Function at 0x7eac10
Capabilities:
Create process on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x508
mov rbp, rsp
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0x100], 0
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xf8], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x108], 0
mov qword [rbp + 0x118], 0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x128], 0
mov qword [rbp + 0x4d0], 0
mov qword [rbp + 0x4c8], 0
mov qword [rbp + 0x440], 0
mov qword [rbp + 0x430], 0
mov qword [rbp + 0x428], 0
mov qword [rbp + 0x420], 0
mov qword [rbp + 0x410], 0
mov qword [rbp + 0x408], 0
mov qword [rbp + 0x3f8], 0
mov qword [rbp + 0x3f0], 0
mov qword [rbp + 0x3e0], 0
mov qword [rbp + 0x198], 0
mov qword [rbp + 0x190], 0
mov qword [rbp + 0x188], 0
mov qword [rbp + 0x178], 0
mov qword [rbp + 0x170], 0
mov qword [rbp + 0x168], 0
mov qword [rbp + 0x160], 0
mov qword [rbp + 0x150], 0
mov qword [rbp + 0x148], 0
mov qword [rbp + 0x138], rbp
mov qword [rbp + 0x530], rcx
mov qword [rbp + 0x538], rdx
mov qword [rbp + 0x540], r8
mov byte [rbp + 0x548], r9b
nop
movzx rcx, byte [0x00864e1d]
call fcn.007eabe0
mov dword [rbp + 0x184], eax
movzx rcx, byte [0x00864e1e]
call fcn.007eabe0
add dword [rbp + 0x184], eax
cmp dword [rbp + 0x184], 0
jge 0x7eae9b
movsxd rax, dword [rbp + 0x184]
mov qword [0x00864e20], rax
movsxd rax, dword [rbp + 0x184]
add qword [0x00864e28], rax
jmp 0x7eb943
lea rcx, [rbp + 0x128]
mov rax, qword [rbp + 0x538]
mov rdx, qword [rax + 0x18]
call fcn.00410ba0
lea rcx, [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
call fcn.00432a30
lea rcx, [rbp + 0x3e0]
mov rdx, qword [rbp + 0x130]
call fcn.00432820
lea rcx, [rbp + 0x430]
mov rdx, qword [rbp + 0x3e0]
call fcn.00434940
lea rcx, [rbp + 0x120]
lea rdx, [0x007ebb0c]
mov r8d, 0x1cad14
call fcn.0078b4d0
mov rax, qword [rbp + 0x120]
mov qword [rbp + 0x158], rax
lea rcx, [rbp + 0x430]
mov rdx, qword [rbp + 0x158]
xor r8, r8
call fcn.00441bc0
mov byte [rbp + 0x3ef], al
cmp byte [rbp + 0x548], 0
je 0x7eb5a9
mov byte [rbp + 0x4f7], 0
lea rcx, [rbp + 0x178]
mov rax, qword [rbp + 0x538]
mov rdx, qword [rax + 0x20]
call fcn.00410ba0
lea rcx, [rbp + 0x178]
lea rdx, [rbp + 0x118]
call fcn.004430d0
cmp qword [rbp + 0x118], 0
je 0x7eb114
lea rcx, [rbp + 0x110]
mov rax, qword [rbp + 0x538]
mov rdx, qword [rax + 0x18]
call fcn.00410ba0
lea rcx, [rbp + 0x108]
lea rdx, [0x007ebb54]
mov r8d, 0x1033a7
call fcn.0078b4d0
lea rcx, [rbp + 0x3f8]
mov rdx, qword [rbp + 0x110]
mov r8, qword [rbp + 0x108]
call fcn.00410f70
nop
lea rcx, [rbp + 0xf8]
lea rdx, [0x007ebba8]
mov r8d, 0x1dca81
call fcn.0078b4d0
lea rcx, [rbp + 0xf0]
mov rax, qword [rbp + 0x538]
mov rdx, qword [rax + 0x18]
call fcn.00410ba0
lea rcx, [rbp + 0xe8]
lea rdx, [0x007ebbf0]
mov r8d, 0x164e5d
call fcn.0078b4d0
lea rcx, [rbp + 0x100]
mov edx, 3
mov r8, qword [rbp + 0xf8]
mov r9, qword [rbp + 0xf0]
mov rax, qword [rbp + 0xe8]
mov qword [rsp + 0x20], rax
call fcn.004110a0
lea rcx, [rbp + 0xe0]
mov rax, qword [rbp + 0x538]
mov rdx, qword [rax + 0x20]
call fcn.00410ba0
lea rcx, [rbp + 0xd0]
mov rax, qword [rbp + 0x538]
mov rdx, qword [rax + 0x18]
call fcn.00410ba0
lea rcx, [rbp + 0xd8]
mov rdx, qword [rbp + 0xd0]
call fcn.004348d0
mov rcx, 0xffffffffffecbc3f
mov edx, 0x1343c1
call fcn.0078b350
mov rbx, rax
mov ecx, 0x13bc90
mov edx, 0x13bc90
call fcn.0078b350
mov rcx, qword [rbp + 0x100]
mov rdx, qword [rbp + 0x3f8]
mov r8, qword [rbp + 0xe0]
mov r9, qword [rbp + 0xd8]
mov qword [rsp + 0x20], 0
mov word [rsp + 0x28], bx
mov dword [rsp + 0x30], 5
mov r10, qword [rbp + 0x3f8]
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x40], eax
call fcn.00796ab0
mov rcx, qword [rbp + 0x3f8]
mov dl, 1
call fcn.00434150
test al, al
je 0x7eb943
jmp 0x7eb12b
lea rcx, [rbp + 0x3f8]
mov rax, qword [rbp + 0x538]
mov rdx, qword [rax + 0x18]
call fcn.00410ba0
cmp byte [rbp + 0x3ef], 0
je 0x7eb161
lea rcx, [rbp + 0xc8]
lea rdx, [0x007ebc1c]
mov r8d, 0x106f13
call fcn.0078b4d0
mov rcx, qword [rbp + 0xc8]
call fcn.0079c2b0
mov dword [rbp + 0x43c], eax
jmp 0x7eb176
mov ecx, 0x17b498
mov edx, 0x17b498
call fcn.0078b350
mov dword [rbp + 0x43c], eax
lea rcx, [rbp + 0xc0]
lea rdx, [0x007ebc7c]
mov r8d, 0x123689
call fcn.0078b4d0
lea rcx, [rbp + 0xb8]
lea rdx, [0x007ebcd4]
mov r8d, 0x113499
call fcn.0078b4d0
lea rcx, [rbp + 0x198]
mov edx, 3
mov r8, qword [rbp + 0xc0]
mov r9, qword [rbp + 0x3f8]
mov rax, qword [rbp + 0xb8]
mov qword [rsp + 0x20], rax
call fcn.004110a0
lea rcx, [rbp + 0x4c8]
lea rdx, [0x007ebd20]
mov r8d, 0x151d3b
call fcn.0078b4d0
lea rcx, [rbp + 0x190]
lea rdx, [0x007ebd84]
mov r8d, 0x119ae3
call fcn.0078b4d0
mov rcx, qword [rbp + 0x190]
call fcn.00410b10
mov rbx, rax
mov rcx, qword [rbp + 0x4c8]
call fcn.00410b10
mov rsi, rax
mov rcx, qword [rbp + 0x198]
call fcn.00410b10
xor ecx, ecx
mov rdx, rbx
mov r8, rsi
mov r9, rax
mov rax, qword [rbp + 0x538]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 5
call sub.shell32.dll_ShellExecuteW
call fcn.00438e90
movsd qword [rbp + 0x418], xmm0
mov ecx, 0x104fbe
mov edx, 0x104fbe
call fcn.0078b350
mov rcx, qword [rbp + 0x540]
mov dword [rcx], eax
mov rcx, 0xffffffffffeef405
mov edx, 0x110d27
call fcn.0078b350
mov ecx, eax
call fcn.004a9530
nop
mov dword [rbp + 0x1a8], 0x238
mov rcx, 0xffffffffffe365e1
mov edx, 0x1c9a1f
call fcn.0078b350
mov ecx, 2
mov edx, eax
call fcn.0078b040
mov qword [rbp + 0x4f8], rax
nop
mov rcx, qword [rbp + 0x4f8]
lea rdx, [rbp + 0x1a8]
call fcn.0078b070
test eax, eax
je 0x7eb488
lea rcx, [rbp + 0x170]
lea rdx, [rbp + 0x1d4]
mov r8d, 0x104
call fcn.00410c00
lea rcx, [rbp + 0x170]
lea rdx, [rbp + 0x150]
mov rax, qword [0x008685b0]
mov r8d, dword [rax]
call fcn.00442f50
lea rcx, [rbp + 0x168]
mov rdx, qword [rbp + 0x150]
call fcn.0040fd00
lea rcx, [rbp + 0x168]
lea rdx, [rbp + 0x188]
call fcn.004430d0
mov rcx, qword [rbp + 0x188]
mov rdx, qword [rbp + 0x430]
call fcn.00411180
test eax, eax
jne 0x7eb3e1
lea rcx, [rbp + 0xa8]
mov edx, dword [rbp + 0x1b0]
call fcn.007e5340
lea rcx, [rbp + 0xb0]
mov rdx, qword [rbp + 0xa8]
call fcn.00432a30
lea rcx, [rbp + 0x420]
mov rdx, qword [rbp + 0xb0]
call fcn.00432820
mov rcx, qword [rbp + 0x420]
mov rdx, qword [rbp + 0x3e0]
call fcn.00411180
test eax, eax
jne 0x7eb3e1
mov rax, qword [rbp + 0x540]
mov ecx, dword [rbp + 0x1b0]
mov dword [rax], ecx
mov ecx, 0x410
xor edx, edx
mov rax, qword [rbp + 0x540]
mov r8d, dword [rax]
call sub.kernel32.dll_OpenProcess
mov rcx, qword [rbp + 0x538]
mov qword [rcx + 0x68], rax
mov byte [rbp + 0x4f7], 1
jmp 0x7eb487
cmp byte [rbp + 0x3ef], 0
je 0x7eb461
lea rcx, [rbp + 0xa0]
lea rdx, [0x007ebdb4]
mov r8d, 0x1bc64d
call fcn.0078b4d0
mov rcx, qword [rbp + 0x188]
mov rdx, qword [rbp + 0xa0]
call fcn.00411180
test eax, eax
jne 0x7eb461
mov eax, dword [rbp + 0x43c]
cmp eax, dword [rbp + 0x1b0]
je 0x7eb461
mov rax, qword [rbp + 0x540]
mov ecx, dword [rbp + 0x1b0]
mov dword [rax], ecx
mov ecx, 0x410
xor edx, edx
mov rax, qword [rbp + 0x540]
mov r8d, dword [rax]
call sub.kernel32.dll_OpenProcess
mov rcx, qword [rbp + 0x538]
mov qword [rcx + 0x68], rax
mov byte [rbp + 0x4f7], 1
jmp 0x7eb487
mov rcx, qword [rbp + 0x4f8]
lea rdx, [rbp + 0x1a8]
call fcn.0078b0a0
test eax, eax
sete al
or al, byte [rbp + 0x4f7]
test al, al
je 0x7eb2df
nop
nop
mov rcx, qword [rbp + 0x4f8]
call sub.kernel32.dll_CloseHandle
jmp 0x7eb4b1
mov rcx, 0xffffffffffe36ca1
mov edx, 0x1c935f
call fcn.0078b350
mov rcx, qword [rbp + 0x540]
mov ecx, dword [rcx]
cmp rcx, rax
jne 0x7eb514
call fcn.00438e90
movsd xmm1, qword [rbp + 0x418]
call fcn.00544610
mov rbx, rax
test rbx, rbx
jge 0x7eb4ed
neg rbx
mov rcx, 0xffffffffffeb80ab
mov edx, 0x147f5f
call fcn.0078b350
cmp rbx, rax
jge 0x7eb514
mov rax, qword [rbp + 0x530]
cmp byte [rax + 0x1a], 0
je 0x7eb27c
nop
lea rcx, [rbp + 0x3f8]
lea rdx, [rbp + 0x148]
mov rax, qword [0x008685b0]
mov r8d, dword [rax]
call fcn.00442f50
lea rcx, [rbp + 0x160]
mov rdx, qword [rbp + 0x148]
call fcn.0040fd00
lea rcx, [rbp + 0x98]
lea rdx, [0x007ebe04]
mov r8d, 0x15496e
call fcn.0078b4d0
mov rax, qword [rbp + 0x98]
mov qword [rbp + 0x140], rax
lea rcx, [rbp + 0x160]
mov rdx, qword [rbp + 0x140]
xor r8, r8
call fcn.00441bc0
test al, al
je 0x7eb942
nop
mov rcx, qword [rbp + 0x3f8]
call fcn.00434610
jmp 0x7eb942
lea rcx, [rbp + 0x410]
lea rdx, [0x007ebe44]
mov r8d, 0x1a1281
call fcn.0078b4d0
mov qword [rbp + 0x1a0], 0
lea rcx, [rbp + 0x4d0]
lea rdx, [0x007ebeac]
mov r8d, 0x1a4723
call fcn.0078b4d0
mov rcx, qword [rbp + 0x4d0]
call fcn.00410b10
mov rbx, rax
mov rcx, rbx
call sub.kernel32.dll_GetModuleHandleW
mov rsi, rax
mov rcx, qword [rbp + 0x410]
call fcn.00410b10
mov rcx, rsi
mov rdx, rax
call fcn.0041e340
mov qword [rbp + 0x4e8], rax
cmp qword [rbp + 0x4e8], 0
je 0x7eb63f
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
lea rdx, [rbp + 0x404]
call qword [rbp + 0x4e8]
jmp 0x7eb649
mov dword [rbp + 0x404], 0
cmp dword [rbp + 0x404], 0
je 0x7eb6a1
lea rcx, [rbp + 0x3f0]
lea rdx, [0x007ebef0]
mov r8d, 0x12aaf6
call fcn.0078b4d0
mov rcx, rbx
call sub.kernel32.dll_GetModuleHandleW
mov rbx, rax
mov rcx, qword [rbp + 0x3f0]
call fcn.00410b10
mov rcx, rbx
mov rdx, rax
call fcn.0041e340
mov qword [rbp + 0x4e0], rax
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x4e0]
mov rax, qword [rbp + 0x538]
mov rax, qword [rax + 0x20]
test rax, rax
je 0x7eb6b7
cmp word [rax], 0
jne 0x7eb6c5
lea rcx, [rbp + 0x408]
call fcn.0040f650
jmp 0x7eb70f
lea rcx, [rbp + 0x90]
lea rdx, [0x007ebf64]
mov r8d, 0x159ef5
call fcn.0078b4d0
lea rcx, [rbp + 0x88]
mov rax, qword [rbp + 0x538]
mov rdx, qword [rax + 0x20]
call fcn.00410ba0
lea rcx, [rbp + 0x408]
mov rdx, qword [rbp + 0x90]
mov r8, qword [rbp + 0x88]
call fcn.00410f70
cmp byte [rbp + 0x3ef], 0
je 0x7eb7b1
lea rcx, [rbp + 0x80]
lea rdx, [0x007ebfa4]
mov r8d, 0x10545b
call fcn.0078b4d0
lea rcx, [rbp + 0x78]
lea rdx, [0x007ebfdc]
mov r8d, 0x131bfc
call fcn.0078b4d0
lea rcx, [rbp + 0x70]
mov rax, qword [rbp + 0x538]
mov rdx, qword [rax + 0x18]
call fcn.00410ba0
lea rcx, [rbp + 0x68]
lea rdx, [0x007ec020]
mov r8d, 0x1dedee
call fcn.0078b4d0
lea rcx, [rbp + 0x428]
mov edx, 5
mov r8, qword [rbp + 0x80]
mov r9, qword [rbp + 0x408]
mov rax, qword [rbp + 0x78]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x68]
mov qword [rsp + 0x30], rax
call fcn.004110a0
jmp 0x7eb81f
lea rcx, [rbp + 0x60]
lea rdx, [0x007ec054]
mov r8d, 0x1e364d
call fcn.0078b4d0
lea rcx, [rbp + 0x58]
mov rax, qword [rbp + 0x538]
mov rdx, qword [rax + 0x18]
call fcn.00410ba0
lea rcx, [rbp + 0x50]
lea rdx, [0x007ec088]
mov r8d, 0x10febc
call fcn.0078b4d0
lea rcx, [rbp + 0x428]
mov edx, 4
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x58]
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x408]
mov qword [rsp + 0x28], rax
call fcn.004110a0
lea rdi, [rbp + 0x460]
xor eax, eax
mov ecx, 0xd
rep stosq qword [rdi], rax
mov dword [rbp + 0x460], 0x68
mov rcx, qword [rbp + 0x428]
call fcn.00410b10
mov rbx, rax
mov ecx, 0x108dda
mov edx, 0x108dda
call fcn.0078b350
xor ecx, ecx
mov rdx, rbx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x460]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x448]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x7eb8bd
mov byte [rbp + 0x4f7], 1
mov rax, qword [rbp + 0x538]
mov rcx, qword [rbp + 0x448]
mov qword [rax + 0x68], rcx
jmp 0x7eb8d4
mov rcx, qword [rbp + 0x538]
call sub.shell32.dll_ShellExecuteExW
test eax, eax
setne al
mov byte [rbp + 0x4f7], al
cmp dword [rbp + 0x404], 0
je 0x7eb942
cmp qword [rbp + 0x1a0], 0
je 0x7eb942
lea rcx, [rbp + 0x440]
lea rdx, [0x007ec0c4]
mov r8d, 0x12d8aa
call fcn.0078b4d0
mov rcx, qword [rbp + 0x4d0]
call fcn.00410b10
mov rcx, rax
call sub.kernel32.dll_GetModuleHandleW
mov rbx, rax
mov rcx, qword [rbp + 0x440]
call fcn.00410b10
mov rcx, rbx
mov rdx, rax
call fcn.0041e340
mov qword [rbp + 0x4d8], rax
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x4d8]
nop
lea rcx, [rbp + 0x50]
mov edx, 0x1d
call fcn.0040f730
lea rcx, [rbp + 0x148]
mov edx, 2
call fcn.0040f730
lea rcx, [rbp + 0x160]
mov edx, 4
call fcn.0040f730
lea rcx, [rbp + 0x188]
mov edx, 3
call fcn.0040f730
lea rcx, [rbp + 0x3e0]
call fcn.0040f650
lea rcx, [rbp + 0x3f0]
mov edx, 2
call fcn.0040f730
lea rcx, [rbp + 0x408]
mov edx, 2
call fcn.0040f730
lea rcx, [rbp + 0x420]
mov edx, 3
call fcn.0040f730
lea rcx, [rbp + 0x440]
call fcn.0040f650
lea rcx, [rbp + 0x4c8]
mov edx, 2
call fcn.0040f730
movzx rax, byte [rbp + 0x4f7]
lea rsp, [rbp + 0x508]
pop rbx
pop rsi
pop rdi
pop rbp
ret