Function at 0x140022460
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x208]
sub rsp, 0x308
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140022aa7
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
xor r13d, r13d
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
lea r8d, [r13 + 8]
lea rdx, str.LWdsZ3I
lea rcx, [rbp - 0x60]
call fcn.140030750
nop
mov qword [rbp - 0x80], r13
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
xor r8d, r8d
lea r12, [0x1401e3cf8]
mov rdx, r12
lea rcx, [rbp - 0x80]
call fcn.140030750
nop
mov r8d, 0x104
lea rdx, [rbp - 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp - 0x80]
call fcn.14004f230
lea r14, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae r14, qword [rbp - 0x80]
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
lea rsi, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rsi, qword [rbp - 0x60]
movabs rbx, 0x7ffffffffffffffe
mov rdi, qword [rbp - 0x50]
cmp rdi, rbx
ja 0x140022ab2
lea r15d, [r13 + 0xa]
mov qword [rsp + 0x60], 7
cmp rdi, 8
jae 0x14002256f
mov qword [rsp + 0x58], rdi
lea r8d, [r13 + 0x10]
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140185440
jmp 0x1400225b5
mov rax, rdi
or rax, 7
cmp rax, rbx
ja 0x140022585
mov rbx, rax
cmp rax, r15
cmovb rbx, r15
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x48]
call fcn.140030fc0
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rbx
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.140185440
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x40]
call fcn.14004bc20
nop
mov r9, r14
mov r8, qword [rax]
lea rdx, str._ws__ws
lea rcx, [rsp + 0x40]
call fcn.140025c80
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140022600
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r13
mov r9, qword [rsp + 0x40]
lea r8, [rbp - 0x10]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp ebx, 0x20
ja 0x1400229e2
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140022ab8
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rbx, str.bnBtYnNhcg
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140031e00
test al, al
jne 0x14002268c
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x140022671
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140022ac3
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp + 0x268], rax
lea rbx, str.cGNqbV9iXWNwcG1w
mov rdx, rbx
lea rcx, [rbp + 0x268]
call fcn.140031e00
test al, al
jne 0x1400226ed
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400226d0
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x268]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140022ace
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp + 0x260], rax
lea rbx, str.Y0FtYmM7I2pz
mov rdx, rbx
lea rcx, [rbp + 0x260]
call fcn.140031e00
test al, al
jne 0x14002274d
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140022730
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x260]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140022ad9
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov r15, qword [rbp + 0x260]
lea rcx, [r15 - 0x18]
call fcn.1400318c0
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x38]
call fcn.14004beb0
nop
mov r8d, esi
mov rdx, qword [rax]
lea rcx, [rsp + 0x38]
call fcn.140025c80
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400227c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140022ae4
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp + 0x258], rax
mov rdx, r12
lea rcx, [rbp + 0x258]
call fcn.140031e00
test al, al
jne 0x14002281e
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [r12 + rax*2], 0
jne 0x140022800
mov r8d, eax
mov rdx, r12
lea rcx, [rbp + 0x258]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140022aef
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp + 0x250], rax
mov rdx, r12
lea rcx, [rbp + 0x250]
call fcn.140031e00
test al, al
jne 0x14002287e
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [r12 + rax*2], 0
jne 0x140022860
mov r8d, eax
mov rdx, r12
lea rcx, [rbp + 0x250]
call fcn.140032190
nop
mov r14, qword [rbp + 0x268]
lea rcx, [r14 - 0x18]
call fcn.1400318c0
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x28]
call fcn.14004beb0
mov rbx, rax
mov rsi, qword [rsp + 0x30]
lea rcx, [rsi - 0x18]
call fcn.1400318c0
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x30]
call fcn.14004beb0
nop
lea rcx, [rbp + 0x258]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x250]
lea r8, [rsp + 0x38]
mov rdx, rbx
mov rcx, rax
call fcn.140061870
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140022910
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002292e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x250]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002294f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x258]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140022970
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002298f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [r15 - 8], eax
sub eax, 1
jg 0x1400229ab
mov rcx, qword [r15 - 0x18]
mov rax, qword [rcx]
lea rdx, [r15 - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [r14 - 8], eax
sub eax, 1
jg 0x1400229c7
mov rcx, qword [r14 - 0x18]
mov rax, qword [rcx]
lea rdx, [r14 - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [rsi - 8], eax
sub eax, 1
jg 0x1400229e2
mov rcx, qword [rsi - 0x18]
mov rax, qword [rcx]
lea rdx, [rsi - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140022a22
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022a1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140022afa
call fcn.140183144
movdqa xmm0, xmmword [0x1401f49f0]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], r13w
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140022a71
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022a6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140022aa1
call fcn.140183144
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140022a8d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x308
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140189c24
nop
mov ecx, 0x80004005
call fcn.140032160
nop
call fcn.140030df0
int3
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
call fcn.140189c24
int3