Function at 0x140001e80
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push r12
push r14
push r15
lea rbp, [rsp - 0xab0]
sub rsp, 0xbb0
mov rax, qword [0x140010088]
xor rax, rsp
mov qword [rbp + 0xa90], rax
movups xmm1, xmmword [0x14000d458]
mov r12d, r9d
xor r9d, r9d
xorps xmm0, xmm0
mov r14, r8
movups xmmword [rsp + 0x40], xmm0
xor r8d, r8d
xor ecx, ecx
movups xmmword [rsp + 0x50], xmm0
lea edx, [r9 + 1]
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmm0, xmmword [str.Shell32.dll_Control_RunDLL]
movups xmmword [rbp - 0x38], xmm1
movsd xmm1, qword [0x14000d478]
movups xmmword [rbp - 0x48], xmm0
movups xmm0, xmmword [0x14000d468]
movsd qword [rbp - 0x18], xmm1
movups xmmword [rbp - 0x28], xmm0
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
nop dword [rax + rax]
xor r15d, r15d
cmp r15w, word [r14]
je 0x14000236c
lea rdx, str.PANEL
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrCmpICW]
nop dword [rax + rax]
test eax, eax
je 0x14000236c
lea r9, [rbp - 0x50]
mov qword [rsp + 0xba8], rdi
lea rdx, [rbp + 0x50]
mov rcx, r14
call fcn.14000b224
test al, al
je 0x140002007
lea rcx, [0x140010a18]
call fcn.1400095d8
test al, al
je 0x140001fda
mov r9d, 0xffffffff
mov dword [rsp + 0x20], 1
mov edx, r9d
lea r8, str.Microsoft.System
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
nop dword [rax + rax]
cmp eax, 2
je 0x140001fcd
mov r9d, 0xffffffff
mov dword [rsp + 0x20], 1
mov edx, r9d
lea r8, str.BB06C0E4_D293_4f75_8A90_CB05B6477EEE
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
nop dword [rax + rax]
cmp eax, 2
jne 0x140001fda
call fcn.140005dec
movzx eax, al
jmp 0x1400020c0
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp + 0x50]
call fcn.14000b72c
mov rcx, qword [rbp - 0x50]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
test ebx, ebx
setns r15b
mov eax, r15d
jmp 0x1400020c0
mov qword [rsp + 0xbe0], rsi
lea rbx, str.DESKTOP
mov qword [rsp + 0xba0], r13
mov edi, r15d
mov rcx, qword [rbx]
mov rdx, r14
call qword [sym.imp.SHLWAPI.dll_StrCmpICW]
nop dword [rax + rax]
lea r13, str._SystemRoot__system32_rundll32.exe
mov esi, 0x30c
test eax, eax
jne 0x14000205b
mov ecx, dword [rbx + 8]
cmp ecx, 0xffffffff
je 0x14000206b
call qword [sym.imp.SHLWAPI.dll_IsOS]
nop dword [rax + rax]
test eax, eax
jne 0x14000206b
inc edi
add rbx, 0x28
cmp edi, 0x15
jb 0x140002021
jmp 0x140002184
lea rcx, [0x140010a18]
call fcn.1400095d8
test al, al
je 0x1400020e8
mov rcx, qword [rbx + 0x18]
lea r8, str.Microsoft.System
mov r9d, 0xffffffff
mov dword [rsp + 0x20], 1
mov edx, r9d
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
nop dword [rax + rax]
cmp eax, 2
jne 0x1400020e8
call fcn.140005dec
movzx eax, al
mov rsi, qword [rsp + 0xbe0]
mov r13, qword [rsp + 0xba0]
mov rdi, qword [rsp + 0xba8]
mov rcx, qword [rbp + 0xa90]
xor rcx, rsp
call fcn.1400029a0
add rsp, 0xbb0
pop r15
pop r14
pop r12
pop rbx
pop rbp
ret
cmp dword [rbx + 0xc], r15d
je 0x140002151
mov rax, qword [rbx + 0x20]
lea r9, [rbp - 0x48]
mov rcx, qword [rbx + 0x18]
mov rdx, rsi
mov qword [rsp + 0x58], r13
test rax, rax
je 0x14000212c
mov qword [rsp + 0x28], rax
lea r8, str._s_s__s
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x260]
call fcn.14000b91c
test eax, eax
jns 0x140002148
xor eax, eax
jmp 0x1400020b0
mov qword [rsp + 0x20], rcx
lea r8, str._s_s
lea rcx, [rbp + 0x260]
call fcn.14000b91c
test eax, eax
js 0x140002128
lea rax, [rbp + 0x260]
jmp 0x14000217f
cmp dword [rbx + 0x10], r15d
je 0x140002172
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x18]
call fcn.14000b72c
test eax, eax
setns r15b
mov eax, r15d
jmp 0x1400020b0
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x58], rax
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x58], r15
jne 0x14000224d
mov rdx, r14
lea rcx, str.NETCONNECTIONS
call qword [sym.imp.SHLWAPI.dll_StrCmpICW]
nop dword [rax + rax]
test eax, eax
je 0x1400022a5
mov rdx, r14
lea rcx, str.ncpa.cpl
call qword [sym.imp.SHLWAPI.dll_StrCmpICW]
nop dword [rax + rax]
test eax, eax
je 0x1400022a5
cmp qword [rsp + 0x58], r15
jne 0x14000224d
lea r8, [rbp - 0x48]
mov rdx, rsi
lea rcx, [rbp + 0x260]
call fcn.14000b8c8
test eax, eax
js 0x140002128
lea rax, [rbp + 0x260]
mov qword [rsp + 0x58], r13
lea rcx, [rbp + 0x260]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
nop dword [rax + rax]
movsxd rbx, eax
mov r8d, esi
lea rdi, [rbp + 0x260]
sub r8d, eax
mov rcx, r14
lea rdi, [rdi + rbx*2]
mov rdx, rdi
call fcn.14000b418
test eax, eax
je 0x14000224d
sub rsi, rbx
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.14000b8c8
test eax, eax
js 0x140002128
or dword [rsp + 0x44], 0x2000300
lea rdx, str.open
mov qword [rsp + 0x50], rdx
test r12d, r12d
mov edx, 1
mov dword [rsp + 0x40], 0x70
cmovne edx, r12d
mov ecx, 0xffffffff
mov dword [rsp + 0x70], edx
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop dword [rax + rax]
mov eax, 1
jmp 0x1400020b0
movaps xmm0, xmmword [str.::7007ACC7_3202_11D1_AAD2_00805FC1270E]
lea rdx, [rbp + 0x880]
movzx eax, word [0x14000d4d0]
lea rcx, [rsp + 0x30]
movaps xmm1, xmmword [0x14000d490]
movaps xmmword [rbp - 0x10], xmm0
movaps xmm0, xmmword [0x14000d4a0]
mov word [rbp + 0x40], ax
mov eax, dword [0x14000d4d4]
movaps xmmword [rbp + 0x10], xmm0
movaps xmm0, xmmword [0x14000d4c0]
movaps xmmword [rbp], xmm1
movaps xmm1, xmmword [0x14000d4b0]
mov dword [rbp - 0x50], eax
movzx eax, word [0x14000d4d8]
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm1
mov word [rbp - 0x4c], ax
call fcn.14000b150
test eax, eax
js 0x140002128
cmp dword [rsp + 0x30], 1
lea rcx, [0x14000c9fc]
lea rax, [rbp - 0x50]
mov rdx, rsi
cmovne rax, rcx
lea r9, [rbp + 0x880]
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x28], rcx
lea r8, str._s_s_s
lea rcx, [rbp + 0x260]
mov qword [rsp + 0x20], rax
call fcn.14000b91c
test eax, eax
js 0x140002128
lea rax, [rbp + 0x260]
mov qword [rsp + 0x58], rax
jmp 0x14000224d
mov edx, 2
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x1400023ec
xor edx, edx
lea rax, [rbp - 0x50]
lea r9, [0x14000cf28]
mov qword [rsp + 0x20], rax
lea rcx, [0x14000c9e8]
lea r8d, [rdx + 1]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x1400023e0
mov rcx, qword [rbp - 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [0x14000c860]
mov rcx, qword [rbp - 0x50]
mov ebx, eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14000c860]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop dword [rax + rax]
not ebx
shr ebx, 0x1f
mov eax, ebx
jmp 0x1400020c8