Function at 0x140105420
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x178
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], 0xfffffffffffffffe
mov qword [rbp + 0xa0], rcx
mov qword [rbp + 0xd8], 1
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov r15, qword [rdx]
mov qword [rbp + 0xa8], rdx
mov rax, qword [rdx + 0x10]
shl rax, 5
add rax, r15
mov qword [rbp + 0xd0], rax
jmp 0x140105484
add r15, 0x20
cmp r15, qword [rbp + 0xd0]
je 0x1401059ff
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
mov rcx, rbp
call fcn.14022ebb0
mov rdx, qword [rbp + 0xe8]
cmp rdx, qword [rbp + 0xe0]
jne 0x1401054c3
lea rcx, [rbp + 0xd8]
call fcn.1400e9e50
mov rdx, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xd8]
mov byte [rax + rdx], 0x20
mov rdi, qword [rbp + 0xe8]
inc rdi
mov qword [rbp + 0xe8], rdi
mov rsi, qword [rbp]
mov r13, qword [rbp + 8]
test rsi, rsi
mov r12, rsi
cmove r12, r13
mov rbx, qword [rbp + 0x10]
test rbx, rbx
je 0x140105940
lea r14, [r12 + rbx]
mov rax, r12
jmp 0x140105519
cmp rax, r14
je 0x14010598e
movzx r9d, byte [rax]
movzx ecx, r9b
test cl, cl
js 0x140105540
inc rax
cmp ecx, 0x22
jbe 0x1401055d0
jmp 0x140105510
mov edx, ecx
and edx, 0x1f
movzx r10d, byte [rax + 1]
and r10d, 0x3f
cmp cl, 0xdf
jbe 0x140105599
movzx r8d, byte [rax + 2]
shl r10d, 6
and r8d, 0x3f
or r8d, r10d
cmp r9b, 0xf0
jb 0x1401055af
movzx ecx, byte [rax + 3]
and edx, 7
shl edx, 0x12
shl r8d, 6
and ecx, 0x3f
or ecx, r8d
or ecx, edx
cmp ecx, 0x110000
je 0x14010598e
add rax, 4
cmp ecx, 0x22
jbe 0x1401055d0
jmp 0x140105510
add rax, 2
shl edx, 6
or edx, r10d
mov ecx, edx
cmp ecx, 0x22
jbe 0x1401055d0
jmp 0x140105510
add rax, 3
shl edx, 0xc
or r8d, edx
mov ecx, r8d
cmp ecx, 0x22
ja 0x140105510
nop word cs:[rax + rax]
mov ecx, ecx
movabs rdx, 0x500000200
bt rdx, rcx
jae 0x140105510
cmp rdi, qword [rbp + 0xe0]
jne 0x140105605
lea rcx, [rbp + 0xd8]
mov rdx, rdi
call fcn.1400e9e50
mov rdi, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xd8]
mov byte [rax + rdi], 0x22
jmp 0x140105631
mov rdi, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xd8]
mov byte [rax + rdi], bl
mov rdi, qword [rbp + 0xe8]
inc rdi
jmp 0x140105655
mov rdi, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xd8]
mov word [rax + rdi], 0x225c
add rdi, 2
mov qword [rbp + 0xe8], rdi
cmp r12, r14
je 0x1401058f0
movzx ecx, byte [r12]
movzx ebx, cl
test bl, bl
js 0x140105680
inc r12
cmp ebx, 0x22
jne 0x1401056f0
jmp 0x1401057c0
mov eax, ebx
and eax, 0x1f
movzx edx, byte [r12 + 1]
and edx, 0x3f
cmp bl, 0xdf
jbe 0x1401056d0
movzx ebx, byte [r12 + 2]
shl edx, 6
and ebx, 0x3f
or ebx, edx
cmp cl, 0xf0
jb 0x1401057a2
movzx ecx, byte [r12 + 3]
add r12, 4
and eax, 7
shl eax, 0x12
shl ebx, 6
and ecx, 0x3f
or ecx, ebx
or ecx, eax
mov ebx, ecx
