Function at 0x5638f8
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4c0
mov qword [rsp + 0x180], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rdi, rcx
xor r13d, r13d
mov rsi, r13
mov qword [rsp + 0x50], r13
mov dword [rsp + 0x58], r13d
mov dword [rax + 0x10], 0x104
mov rdx, rcx
lea rcx, [rsp + 0x60]
call fcn.00402190
lea ebp, [r13 + 8]
mov r8, rbp
lea rdx, str.magnet:_
mov rcx, qword [rax + 0x28]
call fcn.006a62c8
cmp eax, r13d
sete bl
lea rax, [rsp + 0x60]
mov r14d, 0x100
mov rcx, qword [rsp + 0x88]
cmp rcx, rax
je 0x563997
cmp rcx, r13
je 0x563997
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
cmp rdx, r14
jbe 0x563992
call fcn.006a4944
jmp 0x563997
call fcn.006a3610
cmp bl, r13b
je 0x5639ac
xor edx, edx
mov rcx, rdi
call fcn.00565420
nop
jmp 0x56405b
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.00402190
mov r8, rbp
lea rdx, str.dchub:__
mov rcx, qword [rax + 0x28]
call fcn.006a62c8
cmp eax, r13d
sete bl
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x88]
cmp rcx, rax
je 0x563a02
cmp rcx, r13
je 0x563a02
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
cmp rdx, r14
jbe 0x5639fd
call fcn.006a4944
jmp 0x563a02
call fcn.006a3610
cmp bl, r13b
je 0x563a15
mov rcx, rdi
call fcn.00564078
nop
jmp 0x56405b
lea rax, [rsp + 0x130]
mov qword [rsp + 0x170], rax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x178], rax
mov word [rsp + 0x130], r13w
mov r9d, 3
xor r8d, r8d
lea rdx, [0x0079f360]
mov rcx, rdi
call fcn.004202f0
or rcx, 0xffffffffffffffff
cmp rax, rcx
je 0x563ad8
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0xe0]
mov rcx, rdi
call fcn.00421328
nop
lea rcx, [rsp + 0x130]
cmp rax, rcx
je 0x563a99
mov r8, qword [rax + 0x40]
mov rdx, qword [rax + 0x48]
lea rcx, [rsp + 0x130]
call fcn.00406d38
nop
lea rax, [rsp + 0xe0]
mov rcx, qword [rsp + 0x128]
cmp rcx, rax
je 0x563af3
cmp rcx, r13
je 0x563af3
mov rax, qword [rsp + 0xe0]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r14
jbe 0x563ad1
call fcn.006a4944
jmp 0x563af3
call fcn.006a3610
jmp 0x563af3
lea r8, [0x0079f370]
lea rdx, str.http
lea rcx, [rsp + 0x130]
call fcn.00406d38
lea r8, [0x0079f39e]
lea rdx, str._shellopencommand
lea rcx, [rsp + 0x130]
call fcn.00406b9c
mov qword [rsp + 0x510], r13
lea rax, [rsp + 0x510]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x178]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r13d
jne 0x563ff0
mov rsi, qword [rsp + 0x510]
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x58], r13d
lea r9, [rsp + 0x508]
lea r8, [rsp + 0x2a0]
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.004d5368
cmp eax, r13d
jne 0x563ff0
lea r8, [rsp + 0x508]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x90]
call fcn.004023b4
nop
mov rbx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xd8]
sub rbx, rcx
sar rbx, 1
cmp rbx, 1
jbe 0x563fbb
mov r15d, 0x22
cmp word [rcx], r15w
jne 0x563be7
lea r12d, [r15 - 0x21]
mov edx, r15d
mov r8, r12
lea rcx, [rsp + 0x90]
call fcn.00421278
mov rbp, rax
jmp 0x563c03
mov r12, r13
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rsp + 0x90]
call fcn.00421278
mov rbp, rax
cmp rbp, 0xffffffffffffffff
cmove rbp, rbx
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0xe0]
call fcn.004021f8
nop
sub rbp, r12
mov r9, rbp
mov r8, r12
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x90]
call fcn.00421328
nop
lea rcx, [rsp + 0x90]
cmp rax, rcx
je 0x563c63
mov r8, qword [rax + 0x40]
mov rdx, qword [rax + 0x48]
lea rcx, [rsp + 0x90]
call fcn.00406d38
nop
lea rax, [rsp + 0x188]
mov rcx, qword [rsp + 0x1d0]
cmp rcx, rax
je 0x563ca0
cmp rcx, r13
je 0x563ca0
mov rax, qword [rsp + 0x188]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r14
jbe 0x563c9b
call fcn.006a4944
