Function at 0x5747a0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push rbp
sub rsp, 0x1a0
mov rbp, rsp
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0x100], 0
mov qword [rbp + 0xc8], rbp
mov qword [rbp + 0x1b0], rcx
mov qword [rbp + 0x1b8], rdx
mov qword [rbp + 0x1c0], r8
mov rcx, qword [rbp + 0x1b0]
call fcn.0040e540
mov rcx, qword [rbp + 0x1b8]
call fcn.0040e540
nop
mov byte [rbp + 0x197], 0
mov dword [rbp + 0x108], 0
lea rcx, [rbp + 0x110]
mov edx, 0x18
xor r8, r8
call fcn.0040a600
lea rcx, [rbp + 0x128]
mov edx, 0x68
xor r8, r8
call fcn.0040a600
mov dword [rbp + 0x128], 0x68
mov dword [rbp + 0x164], 1
mov word [rbp + 0x168], 5
lea rcx, [rbp + 0xc0]
mov rdx, qword [rbp + 0x1b0]
call fcn.0042db80
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0xf0], rax
lea rax, [0x00575040]
cmp qword [rbp + 0xf0], rax
jne 0x574910
mov byte [rbp + 0xef], 1
jmp 0x57494d
cmp qword [rbp + 0xf0], 0
je 0x574926
lea rax, [0x00575040]
test rax, rax
jne 0x57492f
mov byte [rbp + 0xef], 0
jmp 0x57494d
mov rcx, qword [rbp + 0xf0]
lea rdx, [0x00575040]
call fcn.0042bc30
test eax, eax
sete al
mov byte [rbp + 0xef], al
nop
cmp byte [rbp + 0xef], 0
je 0x574994
lea rcx, [rbp + 0x100]
mov edx, 4
lea r8, [0x00575058]
mov r9, qword [rbp + 0x1b0]
lea rax, [0x0057508c]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x1b8]
mov qword [rsp + 0x28], rax
call fcn.0040ff20
jmp 0x574a93
lea rcx, [rbp + 0xb8]
mov rdx, qword [rbp + 0x1b0]
call fcn.0042db80
mov rax, qword [rbp + 0xb8]
mov qword [rbp + 0xe0], rax
lea rax, [0x005750a0]
cmp qword [rbp + 0xe0], rax
jne 0x5749ce
mov byte [rbp + 0xdf], 1
jmp 0x574a0b
cmp qword [rbp + 0xe0], 0
je 0x5749e4
lea rax, [0x005750a0]
test rax, rax
jne 0x5749ed
mov byte [rbp + 0xdf], 0
jmp 0x574a0b
mov rcx, qword [rbp + 0xe0]
lea rdx, [0x005750a0]
call fcn.0042bc30
test eax, eax
sete al
mov byte [rbp + 0xdf], al
nop
cmp byte [rbp + 0xdf], 0
je 0x574a4f
lea rcx, [rbp + 0x100]
mov edx, 4
lea r8, [0x005750b8]
mov r9, qword [rbp + 0x1b0]
lea rax, [0x0057508c]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x1b8]
mov qword [rsp + 0x28], rax
call fcn.0040ff20
jmp 0x574a93
lea rcx, [rbp + 0x100]
mov edx, 5
lea r8, [0x005750e0]
mov r9, qword [rbp + 0x1b0]
lea rax, [0x005750e0]
mov qword [rsp + 0x20], rax
lea rax, [0x005750f0]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x1b8]
mov qword [rsp + 0x30], rax
call fcn.0040ff20
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x574ad0
lea rcx, [rbp + 0xb0]
lea rdx, [0x00575100]
mov r8, qword [rbp + 0x100]
call fcn.0040fe00
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0xb0]
call fcn.00553130
mov dword [rbp + 0xd8], 0
cmp qword [rbp + 0x100], 0
je 0x574af4
mov rax, qword [rbp + 0x100]
mov eax, dword [rax - 4]
mov dword [rbp + 0xd8], eax
mov ecx, dword [rbp + 0xd8]
add ecx, 2
add ecx, ecx
movsxd rcx, ecx
call fcn.00408c40
mov qword [rbp + 0xf8], rax
mov dword [rbp + 0xd4], 0
cmp qword [rbp + 0x100], 0
je 0x574b32
mov rax, qword [rbp + 0x100]
mov eax, dword [rax - 4]
mov dword [rbp + 0xd4], eax
mov rcx, qword [rbp + 0xf8]
mov edx, dword [rbp + 0xd4]
add edx, 2
add edx, edx
movsxd rdx, edx
xor r8, r8
call fcn.0040a600
mov rcx, qword [rbp + 0xf8]
mov rdx, qword [rbp + 0x100]
call fcn.0042ddd0
xor rcx, rcx
mov rdx, qword [rbp + 0xf8]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x128]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x110]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x574c24
mov byte [rbp + 0x197], 0
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x574c13
call sub.kernel32.dll_GetLastError_2
lea rcx, [rbp + 0xa0]
mov edx, eax
mov r8d, 8
call fcn.0042cbc0
lea rcx, [rbp + 0xa8]
lea rdx, [0x00575124]
mov r8, qword [rbp + 0xa0]
call fcn.0040fe00
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0xa8]
call fcn.00553130
mov rcx, qword [rbp + 0xf8]
call fcn.00408c70
jmp 0x574f68
mov rcx, qword [rbp + 0xf8]
call fcn.00408c70
cmp qword [rbp + 0x110], 0
je 0x574f5e
mov rcx, qword [rbp + 0x110]
or edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov dword [rbp + 0x10c], eax
cmp dword [rbp + 0x10c], 0
jne 0x574dac
mov rcx, qword [rbp + 0x110]
lea rdx, [rbp + 0x108]
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x574d49
cmp dword [rbp + 0x108], 0x103
je 0x574d1a
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x574cff
lea rcx, [rbp + 0x90]
mov edx, dword [rbp + 0x108]
mov r8d, 8
call fcn.0042cbc0
lea rcx, [rbp + 0x98]
mov edx, 4
lea r8, [0x00575100]
mov r9, qword [rbp + 0x1b0]
lea rax, [0x00575168]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x90]
mov qword [rsp + 0x28], rax
call fcn.0040ff20
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x98]
call fcn.00553130
mov rax, qword [rbp + 0x1c0]
mov ecx, dword [rbp + 0x108]
mov dword [rax], ecx
mov byte [rbp + 0x197], 1
jmp 0x574ed0
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x574d3d
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x00575190]
call fcn.00553130
mov byte [rbp + 0x197], 0
jmp 0x574ed0
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x574da0
call sub.kernel32.dll_GetLastError_2
lea rcx, [rbp + 0x80]
mov edx, eax
mov r8d, 8
call fcn.0042cbc0
lea rcx, [rbp + 0x88]
lea rdx, [0x005751f0]
mov r8, qword [rbp + 0x80]
call fcn.0040fe00
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x88]
call fcn.00553130
mov byte [rbp + 0x197], 0
jmp 0x574ed0
cmp dword [rbp + 0x10c], 0x102
jne 0x574de7
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x574ddb
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x0057525c]
call fcn.00553130
mov byte [rbp + 0x197], 0
jmp 0x574ed0
cmp dword [rbp + 0x10c], 0x80
jne 0x574e22
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x574e16
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x005752c0]
call fcn.00553130
mov byte [rbp + 0x197], 0
jmp 0x574ed0
cmp dword [rbp + 0x10c], 0xffffffff
jne 0x574e7f
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x574e76
call sub.kernel32.dll_GetLastError_2
lea rcx, [rbp + 0x70]
mov edx, eax
mov r8d, 8
call fcn.0042cbc0
lea rcx, [rbp + 0x78]
lea rdx, [0x0057531c]
mov r8, qword [rbp + 0x70]
call fcn.0040fe00
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x78]
call fcn.00553130
mov byte [rbp + 0x197], 0
jmp 0x574ed0
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x574ec9
lea rcx, [rbp + 0x60]
mov edx, dword [rbp + 0x10c]
mov r8d, 8
call fcn.0042cbc0
lea rcx, [rbp + 0x68]
lea rdx, [0x00575398]
mov r8, qword [rbp + 0x60]
call fcn.0040fe00
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x68]
call fcn.00553130
mov byte [rbp + 0x197], 0
nop
mov rcx, qword [rbp + 0x110]
call sub.kernel32.dll_CloseHandle_1
jmp 0x574f67
mov byte [rbp + 0x197], 0
jmp 0x574f68
nop
lea rcx, [rbp + 0x50]
mov edx, 0xf
call fcn.0040e490
lea rcx, [rbp + 0x100]
call fcn.0040e3b0
lea rcx, [rbp + 0x1b0]
mov edx, 2
call fcn.0040e490
movzx rax, byte [rbp + 0x197]
lea rsp, [rbp + 0x1a0]
pop rbp
ret