Function at 0x402c5b
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x318
mov rsi, qword [rdx + 8]
mov rdi, qword [rdx]
lea r12, [rsp + 0x40]
cmp rsi, 7
mov rbx, rcx
mov qword [rsp + 0x218], rsi
lea rax, [r12 + 0x10]
mov qword [rsp + 0x40], rax
jbe 0x402cb6
lea rcx, [rsp + 0x218]
xor edx, edx
call fcn.0040155e
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x40]
xor eax, eax
cmp rsi, rax
je 0x402cd0
movsx cx, byte [rdi + rax]
mov word [rdx + rax*2], cx
inc rax
jmp 0x402cbd
mov rdx, qword [rsp + 0x218]
mov rcx, r12
call fcn.00498270
lea rcx, [0x004ac0a0]
call fcn.00412ff0
lea rcx, [0x004ac080]
mov rbp, rax
call fcn.00412ff0
cmp byte [rbp], 0
mov r8, rax
lea rdx, [rax + 0xa]
jne 0x402d70
lea rdi, [rsp + 0x120]
mov ecx, 0xa
mov qword [rax], 0
lea rsi, [0x004b04a0]
mov word [rax + 8], 0
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x218]
mov ecx, 0xa
lea rsi, [rsp + 0x120]
rep movsd dword [rdi], dword [rsi]
mov ecx, 7
mov rdi, rdx
rep stosd dword [rdi], eax
lea r9, [rsp + 0x218]
mov eax, 0xa
mov cl, byte [r9 + rax]
mov byte [r8 + rax], cl
inc rax
cmp rax, 0x26
jne 0x402d5b
mov byte [rbp], 1
cmp byte [r8 + 9], 0
mov rcx, rdx
mov r10b, 0x94
jne 0x402dd6
mov eax, dword [r8 + 4]
mov r9d, dword [r8]
lea r11d, [rax + 1]
cmp r11d, r9d
jne 0x402d91
inc eax
jmp 0x402dc3
lea r11d, [rax + 2]
cmp r11d, r9d
jne 0x402d9f
add eax, 2
jmp 0x402dc3
cmp eax, r9d
jne 0x402da9
xor byte [rcx], r10b
jmp 0x402dca
lea r11d, [rax + 4]
cmp r9d, r11d
jne 0x402db7
add eax, 3
jmp 0x402dc3
lea r11d, [rax + 5]
cmp r9d, r11d
jne 0x402dca
add eax, 4
xor byte [rcx], al
inc dword [r8]
jmp 0x402d7d
inc r10d
inc rcx
cmp r10b, 0xb0
jne 0x402d7d
lea r13, [rsp + 0x100]
mov byte [r8 + 9], 1
mov rcx, r13
call fcn.004023f2
mov rax, qword [rsp + 0x48]
lea r14, [rsp + 0xe0]
mov rsi, qword [rsp + 0x40]
lea rdx, [r14 + 0x10]
mov qword [rsp + 0xe0], rdx
add rax, rax
lea rdi, [rsi + rax]
sar rax, 1
cmp rax, 0xf
mov qword [rsp + 0x218], rax
jbe 0x402e48
lea rcx, [rsp + 0x218]
xor edx, edx
call fcn.004015b0
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xe0]
cmp rdi, rsi
je 0x402e64
mov dx, word [rsi]
inc rax
add rsi, 2
mov byte [rax - 1], dl
jmp 0x402e50
mov rdx, qword [rsp + 0xe0]
lea rcx, [0x004ac060]
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0xe8], rax
mov byte [rdx + rax], 0
call fcn.00412ff0
lea rcx, [0x004ac040]
mov rbp, rax
call fcn.00412ff0
cmp byte [rbp], 0
mov r8, rax
lea rdx, [rax + 0xa]
jne 0x402f12
lea rdi, [rsp + 0x120]
mov ecx, 0x3d
mov qword [rax], 0
lea rsi, [0x004b04e0]
mov word [rax + 8], 0
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x218]
mov ecx, 0x3d
lea rsi, [rsp + 0x120]
rep movsd dword [rdi], dword [rsi]
mov ecx, 0xea
mov rdi, rdx
rep stosb byte [rdi], al
lea r9, [rsp + 0x218]
mov eax, 0xa
mov cl, byte [r9 + rax]
mov byte [r8 + rax], cl
inc rax
cmp rax, 0xf4
jne 0x402efb
mov byte [rbp], 1
cmp byte [r8 + 9], 0
mov rcx, rdx
mov r10b, 0x94
jne 0x402f78
mov eax, dword [r8 + 4]
mov r9d, dword [r8]
lea r11d, [rax + 1]
cmp r9d, r11d
jne 0x402f33
inc eax
jmp 0x402f65
lea r11d, [rax + 2]
cmp r9d, r11d
jne 0x402f41
add eax, 2
jmp 0x402f65
cmp r9d, eax
jne 0x402f4b
xor byte [rcx], r10b
jmp 0x402f6c
lea r11d, [rax + 4]
cmp r9d, r11d
jne 0x402f59
add eax, 3
jmp 0x402f65
lea r11d, [rax + 5]
cmp r9d, r11d
jne 0x402f6c
add eax, 4
xor byte [rcx], al
inc dword [r8]
jmp 0x402f1f
inc r10d
inc rcx
cmp r10b, 0x7e
jne 0x402f1f
lea r15, [rsp + 0xc0]
mov byte [r8 + 9], 1
mov rcx, r15
call fcn.004023f2
lea rcx, [0x004ac020]
call fcn.00412ff0
lea rcx, [0x004ac000]
mov rbp, rax
call fcn.00412ff0
cmp byte [rbp], 0
mov r8, rax
lea rdx, [rax + 0xa]
jne 0x40301d
lea rdi, [rsp + 0x120]
mov ecx, 0xc
mov qword [rax], 0
lea rsi, [0x004b05e0]
mov word [rax + 8], 0
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x218]
mov ecx, 0xc
lea rsi, [rsp + 0x120]
rep movsd dword [rdi], dword [rsi]
mov ecx, 0x23
mov rdi, rdx
rep stosb byte [rdi], al
lea r9, [rsp + 0x218]
mov eax, 0xa
mov cl, byte [r9 + rax]
mov byte [r8 + rax], cl
inc rax
cmp rax, 0x2d
jne 0x403008
mov byte [rbp], 1
cmp byte [r8 + 9], 0
mov rcx, rdx
mov r10b, 0x93
jne 0x403083
mov eax, dword [r8 + 4]
mov r9d, dword [r8]
lea r11d, [rax + 1]
cmp r9d, r11d
jne 0x40303e
inc eax
jmp 0x403070
lea r11d, [rax + 2]
cmp r9d, r11d
jne 0x40304c
add eax, 2
jmp 0x403070
cmp r9d, eax
jne 0x403056
xor byte [rcx], r10b
jmp 0x403077
lea r11d, [rax + 4]
cmp r9d, r11d
jne 0x403064
add eax, 3
jmp 0x403070
lea r11d, [rax + 5]
cmp r9d, r11d
jne 0x403077
add eax, 4
xor byte [rcx], al
inc dword [r8]
jmp 0x40302a
inc r10d
inc rcx
cmp r10b, 0xb6
jne 0x40302a
lea rsi, [rsp + 0x80]
mov byte [r8 + 9], 1
mov rcx, rsi
call fcn.004023f2
mov rdx, rbx
mov rcx, rsi
call fcn.00496060
lea rdi, [rsp + 0xa0]
mov rdx, rax
lea rbx, [rsp + 0x120]
mov rcx, rdi
call fcn.00497910
mov r8, r15
mov rdx, rdi
mov rcx, rbx
call fcn.004a6950
lea rbp, [rsp + 0x218]
mov r8, r14
mov rdx, rbx
mov rcx, rbp
call fcn.004a6950
lea rax, [rsp + 0x60]
mov r8, r13
mov rdx, rbp
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.004a6950
mov rcx, rbp
call fcn.00495540
mov rcx, rbx
call fcn.00495540
mov rcx, rdi
call fcn.00495540
mov rcx, rsi
call fcn.00495540
mov rcx, r15
call fcn.00495540
mov rcx, r14
call fcn.00495540
mov rcx, r13
call fcn.00495540
lea rcx, [0x004ac120]
mov r13, qword [rsp + 0x60]
call fcn.00412ff0
lea rcx, [0x004ac100]
mov r14, rax
call fcn.00412ff0
cmp byte [r14], 0
mov rdx, rax
lea r8, [rax + 0xa]
jne 0x4031af
lea rsi, [0x004b0470]
mov ecx, 7
mov rdi, rbx
mov qword [rax], 0
rep movsd dword [rdi], dword [rsi]
mov word [rax + 8], 0
mov ecx, 7
xor eax, eax
mov rdi, rbp
mov rsi, rbx
rep movsd dword [rdi], dword [rsi]
mov ecx, 0xf
mov rdi, r8
rep stosb byte [rdi], al
mov eax, 0xa
mov cl, byte [rbp + rax]
mov byte [rdx + rax], cl
inc rax
cmp rax, 0x19
jne 0x40319b
mov byte [r14], 1
cmp byte [rdx + 9], 0
mov rcx, r8
mov r10b, 0x95
jne 0x403212
mov eax, dword [rdx + 4]
mov r9d, dword [rdx]
lea r11d, [rax + 1]
cmp r9d, r11d
jne 0x4031ce
inc eax
jmp 0x403200
lea r11d, [rax + 2]
cmp r9d, r11d
jne 0x4031dc
add eax, 2
jmp 0x403200
cmp r9d, eax
jne 0x4031e6
xor byte [rcx], r10b
jmp 0x403206
lea r11d, [rax + 4]
cmp r9d, r11d
jne 0x4031f4
add eax, 3
jmp 0x403200
lea r11d, [rax + 5]
cmp r9d, r11d
jne 0x403206
add eax, 4
xor byte [rcx], al
inc dword [rdx]
jmp 0x4031bb
inc r10d
inc rcx
cmp r10b, 0xa4
jne 0x4031bb
mov byte [rdx + 9], 1
lea rcx, [0x004ac0e0]
mov qword [rsp + 0x38], r8
call fcn.00412ff0
lea rcx, [0x004ac0c0]
mov rbx, rax
call fcn.00412ff0
cmp byte [rbx], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
lea rdx, [rax + 0xa]
jne 0x4032a8
mov rcx, qword [0x004b0490]
mov rdi, rdx
mov qword [r9], 0
mov rax, qword [0x004b0498]
mov word [r9 + 8], 0
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x218], rcx
mov ecx, 6
mov qword [rsp + 0x220], rax
xor eax, eax
rep stosb byte [rdi], al
mov eax, 0xa
mov cl, byte [rbp + rax]
mov byte [r9 + rax], cl
inc rax
cmp rax, 0x10
jne 0x403294
mov byte [rbx], 1
cmp byte [r9 + 9], 0
mov rcx, rdx
mov r11b, 0x95
jne 0x40330a
mov eax, dword [r9 + 4]
mov r10d, dword [r9]
lea ebx, [rax + 1]
cmp r10d, ebx
jne 0x4032c8
inc eax
jmp 0x4032f7
lea ebx, [rax + 2]
cmp r10d, ebx
jne 0x4032d5
add eax, 2
jmp 0x4032f7
cmp r10d, eax
jne 0x4032df
xor byte [rcx], r11b
jmp 0x4032fe
lea ebx, [rax + 4]
cmp r10d, ebx
jne 0x4032ec
add eax, 3
jmp 0x4032f7
lea ebx, [rax + 5]
cmp r10d, ebx
jne 0x4032fe
add eax, 4
xor byte [rcx], al
inc dword [r9]
jmp 0x4032b5
inc r11d
inc rcx
cmp r11b, 0x9b
jne 0x4032b5
mov byte [r9 + 9], 1
xor ecx, ecx
mov r9, r13
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rcx, qword [rsp + 0x30]
call fcn.00495540
mov rcx, r12
call fcn.00497c30
xor eax, eax
add rsp, 0x318
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret