Function at 0x140003b70
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xa0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0xd0], rbx
mov r13, rdx
call fcn.140014ad4
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x140003bb6
mov ecx, 0x80004005
call fcn.1400047b0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xe8], rbx
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
lea rdi, str.auto
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x140003c4d
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140003cdb
cmp dword [rdx + 0x10], eax
jge 0x140003c1c
cmp dword [rbx - 0xc], eax
jge 0x140003c11
mov ecx, 0x80070057
call fcn.1400047b0
int3
mov dword [rbx - 0x10], eax
mov word [rbx], ax
jmp 0x140003cdb
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140003c33
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xe8], rbx
jmp 0x140003cdb
invalid
mov ebp, dword [rbx - 0x10]
lea r12, str.auto
adc eax, dword [0x1232b885a]
sar r12, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140003c85
mov edx, edi
lea rcx, [rsp + 0xe8]
call fcn.1400047d0
mov rbx, qword [rsp + 0xe8]
cmp r12, rbp
ja 0x140003ca5
movsxd rax, edi
lea rbp, [rax + rax]
lea r8, [rbx + r12*2]
mov r9, rbp
mov rdx, rbp
mov rcx, rbx
call fcn.140030380
jmp 0x140003cc1
movsxd rax, edi
lea rbp, [rax + rax]
mov r9, rbp
lea r8, str.auto
add eax, 0xd58b4800
mov rcx, rbx
call fcn.1400302b0
test edi, edi
js 0x140003de9
cmp edi, dword [rbx - 0xc]
jg 0x140003de9
mov dword [rbx - 0x10], edi
mov word [rbx + rbp], 0
call fcn.140014ad4
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x140003cfa
mov ecx, 0x80004005
call fcn.1400047b0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, qword [r13]
lea rdx, str.config__s_start__s
lea rcx, [rsp + 0x20]
call fcn.140004930
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x30]
call fcn.140031f70
mov dword [rsp + 0x30], 0x70
lea rax, str.open
mov qword [rsp + 0x40], rax
lea rax, str.sc.exe
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0x20]
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x34], 0x140
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140003da1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0xe8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140003dc5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x140003de2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, 1
jmp 0x140003df4
mov ecx, 0x80070057
call fcn.1400047b0
nop
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret