mov edx, 4
mov rcx, rdi
call fcn.00440750
test eax, eax
je 0x44badc
lea rdi, [rbp + 0xe0]
mov rcx, rdi
mov rdx, rbx
call fcn.0043a340
mov rcx, rdi
call fcn.0043a260
test r14d, r14d
mov byte [rbp + rax + 0xe4], 0
mov dword [rbp + rax + 0xe0], 0x444d432e
je 0x44bab8
lea rdx, [0x0045530a]
lea rcx, [rbp + 0xe0]
lea r8, [rbp - 0x30]
call fcn.0044b360
cmp byte [rbp - 0x30], 0
jne 0x44badc
jmp 0x44bb26
lea rcx, [rbp - 0x30]
lea rdi, [rbp + 0xe0]
mov rdx, rdi
call fcn.0043a340
mov edx, 4
mov rcx, rdi
call fcn.00440750
test eax, eax
jne 0x44bb26
lea rcx, [0x004552ff]
call fcn.0044a660
mov r12, rax
test r12, r12
je 0x44bb26
lea rdx, [0x00455307]
mov rcx, r12
mov r8, r15
call fcn.0044bc10
mov r14, rax
mov dil, 1
test r14, r14
jne 0x44b77f
call fcn.00449970
mov dword [rax], 8
mov esi, 0xffffffff
jmp 0x44bbca
call fcn.00449970
mov dword [rax], 2
mov esi, 0xffffffff
jmp 0x44bbca
mov esi, 8
jmp 0x44bb4e
mov esi, 0x2a
jmp 0x44bb4e
mov esi, 0x15
call fcn.00449970
mov dword [rax], esi
mov esi, 0xffffffff
jmp 0x44bbba
mov rcx, qword [rbp + 0x200]
mov edx, 0xffffffff
call sub.KERNEL32_WaitForSingleObject
mov rcx, qword [rbp + 0x200]
lea rdx, [rbp + 0x224]
call sub.KERNEL32_GetExitCodeProcess
test bh, 1
jne 0x44bb91
mov rcx, qword [rbp + 0x200]
call sub.KERNEL32_CloseHandle
mov esi, dword [rbp + 0x224]
test bl, bl
jns 0x44bba6
jmp 0x44bbba
mov esi, 0xffffffff
test bl, bl
js 0x44bbba
and ebx, 0x100
jne 0x44bbba
mov rcx, qword [rbp + 0x208]
call sub.KERNEL32_CloseHandle
mov rcx, r15
call fcn.00434d00
mov rcx, r14
call fcn.00434d00
mov eax, esi
add rsp, 0x2a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, r15
call fcn.00434d00
mov rcx, r14
call fcn.00434d00
xor ecx, ecx
call fcn.0044a510
ud2