Function at 0x44d040
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x2a8
lea rbp, [rsp + 0x80]
mov r13, r9
mov r15, r8
mov rbx, rdx
mov eax, ecx
and eax, 7
cmp eax, 5
jae 0x44d129
mov qword [rbp + 0x218], rcx
movsx eax, byte [rbx]
lea ecx, [rax - 0x20]
cmp eax, 0x60
cmovbe ecx, eax
add ecx, 0xffffffbf
cmp ecx, 0x19
ja 0x44d093
cmp byte [rbx + 1], 0x3a
je 0x44d0bb
mov edx, 0x2f
mov rcx, rbx
call fcn.0044ae10
test rax, rax
jne 0x44d0bb
mov edx, 0x5c
mov rcx, rbx
call fcn.0044ae10
test rax, rax
je 0x44d2bf
xor r14d, r14d
mov edx, 0x5c
mov rcx, rbx
call fcn.0044b1b0
test rax, rax
lea rcx, [rax + 1]
cmove rcx, rbx
mov edx, 0x2e
call fcn.0044b1b0
mov rdi, rax
lea rsi, [rbp + 0xe0]
mov rcx, rsi
mov rdx, rbx
call fcn.0043be40
test rdi, rdi
je 0x44d13e
test r14d, r14d
je 0x44d185
lea rdx, [0x004573ba]
lea rcx, [rbp + 0xe0]
lea r8, [rbp - 0x30]
call fcn.0044ce60
cmp byte [rbp - 0x30], 0
jne 0x44d1ad
jmp 0x44d626
call fcn.0044b470
mov dword [rax], 0x13
mov esi, 0xffffffff
jmp 0x44d6ca
lea rcx, [rbp + 0xe0]
call fcn.0043bd60
mov byte [rbp + rax + 0xe4], 0
mov dword [rbp + rax + 0xe0], 0x4558452e
test r14d, r14d
je 0x44d1e0
lea rdx, [0x004573ba]
lea rcx, [rbp + 0xe0]
lea r8, [rbp - 0x30]
call fcn.0044ce60
cmp byte [rbp - 0x30], 0
jne 0x44d260
jmp 0x44d204
lea rcx, [rbp - 0x30]
lea rbx, [rbp + 0xe0]
mov rdx, rbx
call fcn.0043be40
mov edx, 4
mov rcx, rbx
call fcn.00442250
test eax, eax
jne 0x44d626
lea rdx, [0x004573a0]
mov rcx, rdi
call fcn.0044af60
test eax, eax
je 0x44d5dc
lea rdx, [0x004573a5]
mov rcx, rdi
call fcn.0044af60
test eax, eax
jne 0x44d260
jmp 0x44d5dc
lea rcx, [rbp - 0x30]
lea rdi, [rbp + 0xe0]
mov rdx, rdi
call fcn.0043be40
mov edx, 4
mov rcx, rdi
call fcn.00442250
test eax, eax
je 0x44d260
lea rdi, [rbp + 0xe0]
mov rcx, rdi
mov rdx, rbx
call fcn.0043be40
mov rcx, rdi
call fcn.0043bd60
test r14d, r14d
mov byte [rbp + rax + 0xe4], 0
mov dword [rbp + rax + 0xe0], 0x5441422e
je 0x44d543
lea rdx, [0x004573ba]
lea rcx, [rbp + 0xe0]
lea r8, [rbp - 0x30]
call fcn.0044ce60
cmp byte [rbp - 0x30], 0
jne 0x44d5dc
jmp 0x44d567
mov rcx, qword [r15]
add r15, 8
xor edi, edi
xor edx, edx
mov r8, r15
call fcn.0044d710
mov r14, rax
test r14, r14
je 0x44d611
test r13, r13
je 0x44d2ba
mov r15, rdi
mov rbx, qword [r13]
test rbx, rbx
je 0x44d2cb
lea rsi, [r13 + 8]
mov edi, 1
mov rcx, rbx
nop dword [rax]
call fcn.0043bd60
lea eax, [rdi + rax + 1]
movsxd rdi, eax
mov rcx, qword [rsi]
add rsi, 8
test rcx, rcx
jne 0x44d2a0
jmp 0x44d2d0
xor r15d, r15d
jmp 0x44d31e
mov r14d, dword [rbp + 0x290]
jmp 0x44d0be
mov edi, 1
mov rcx, rdi
call fcn.004367f0
test rax, rax
lea rsi, [rbp + 0xe0]
mov rdi, r15
mov r15, rax
je 0x44d4f9
test rbx, rbx
mov rax, r15
je 0x44d31b
add r13, 8
mov rax, r15
nop dword [rax]
mov rcx, rax
mov rdx, rbx
call fcn.0043bd90
inc rax
mov rbx, qword [r13]
add r13, 8
test rbx, rbx
jne 0x44d300
mov byte [rax], 0
call qword [0x004665c0]
xorps xmm0, xmm0
movaps xmmword [rbp + 0xe0], xmm0
movaps xmmword [rbp + 0x120], xmm0
movaps xmmword [rbp + 0x130], xmm0
movaps xmmword [rbp + 0x110], xmm0
movaps xmmword [rbp + 0x100], xmm0
movaps xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x140], 0
mov dword [rbp + 0xe0], 0x68
mov word [rbp + 0x120], 0xa
cmp dword [0x00468b00], 0
je 0x44d3a8
xor ecx, ecx
call qword [0x00461190]
mov word [rbp + 0x122], ax
movzx ecx, ax
call fcn.004367f0
mov qword [rbp + 0x128], rax
test rax, rax
je 0x44d4f9
mov rcx, rax
call qword [0x00461190]
mov dword [rbp + 0x1e8], 0x18
mov qword [rbp + 0x1f0], 0
mov dword [rbp + 0x1f8], 1
mov rbx, qword [rbp + 0x218]
mov eax, ebx
shr eax, 1
and eax, 8
test bl, 0x20
mov ecx, 0x10
cmove ecx, eax
mov eax, ebx
and eax, 0x40
mov edx, ebx
shr edx, 5
and edx, 4
lea edx, [rdx + rax*8]
or edx, ecx
lea eax, [rbx*4]
and eax, 0x1000
test bh, 2
mov ecx, 0x800
cmove ecx, eax
mov eax, ebx
shl eax, 0xf
and eax, 0x4000000
or eax, ecx
or eax, edx
mov ecx, 0x20
test bh, 0x20
jne 0x44d440
mov ecx, 0x40
test bh, 0x10
jne 0x44d440
mov ecx, 0x80
test bh, 0x40
jne 0x44d440
mov ecx, ebx
shr ecx, 7
and ecx, 0x100
or eax, ecx
test dil, dil
lea rcx, [rbp - 0x30]
cmovne rcx, r12
lea rdx, [rbp + 0x200]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x20], 1
lea r8, [rbp + 0x1e8]
mov rdx, r14
mov r9, r8
call sub.KERNEL32_CreateProcessA
cmp eax, 1
jne 0x44d516
mov rax, qword [rbp + 0x218]
cmp eax, 0x10
mov ebx, 4
cmovne ebx, eax
mov eax, ebx
and al, 7
cmp al, 4
ja case.default.0x44d4c4
mov eax, ebx
and eax, 7
lea rcx, [0x0044d6fc]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
test bh, 1
jne case.0x44d4c4.1
mov rcx, qword [rbp + 0x200]
call sub.KERNEL32_CloseHandle
mov ecx, dword [rbp + 0x210]
mov rdx, qword [rbp + 0x200]
call qword [0x00466620]
mov esi, eax
test bl, bl
jns 0x44d6a6
jmp 0x44d6ba
call fcn.0044b470
mov dword [rax], 8
mov rcx, r14
call fcn.00436800
mov esi, 0xffffffff
jmp 0x44d6ca
call sub.KERNEL32_GetLastError
movzx eax, ax
cmp eax, 0x59
je 0x44d642
cmp eax, 8
je 0x44d63b
cmp eax, 1
jne 0x44d649
mov esi, 0x13
jmp 0x44d64e
lea rcx, [rbp - 0x30]
lea rdi, [rbp + 0xe0]
mov rdx, rdi
call fcn.0043be40
mov edx, 4
mov rcx, rdi
call fcn.00442250
test eax, eax
je 0x44d5dc
lea rdi, [rbp + 0xe0]
mov rcx, rdi
mov rdx, rbx
call fcn.0043be40
mov rcx, rdi
call fcn.0043bd60
test r14d, r14d
mov byte [rbp + rax + 0xe4], 0
mov dword [rbp + rax + 0xe0], 0x444d432e
je 0x44d5b8
lea rdx, [0x004573ba]
lea rcx, [rbp + 0xe0]
lea r8, [rbp - 0x30]
call fcn.0044ce60
cmp byte [rbp - 0x30], 0
jne 0x44d5dc
jmp 0x44d626
lea rcx, [rbp - 0x30]
lea rdi, [rbp + 0xe0]
mov rdx, rdi
call fcn.0043be40
mov edx, 4
mov rcx, rdi
call fcn.00442250
test eax, eax
jne 0x44d626
lea rcx, [0x004573af]
call fcn.0044c160
mov r12, rax
test r12, r12
je 0x44d626
lea rdx, [0x004573b7]
mov rcx, r12
mov r8, r15
call fcn.0044d710
mov r14, rax
mov dil, 1
test r14, r14
jne 0x44d27f
call fcn.0044b470
mov dword [rax], 8
mov esi, 0xffffffff
jmp 0x44d6ca
call fcn.0044b470
mov dword [rax], 2
mov esi, 0xffffffff
jmp 0x44d6ca
mov esi, 8
jmp 0x44d64e
mov esi, 0x2a
jmp 0x44d64e
mov esi, 0x15
call fcn.0044b470
mov dword [rax], esi
mov esi, 0xffffffff
jmp 0x44d6ba
mov rcx, qword [rbp + 0x200]
mov edx, 0xffffffff
call sub.KERNEL32_WaitForSingleObject
mov rcx, qword [rbp + 0x200]
lea rdx, [rbp + 0x224]
call sub.KERNEL32_GetExitCodeProcess
test bh, 1
jne 0x44d691
mov rcx, qword [rbp + 0x200]
call sub.KERNEL32_CloseHandle
mov esi, dword [rbp + 0x224]
test bl, bl
jns 0x44d6a6
jmp 0x44d6ba
mov esi, 0xffffffff
test bl, bl
js 0x44d6ba
and ebx, 0x100
jne 0x44d6ba
mov rcx, qword [rbp + 0x208]
call sub.KERNEL32_CloseHandle
mov rcx, r15
call fcn.00436800
mov rcx, r14
call fcn.00436800
mov eax, esi
add rsp, 0x2a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, r15
call fcn.00436800
mov rcx, r14
call fcn.00436800
xor ecx, ecx
call fcn.0044c010
ud2