Function at 0x140005180
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x140041018]
xor rax, rsp
mov qword [rbp], rax
mov r14, rcx
mov qword [rbp - 0x78], rcx
xor edx, edx
mov rsi, qword [rcx + 0x10]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, rsi
cmp rax, 1
jb 0x140005d5c
mov r12, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x1400051e6
mov r12, qword [rcx]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rdx
lea r15, [rsi + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x30]
lea r8, [rbx - 0x10]
cmp r15, rbx
jbe 0x140005280
mov rbx, r15
or rbx, 0xf
cmp rbx, r13
jbe 0x14000521d
mov rbx, r13
jmp 0x140005229
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
cmovb rcx, r8
cmp rcx, 0x1000
jb 0x140005269
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005d62
mov rcx, rax
call fcn.14000a0b4
test rax, rax
je 0x140005d68
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000527b
test rcx, rcx
je 0x140005278
call fcn.14000a0b4
mov rdi, rax
jmp 0x14000527b
mov rdi, rdx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], rbx
mov r8, rsi
mov rdx, r12
mov rcx, rdi
call fcn.14000bd20
mov byte [rdi + rsi], 0x5c
mov byte [rdi + r15], 0
mov r8d, 0xe
lea rdx, str.terminal64.exe
lea rcx, [rsp + 0x30]
call fcn.140006520
xor r12d, r12d
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140005322
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000531d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005d6e
call fcn.140009e10
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r12
mov rdi, qword [rbp - 0x40]
lea rsi, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rsi, qword [rbp - 0x50]
cmp rdi, 0x10
jae 0x140005367
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x70], xmm0
mov ebx, 0xf
jmp 0x1400053d3
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
cmova rbx, r13
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400053b1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005d74
mov rcx, rax
call fcn.14000a0b4
mov rcx, rax
test rax, rax
je 0x140005d7a
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400053c0
test rcx, rcx
je 0x1400053bd
call fcn.14000a0b4
jmp 0x1400053c0
mov rax, r12
mov qword [rbp - 0x70], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.14000bd20
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], rbx
lea rcx, [rbp - 0x70]
cmp rbx, 0x10
cmovae rcx, qword [rbp - 0x70]
xor edx, edx
call fcn.140012bf4
test eax, eax
sete bl
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x14000542f
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000542a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005d80
call fcn.140009e10
test bl, bl
je 0x140005c78
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], 0xf
mov r8d, 0x15
lea rdx, str..myconfiguration.ini
lea rcx, [rbp - 0x70]
call fcn.1400063c0
lea r9, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae r9, qword [rbp - 0x70]
lea r8, str.1006
lea rdx, str.Login
lea rcx, str.Common
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea r9, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae r9, qword [rbp - 0x70]
lea r8, [0x14003ba30]
lea rdx, str.Server
lea rcx, str.Common
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea r9, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae r9, qword [rbp - 0x70]
lea r8, [0x14003ba44]
lea rdx, [0x14003ba48]
lea rcx, str.Common
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea r9, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae r9, qword [rbp - 0x70]
lea r8, [0x14003ba44]
lea rdx, str.ProxyEnable
lea rcx, str.Common
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x14000553c
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005537
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005d86
call fcn.140009e10
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], 0xf
mov r8d, 0x15
lea rdx, str..myconfiguration.ini
lea rcx, [rbp - 0x70]
call fcn.1400063c0
lea r9, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae r9, qword [rbp - 0x70]
lea r8, [0x14003ba44]
lea rdx, str.AllowLiveTrading
lea rcx, str.Experts
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea r9, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae r9, qword [rbp - 0x70]
lea r8, [0x14003ba44]
lea rdx, str.AllowDllImport
lea rcx, str.Experts
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea r9, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae r9, qword [rbp - 0x70]
lea r8, [0x14003ba44]
lea rdx, str.Enabled
lea rcx, str.Experts
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea r9, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae r9, qword [rbp - 0x70]
lea r8, [0x14003baa0]
lea rdx, str.Account
lea rcx, str.Experts
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea r9, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae r9, qword [rbp - 0x70]
lea r8, [0x14003baa0]
lea rdx, str.Profile
lea rcx, str.Experts
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x14000566a
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005665
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005d8c
call fcn.140009e10
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x140005677
mov rdx, qword [r14]
lea rcx, [rbp - 0x30]
call fcn.140001fc0
nop
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x30]
mov qword [rbp - 0x80], rax
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x60]
call fcn.140006180
mov r13, rax
mov r15, qword [rbp - 0x20]
movabs r8, 0x7ffffffffffffffe
mov rcx, r8
sub rcx, r15
cmp rcx, 0xd
jb 0x140005d92
lea r12, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r12, qword [rbp - 0x30]
xor edx, edx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rdx
lea rsi, [r15 + 0xd]
mov ebx, 7
lea rdi, [rsp + 0x30]
cmp rsi, rbx
jbe 0x140005797
mov rbx, rsi
mov eax, 8
cmp rsi, rax
cmovb rbx, rax
or rbx, 7
cmp rbx, r8
jbe 0x140005716
mov rbx, r8
jmp 0x140005722
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
mov rax, rbx
add rax, 1
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x140005d9e
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x140005780
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005d9e
mov rcx, rax
call fcn.14000a0b4
test rax, rax
je 0x140005d98
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140005792
test rcx, rcx
je 0x14000578f
call fcn.14000a0b4
mov rdi, rax
jmp 0x140005792
mov rdi, rdx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r12
mov rcx, rdi
call fcn.14000bd20
movups xmm0, xmmword [str._terminal.exe]
movups xmmword [rdi + rbx], xmm0
movsd xmm1, qword [0x14003baf0]
movsd qword [rdi + rbx + 0x10], xmm1
movzx eax, word [0x14003baf8]
mov word [rdi + rbx + 0x18], ax
xor r12d, r12d
mov word [rdi + rsi*2], r12w
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], 7
lea r9, [0x14003bb00]
lea edx, [r12 + 9]
lea rcx, [rbp - 0x70]
call fcn.140006a30
nop
mov r8, r13
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x70]
call fcn.1400045e0
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], r12b
lea r8d, [r12 + 0xc]
lea rdx, str.Terminal.ico
lea rcx, [rbp - 0x70]
call fcn.1400063c0
nop
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
lea rsi, [rbp - 0x70]
mov r15, qword [rbp - 0x70]
mov r13, qword [rbp - 0x58]
cmp r13, 0x10
cmovae rsi, r15
mov rdi, qword [rbp - 0x60]
cmp rdi, 0x10
jae 0x14000587d
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x30], xmm0
lea ebx, [r12 + 0xf]
jmp 0x1400058f4
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400058d1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005da4
mov rcx, rax
call fcn.14000a0b4
mov rcx, rax
test rax, rax
je 0x140005daa
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400058e0
test rcx, rcx
je 0x1400058dd
call fcn.14000a0b4
jmp 0x1400058e0
mov rax, r12
mov qword [rsp + 0x30], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.14000bd20
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
cmp rbx, 0x10
cmovae rcx, qword [rsp + 0x30]
xor edx, edx
call fcn.140012bf4
test eax, eax
sete bl
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140005956
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005951
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005db0
call fcn.140009e10
test bl, bl
jne 0x140005a58
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
lea rsi, [rbp - 0x70]
cmp r13, 0x10
cmovae rsi, r15
cmp rdi, 0x10
jae 0x140005998
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x30], xmm0
mov ebx, 0xf
jmp 0x140005a0f
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400059ec
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005db6
mov rcx, rax
call fcn.14000a0b4
mov rcx, rax
test rax, rax
je 0x140005dbc
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400059fb
test rcx, rcx
je 0x1400059f8
call fcn.14000a0b4
jmp 0x1400059fb
mov rax, r12
mov qword [rsp + 0x30], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.14000bd20
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 0xf
mov r8d, 4
lea rdx, str.icon
lea rcx, [rsp + 0x60]
call fcn.1400063c0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov ecx, 0x76
call fcn.140002b90
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 0xf
xor r8d, r8d
lea rdx, [0x14003b78b]
lea rcx, [rsp + 0x60]
call fcn.1400063c0
lea rcx, [rsp + 0x60]
call fcn.140003270
lea r8, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae r8, qword [rbp - 0x50]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, str._config:myconfiguration.ini__portable
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, [0x14003bb60]
call fcn.140006750
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov rbx, rax
mov dl, 0xa
add rcx, rax
call fcn.1400072d0
movzx edx, al
mov rcx, rbx
call fcn.140007120
mov rcx, rbx
call fcn.140006fc0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
mov rdi, qword [rbp - 0x40]
lea rsi, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rsi, qword [rbp - 0x50]
cmp rdi, 0x10
jae 0x140005b2f
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], 0xf
jmp 0x140005bab
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140005b83
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005dc8
mov rcx, rax
call fcn.14000a0b4
mov rcx, rax
test rax, rax
je 0x140005dc2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140005b92
test rcx, rcx
je 0x140005b8f
call fcn.14000a0b4
jmp 0x140005b92
mov rax, r12
mov qword [rsp + 0x30], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.14000bd20
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rdi
lea rdx, [rsp + 0x30]
call fcn.140002410
test eax, eax
je 0x140005bca
lea rdx, [0x14003bb70]
jmp 0x140005abe
lea rdx, [0x14003bb80]
call fcn.140006750
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.1400072d0
movzx edx, al
mov rcx, rbx
call fcn.140007120
mov rcx, rbx
call fcn.140006fc0
nop
cmp r13, 0x10
jb 0x140005c36
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140005c2d
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005dce
mov rcx, r15
call fcn.140009e10
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140005c92
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005dd4
call fcn.140009e10
jmp 0x140005c92
xor r9d, r9d
lea r8, [0x14003bb90]
lea rdx, [0x14003bba0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140005ccd
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005cc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005d50
call fcn.140009e10
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x140005d13
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x140005d0e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005d56
mov rcx, r8
call fcn.140009e10
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140009df0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140012b7c
nop
call fcn.140012b7c
nop
call fcn.140001360
int3
call fcn.1400012c0
int3
call fcn.140012b7c
nop
call fcn.140012b7c
int3
call fcn.1400012c0
int3
call fcn.140012b7c
int3
call fcn.140012b7c
int3
call fcn.140012b7c
int3
call fcn.140012b7c
nop
call fcn.140001360
int3
call fcn.140012b7c
int3
call fcn.1400012c0
nop
call fcn.1400012c0
int3
call fcn.140012b7c
int3
call fcn.140012b7c
int3
call fcn.1400012c0
int3
call fcn.140012b7c
int3
call fcn.140012b7c
int3
call fcn.1400012c0
nop
call fcn.140012b7c
nop
call fcn.140012b7c
int3