jmp 0x563ca0
call fcn.006a3610
mov ebp, 2
mov r9, rbp
xor r8d, r8d
lea rdx, [0x0079f3a0]
lea rcx, [rsp + 0xe0]
call fcn.004202f0
or rbx, 0xffffffffffffffff
cmp rax, rbx
je 0x563ce3
mov r9, rdi
mov r8, rbp
mov rdx, rax
lea rcx, [rsp + 0xe0]
call fcn.0056a24c
jmp 0x563da0
mov r8, rdi
lea rdx, [0x0079f3a8]
lea rcx, [rsp + 0x1d8]
call fcn.00420494
nop
mov r8d, r15d
mov rdx, rax
lea rcx, [rsp + 0x188]
call fcn.004471d4
nop
mov r8, qword [rax + 0x40]
mov rdx, qword [rax + 0x48]
lea rcx, [rsp + 0xe0]
call fcn.00406b9c
nop
lea rax, [rsp + 0x188]
mov rcx, qword [rsp + 0x1d0]
cmp rcx, rax
je 0x563d63
cmp rcx, r13
je 0x563d63
mov rax, qword [rsp + 0x188]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r14
jbe 0x563d5d
call fcn.006a4944
jmp 0x563d63
call fcn.006a3610
nop
lea rax, [rsp + 0x1d8]
mov rcx, qword [rsp + 0x220]
cmp rcx, rax
je 0x563da0
cmp rcx, r13
je 0x563da0
mov rax, qword [rsp + 0x1d8]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r14
jbe 0x563d9b
call fcn.006a4944
jmp 0x563da0
call fcn.006a3610
mov dword [rsp + 0x230], WSAGetLastError
mov qword [rsp + 0x238], r13
xor edx, edx
lea r8d, [rdx + 0x58]
lea rcx, [rsp + 0x240]
call fcn.006aba40
mov qword [rsp + 0x60], r13
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x120]
sub rcx, qword [rsp + 0x128]
sar rcx, 1
inc rcx
mov rax, rbp
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.006a43c4
mov rbx, rax
mov rcx, qword [rsp + 0x128]
mov rdx, rax
movzx eax, word [rcx]
mov word [rdx], ax
add rcx, rbp
add rdx, rbp
cmp ax, r13w
jne 0x563e0d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x230]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, r13d
je 0x563f5b
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, rbx
call fcn.006a5088
nop
lea rax, [rsp + 0xe0]
mov rcx, qword [rsp + 0x128]
cmp rcx, rax
je 0x563ec8
cmp rcx, r13
je 0x563ec8
mov rax, qword [rsp + 0xe0]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r14
jbe 0x563ec2
call fcn.006a4944
jmp 0x563ec8
call fcn.006a3610
nop
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xd8]
cmp rcx, rax
je 0x563f06
cmp rcx, r13
je 0x563f06
mov rax, qword [rsp + 0x90]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r14
jbe 0x563f00
call fcn.006a4944
jmp 0x563f06
call fcn.006a3610
nop
lea rax, [rsp + 0x130]
mov rcx, qword [rsp + 0x178]
cmp rcx, rax
je 0x563f44
cmp rcx, r13
je 0x563f44
mov rax, qword [rsp + 0x130]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r14
jbe 0x563f3e
call fcn.006a4944
jmp 0x563f44
call fcn.006a3610
nop
cmp rsi, r13
je 0x56405b
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x56405b
mov rcx, rbx
call fcn.006a5088
nop
lea rax, [rsp + 0xe0]
mov rcx, qword [rsp + 0x128]
cmp rcx, rax
je 0x563fb3
cmp rcx, r13
je 0x563fb3
mov rax, qword [rsp + 0xe0]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r14
jbe 0x563fa4
call fcn.006a4944
mov rcx, qword [rsp + 0xd8]
jmp 0x563fbb
call fcn.006a3610
mov rcx, qword [rsp + 0xd8]
jmp 0x563fbb
mov rcx, qword [rsp + 0xd8]
lea rax, [rsp + 0x90]
cmp rcx, rax
je 0x563ff0
cmp rcx, r13
je 0x563ff0
mov rax, qword [rsp + 0x90]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r14
jbe 0x563feb
call fcn.006a4944
jmp 0x563ff0
call fcn.006a3610
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, qword [rdi + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rax, [rsp + 0x130]
mov rcx, qword [rsp + 0x178]
cmp rcx, rax
je 0x56404d
cmp rcx, r13
je 0x56404d
mov rax, qword [rsp + 0x130]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r14
jbe 0x564047
call fcn.006a4944
jmp 0x56404d
call fcn.006a3610
nop
cmp rsi, r13
je 0x56405b
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x500]
add rsp, 0x4c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret