Function at 0x1400713f0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x1400fec00]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov r12, rcx
mov qword [rbp - 0x68], rcx
xor r13d, r13d
mov esi, r13d
mov dword [rsp + 0x30], r13d
mov ecx, 4
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov eax, dword [rcx + rdx]
cmp dword [0x1401064d8], eax
jle 0x140071484
lea rcx, [0x1401064d8]
call fcn.1400b4020
cmp dword [0x1401064d8], 0xffffffff
jne 0x140071484
lea rcx, [0x1400d3ad0]
call fcn.1400b43cc
nop
lea rcx, [0x1401064d8]
call fcn.1400b3fb4
mov rax, qword [r12]
mov r15, r13
test rax, rax
je 0x14007149c
mov ecx, 0x5a4d
cmp cx, word [rax]
sete r15b
lea r14, str..exe
movzx ebx, byte [rsp + 0x34]
test r15, r15
je 0x1400714d1
mov rax, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x1400714ba
mov rax, qword [r14]
cmp qword [r14 + 0x10], 4
jne 0x140071a80
cmp dword [rax], 0x6578652e
jne 0x140071a80
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], send
mov byte [rsp + 0x38], 0
or esi, 1
mov dword [rsp + 0x30], esi
mov edi, reloc.SHLWAPI.dll_SHCreateMemStream
movabs r13, 0x948b0fcd6e9e0653
lea r12, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_________._
call fcn.14009e560
movsxd rcx, eax
mov rax, r13
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 6
imul rax, rax, 0x51
sub rcx, rax
movzx r9d, byte [rcx + r12]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
cmp rcx, rdx
jae 0x14007156f
lea rax, [rcx + 1]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x38]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140071582
movzx r8d, bl
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.140045510
sub rdi, 1
jne 0x140071513
mov r12, qword [rbp - 0x68]
xor r13d, r13d
mov rdx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x14007159c
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rsp + 0x38]
call fcn.140040af0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], send
mov byte [rax], 0
or esi, 2
mov dword [rsp + 0x30], esi
lea rax, [rbp - 0x60]
mov qword [rbp + 0x10], rax
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rax, qword [rsp + 0x58]
mov qword [rbp - 0x10], rax
mov rax, qword [rsp + 0x68]
mov qword [rbp - 8], rax
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp], xmm0
lea rdx, [rbp]
lea rcx, [rbp - 0x60]
call fcn.14004bec0
or esi, 4
mov dword [rsp + 0x30], esi
and esi, 0xfffffffb
mov dword [rsp + 0x30], esi
lea rcx, [rbp - 0x40]
call fcn.14007f8c0
or esi, 8
mov dword [rsp + 0x30], esi
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x48]
call fcn.14002d230
nop
and esi, 0xfffffff7
mov dword [rsp + 0x30], esi
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140071696
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140071691
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140071ad0
call fcn.1400b3f70
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x1400716e7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400716e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140071ad6
call fcn.1400b3f70
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r13w
and esi, 0xfffffffd
mov dword [rsp + 0x30], esi
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14007173c
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140071737
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140071adc
call fcn.1400b3f70
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], send
mov byte [rsp + 0x58], 0
and esi, 0xfffffffe
mov dword [rsp + 0x30], esi
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140071793
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007178e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140071ae2
call fcn.1400b3f70
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], send
mov byte [rsp + 0x38], 0
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x70]
call fcn.1400c1030
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 7
cmova rdx, qword [rbp + 0x48]
mov r8d, 0x22
lea rcx, [rbp + 0x70]
call fcn.140064470
nop
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x70], rdi
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x6c], edx
cmp qword [rbp + 0xf8], 0
je 0x1400719a8
mov rdx, qword [r12]
mov r8, qword [r12 + 8]
sub r8, rdx
lea rcx, [rbp + 0x70]
call fcn.140063520
lea rcx, [rbp + 0x70]
call fcn.140046b80
lea rcx, [rbp + 0x78]
call fcn.140051bc0
test rax, rax
jne 0x140071871
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
mov eax, 6
cmp qword [rbp + rcx + 0xb8], 0
mov edx, 2
cmovne eax, edx
or eax, dword [rbp + rcx + 0x80]
and eax, 0x17
mov dword [rbp + rcx + 0x80], eax
and eax, dword [rbp + rcx + 0x84]
jne 0x140071ae8
call fcn.1400816f0
lea rdx, str.open
test eax, eax
lea rax, str.runas
cmovne rdx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400718a0
lea rcx, [rbp + 0x28]
call fcn.1400348f0
nop
lea rdx, [rbp + 0x48]
lea rcx, [rsp + 0x78]
call fcn.140034b80
or esi, 0x10
mov dword [rsp + 0x30], esi
lea r8, [rsp + 0x78]
cmp qword [rbp - 0x70], 7
cmova r8, qword [rsp + 0x78]
lea rdx, [rbp + 0x28]
cmp qword [rbp + 0x40], 7
cmova rdx, qword [rbp + 0x28]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
and esi, 0xffffffef
mov dword [rsp + 0x30], esi
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x140071945
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140071940
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140071b37
call fcn.1400b3f70
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r13w
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x140071997
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140071992
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140071ac4
call fcn.1400b3f70
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
lea rax, [rbp + 0x118]
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x70], rdi
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x6c], edx
lea rcx, [rbp + 0x78]
call fcn.140051500
nop
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x70], rax
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x6c], edx
lea rax, [rbp + 0x118]
mov qword [rbp + 0x20], rax
lea rax, vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x118], rax
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 0x118]
call fcn.1400bb8f0
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 7
jbe 0x140071a6f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140071a6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140071aca
call fcn.1400b3f70
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], 7
mov word [rbp + 0x48], r13w
add r14, 0x20
lea rax, [0x1400fee50]
cmp r14, rax
jne 0x1400714a8
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1400b3f50
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140097c38
nop
call fcn.140097c38
nop
call fcn.140097c38
nop
call fcn.140097c38
nop
call fcn.140097c38
nop
call fcn.140097c38
nop
test al, 4
je 0x140071af5
lea rbx, str.ios_base::badbit_set
jmp 0x140071b09
test dl, al
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rbp]
call fcn.14002b5f0
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.14002c7e0
lea rdx, [0x1400fb980]
lea rcx, [rbp - 0x40]
call fcn.1400b65a4
nop
call fcn.140097c38
int3