cmp ebx, 0x22
jne 0x1401056f0
jmp 0x1401057c0
add r12, 2
shl eax, 6
or eax, edx
mov ebx, eax
cmp ebx, 0x22
je 0x1401057c0
nop word cs:[rax + rax]
cmp ebx, 0x5c
je 0x140105760
cmp ebx, 0x110000
je 0x1401058f0
cmp ebx, 0x80
jb 0x1401058c0
mov dword [rbp + 0xb0], 0
mov eax, ebx
cmp ebx, 0x800
jae 0x1401057ee
shr eax, 6
or al, 0xc0
mov byte [rbp + 0xb0], al
and bl, 0x3f
or bl, 0x80
mov byte [rbp + 0xb1], bl
mov ebx, 2
mov rax, qword [rbp + 0xe0]
sub rax, rdi
cmp rax, rbx
jb 0x14010587b
jmp 0x140105894
mov rax, qword [rbp + 0xe0]
sub rax, rdi
cmp rax, 1
ja 0x14010578c
mov r8d, 2
lea rcx, [rbp + 0xd8]
mov rdx, rdi
call fcn.14025a040
mov rdi, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xd8]
mov word [rax + rdi], 0x5c5c
add rdi, 2
jmp 0x140105655
add r12, 3
shl eax, 0xc
or ebx, eax
cmp ebx, 0x22
jne 0x1401056f0
nop word cs:[rax + rax]
mov rax, qword [rbp + 0xe0]
sub rax, rdi
cmp rax, 1
ja 0x140105644
mov r8d, 2
lea rcx, [rbp + 0xd8]
mov rdx, rdi
call fcn.14025a040
jmp 0x14010563d
cmp ebx, 0x10000
jae 0x140105832
shr eax, 0xc
or al, 0xe0
mov byte [rbp + 0xb0], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rbp + 0xb1], al
and bl, 0x3f
or bl, 0x80
mov byte [rbp + 0xb2], bl
mov ebx, 3
mov rax, qword [rbp + 0xe0]
sub rax, rdi
cmp rax, rbx
jb 0x14010587b
jmp 0x140105894
shr eax, 0x12
or al, 0xf0
mov byte [rbp + 0xb0], al
mov eax, ebx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [rbp + 0xb1], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rbp + 0xb2], al
and bl, 0x3f
or bl, 0x80
mov byte [rbp + 0xb3], bl
mov ebx, 4
mov rax, qword [rbp + 0xe0]
sub rax, rdi
cmp rax, rbx
jae 0x140105894
lea rcx, [rbp + 0xd8]
mov rdx, rdi
mov r8, rbx
call fcn.14025a040
mov rdi, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xd8]
add rcx, rdi
lea rdx, [rbp + 0xb0]
mov r8, rbx
call fcn.140258050
add rdi, rbx
jmp 0x140105655
cmp rdi, qword [rbp + 0xe0]
jne 0x140105627
lea rcx, [rbp + 0xd8]
mov rdx, rdi
call fcn.1400e9e50
jmp 0x140105620
cmp rdi, qword [rbp + 0xe0]
jne 0x14010590f
lea rcx, [rbp + 0xd8]
mov rdx, rdi
call fcn.1400e9e50
mov rdi, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xd8]
mov byte [rax + rdi], 0x22
mov rdi, qword [rbp + 0xe8]
inc rdi
mov qword [rbp + 0xe8], rdi
test rsi, rsi
jne 0x1401059e0
jmp 0x140105480
mov rax, qword [rbp + 0xe0]
sub rax, rdi
cmp rax, 1
ja 0x14010596c
mov r8d, 2
lea rcx, [rbp + 0xd8]
mov rdx, rdi
call fcn.14025a040
mov rdi, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xd8]
mov word [rax + rdi], 0x2222
add rdi, 2
mov qword [rbp + 0xe8], rdi
test rsi, rsi
jne 0x1401059e0
jmp 0x140105480
mov rax, qword [rbp + 0xe0]
sub rax, rdi
cmp rax, rbx
jae 0x1401059b6
lea rcx, [rbp + 0xd8]
mov rdx, rdi
mov r8, rbx
call fcn.14025a040
mov rdi, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xd8]
add rcx, rdi
mov rdx, r12
mov r8, rbx
call fcn.140258050
add rdi, rbx
mov qword [rbp + 0xe8], rdi
test rsi, rsi
je 0x140105480
nop
test r13, r13
je 0x140105480
mov r8d, 1
mov rcx, rsi
mov rdx, r13
call fcn.140104c30
jmp 0x140105480
mov rcx, qword [rbp + 0xa8]
mov rax, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x28]
add rcx, rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rcx
mov word [rbp - 0x28], 0
mov dword [rbp - 0x20], 1
lea rcx, [rbp + 0x70]
lea rdx, [rbp - 0x38]
call fcn.140104c70
mov rax, qword [rbp + 0xd8]
mov rcx, qword [rbp + 0xe8]
add rcx, rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rcx
mov word [rbp - 0x48], 0
mov dword [rbp - 0x40], 1
lea rcx, [rbp - 0x18]
lea rdx, [rbp - 0x58]
call fcn.140104c70
mov rsi, qword [rbp + 0x70]
mov rax, qword [rbp - 0x18]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0xa8]
mov bl, byte [rax + 0x39]
mov dword [rbp + 0xcc], 0
xorps xmm0, xmm0
movaps xmmword [rbp + 0x60], xmm0
movaps xmmword [rbp + 0x50], xmm0
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
lea rax, str.runas
mov qword [rbp + 0xb0], rax
lea rax, [0x14067d746]
mov qword [rbp + 0xb8], rax
mov word [rbp + 0xc0], 0
lea rcx, [rbp + 0x88]
lea rdx, [rbp + 0xb0]
call fcn.140105070
mov r15, qword [rbp + 0xa0]
xor ecx, ecx
mov edx, 6
call qword [sym.imp.ole32.dll_CoInitializeEx]
xor eax, eax
test bl, bl
sete al
movabs rcx, 0x14000000070
mov qword [rbp], rcx
mov rdi, qword [rbp + 0x88]
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], rsi
mov rcx, qword [rbp + 0xd0]
mov qword [rbp + 0x20], rcx
mov dword [rbp + 0x30], eax
mov rcx, rbp
call qword [sym.imp.shell32.dll_ShellExecuteExW]
test eax, eax
je 0x140105b8a
mov rcx, qword [rbp + 0x68]
test rcx, rcx
je 0x140105b8a
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x68]
lea rdx, [rbp + 0xcc]
call qword [sym.imp.kernel32.dll_GetExitCodeProcess]
mov ebx, eax
mov r14d, dword [rbp + 0xcc]
mov rdx, qword [rbp + 0x90]
test rdx, rdx
je 0x140105b7e
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140104c30
xor eax, eax
cmp ebx, 1
sbb eax, eax
or eax, r14d
jmp 0x140105bac
mov rdx, qword [rbp + 0x90]
test rdx, rdx
je 0x140105ba7
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140104c30
mov eax, 0xffffffff
mov dword [r15 + 4], eax
mov dword [r15], 0
mov rdx, qword [rbp - 0x10]
test rdx, rdx
je 0x140105bd5
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0xd0]
call fcn.140104c30
mov rdx, qword [rbp + 0x78]
test rdx, rdx
je 0x140105bef
add rdx, rdx
mov r8d, 2
mov rcx, rsi
call fcn.140104c30
mov rdx, qword [rbp + 0xe0]
test rdx, rdx
je 0x140105c0d
mov rcx, qword [rbp + 0xd8]
mov r8d, 1
call fcn.140104c30
mov rax, r15
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret