Function at 0x1400041d0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x1c0], rbx
mov rax, qword [0x140133088]
xor rax, rsp
mov qword [rbp + 0x60], rax
movzx r13d, dl
mov r12, rcx
mov qword [rbp - 0x48], rcx
xor ebx, ebx
mov dword [rsp + 0x38], ebx
lea r8d, [rbx + 3]
lea rdx, [0x1400f5778]
call fcn.140009140
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
lea rcx, [rbp]
call fcn.140020150
nop
mov r8, rax
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140009de0
nop
lea rcx, [rbp]
call fcn.140002550
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x1400fe370]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp - 0x20], bx
lea r8d, [rbx + 0xc]
lea rdx, [0x1400f54e0]
lea rcx, [rbp - 0x20]
call fcn.1400025d0
nop
lea rcx, [rbp]
call fcn.140020150
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x1400fe370]
movdqu xmmword [rbp - 0x30], xmm1
mov word [rbp - 0x40], bx
lea rdx, [rbp - 0x40]
lea rcx, [rbp]
call fcn.140020da0
lea edx, [rbx + 0x10]
lea rcx, [rbp - 0x40]
call fcn.14001e5c0
nop
lea rcx, [rbp]
call fcn.140002550
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x40]
call fcn.14001eb30
nop
mov r15, qword [rsp + 0x28]
cmp qword [rsp + 0x30], r15
je 0x14000431d
mov qword [r15 + 0x10], rbx
mov qword [r15 + 0x18], rbx
movups xmm0, xmmword [rax]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r15 + 0x10], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
add r15, 0x20
mov qword [rsp + 0x28], r15
jmp 0x140004332
mov r8, rax
mov rdx, r15
lea rcx, [rsp + 0x20]
call fcn.140009de0
mov r15, qword [rsp + 0x28]
lea rcx, [rbp + 0x40]
call fcn.140002550
nop
mov dword [rsp + 0x38], ebx
lea rcx, [rbp - 0x40]
call fcn.140002550
nop
lea rcx, [rbp - 0x20]
call fcn.140002550
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400fe370]
movdqu xmmword [rbp + 0x30], xmm1
mov word [rbp + 0x20], bx
lea rcx, [rbp + 0x20]
call fcn.14002c110
test al, al
jne 0x14000439f
lea rcx, [rbp + 0x20]
call fcn.140002550
nop
lea rcx, [rsp + 0x20]
call fcn.140009090
nop
mov rcx, r12
call fcn.140002550
nop
xor al, al
jmp 0x14000463f
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rbx
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x1400fe370]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp - 0x20], bx
mov r8d, 0xc
lea rdx, str.cduninst.exe
lea rcx, [rbp - 0x20]
call fcn.1400025d0
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x40]
call fcn.14001eb30
nop
mov r8, rax
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.140009de0
nop
lea rcx, [rbp + 0x40]
call fcn.140002550
nop
lea rcx, [rbp - 0x20]
call fcn.140002550
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1400fe370]
movdqu xmmword [rbp + 0x10], xmm1
mov word [rbp], bx
mov r8d, 0xc
lea rdx, [0x1400f54e0]
lea rcx, [rbp]
call fcn.1400025d0
nop
lea r8, [rbp]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x40]
call fcn.14001eb30
nop
mov rdx, qword [rbp - 0x38]
cmp qword [rbp - 0x30], rdx
je 0x140004488
mov qword [rdx + 0x10], rbx
mov qword [rdx + 0x18], rbx
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
add rdx, 0x20
mov qword [rbp - 0x38], rdx
jmp 0x140004495
mov r8, rax
lea rcx, [rbp - 0x40]
call fcn.140009de0
nop
lea rcx, [rbp + 0x40]
call fcn.140002550
nop
lea rcx, [rbp]
call fcn.140002550
nop
mov r14d, ebx
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rbp - 0x40]
cmp rbx, r15
je 0x140004541
mov rcx, rbx
call fcn.140020be0
test al, al
je 0x1400044eb
movsxd rdi, r14d
shl rdi, 5
add rdi, rsi
mov rcx, rdi
call fcn.14002bf60
mov rdx, rdi
mov rcx, rbx
call fcn.14002be50
test al, al
je 0x1400044f4
add rbx, 0x20
inc r14d
jmp 0x1400044b5
dec r14d
test r14d, r14d
jle 0x140004512
mov ebx, r14d
nop
mov rcx, rsi
call fcn.14002bf60
add rsi, 0x20
sub rbx, 1
jne 0x140004500
lea rcx, [rbp - 0x40]
call fcn.140009090
nop
lea rcx, [rbp + 0x20]
call fcn.140002550
nop
lea rcx, [rsp + 0x20]
call fcn.140009090
nop
mov rcx, r12
call fcn.140002550
nop
xor al, al
jmp 0x14000463f
xor eax, eax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov dword [rbp - 0x54], eax
mov dword [rsp + 0x40], 0x70
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], 0x440
lea rcx, str.runas
lea rax, str.open
test r13b, r13b
cmovne rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsi + 0x18], 8
jb 0x14000459d
mov rsi, qword [rsi]
mov qword [rsp + 0x58], rsi
lea rax, [0x1400f4030]
mov qword [rsp + 0x68], rax
mov rax, r12
cmp qword [r12 + 0x18], 8
jb 0x1400045bd
mov rax, qword [r12]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x70], 1
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x140004605
lea rcx, [rbp - 0x40]
call fcn.140009090
nop
lea rcx, [rbp + 0x20]
call fcn.140002550
nop
lea rcx, [rsp + 0x20]
call fcn.140009090
nop
mov rcx, r12
call fcn.140002550
nop
xor al, al
jmp 0x14000463f
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140004615
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x40]
call fcn.140009090
nop
lea rcx, [rbp + 0x20]
call fcn.140002550
nop
lea rcx, [rsp + 0x20]
call fcn.140009090
nop
mov rcx, r12
call fcn.140002550
nop
mov al, 1
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1400a6810
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret