Function at 0x140039250
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
xor r14d, r14d
mov qword [rbp - 0x79], r14
mov qword [rbp - 0x69], r14
mov qword [rbp - 0x61], 7
lea r8d, [r14 + 0xb]
lea rdx, str.miareys.sys
lea rcx, [rbp - 0x79]
call fcn.140045f10
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x19]
call fcn.140038d70
nop
mov qword [rbp - 0x59], r14
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], 7
lea r8d, [r14 + 0xb]
lea rdx, str.miareys.exe
lea rcx, [rbp - 0x59]
call fcn.140045f10
lea rdx, [rbp - 0x59]
lea rcx, [rbp + 7]
call fcn.140038d70
nop
mov qword [rbp - 0x79], r14
mov qword [rbp - 0x69], r14
mov qword [rbp - 0x61], r14
lea rdi, [rbp - 0x19]
mov r15, qword [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdi, r15
movabs rax, 0x7ffffffffffffffe
movabs rdx, 0x7fffffffffffffff
mov rsi, qword [rbp - 9]
cmp rsi, 8
jae 0x14003931b
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x79], xmm0
lea ebx, [r14 + 7]
jmp 0x14003939a
mov rbx, rsi
or rbx, 7
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, rdx
ja 0x1400398a5
add rcx, rcx
cmp rcx, 0x1000
jb 0x140039374
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400398a5
mov rcx, rax
call fcn.1400aa54c
mov rcx, rax
test rax, rax
je 0x14003936d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140039383
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140039380
call fcn.1400aa54c
jmp 0x140039383
mov rax, r14
mov qword [rbp - 0x79], rax
lea r8, [rsi*2 + 2]
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x69], rsi
mov qword [rbp - 0x61], rbx
lea rcx, [rbp - 0x79]
call fcn.140038f70
mov qword [rbp - 0x79], r14
mov qword [rbp - 0x69], r14
mov qword [rbp - 0x61], r14
lea rdi, [rbp + 7]
mov r13, qword [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rdi, r13
mov r12, qword [rbp + 0x17]
cmp r12, 8
jae 0x1400393e3
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x79], xmm0
mov ebx, 7
jmp 0x140039476
mov rbx, r12
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14003989f
add rcx, rcx
cmp rcx, 0x1000
jb 0x140039450
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003989f
mov rcx, rax
call fcn.1400aa54c
mov rcx, rax
test rax, rax
je 0x140039449
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003945f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14003945c
call fcn.1400aa54c
jmp 0x14003945f
mov rax, r14
mov qword [rbp - 0x79], rax
lea r8, [r12*2 + 2]
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x69], r12
mov qword [rbp - 0x61], rbx
lea rcx, [rbp - 0x79]
call fcn.1400390e0
mov qword [rbp - 0x79], r14
mov qword [rbp - 0x69], r14
mov qword [rbp - 0x61], r14
lea r14, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae r14, r15
cmp rsi, 8
jae 0x1400394bc
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x79], xmm0
mov edi, 7
mov rbx, qword [rbp - 0x79]
jmp 0x14003954b
mov rdi, rsi
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400398b7
add rcx, rcx
cmp rcx, 0x1000
jb 0x140039523
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400398b7
mov rcx, rax
call fcn.1400aa54c
test rax, rax
je 0x1400397ee
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140039534
test rcx, rcx
je 0x14003952f
call fcn.1400aa54c
jmp 0x140039531
xor eax, eax
mov rbx, rax
mov qword [rbp - 0x79], rbx
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, rdi
mov qword [rbp - 0x61], rdi
mov qword [rbp - 0x69], rsi
lea rcx, [rbp - 0x59]
mov qword [rbp + 0x67], rcx
xor edx, edx
mov qword [rbp - 0x59], rdx
mov qword [rbp - 0x49], rdx
mov qword [rbp - 0x41], rdx
lea r15, [rbp - 0x79]
cmp rax, 8
cmovae r15, rbx
cmp rsi, 8
jae 0x14003958f
movups xmm0, xmmword [r15]
movups xmmword [rbp - 0x59], xmm0
lea r14d, [rdx + 7]
jmp 0x140039621
mov r14, rsi
or r14, 7
movabs rax, 0x7ffffffffffffffe
cmp r14, rax
cmova r14, rax
lea rcx, [r14 + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400398b1
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400395f9
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400398b1
mov rcx, rax
call fcn.1400aa54c
mov rcx, rax
test rax, rax
je 0x1400397b2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140039608
test rcx, rcx
je 0x140039605
call fcn.1400aa54c
jmp 0x140039608
mov rax, rdx
mov qword [rbp - 0x59], rax
lea r8, [rsi*2 + 2]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor edx, edx
mov qword [rbp - 0x49], rsi
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x39], rdx
mov qword [rbp - 0x29], rdx
mov qword [rbp - 0x21], rdx
lea r15, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae r15, r13
cmp r12, 8
jae 0x14003965a
movups xmm0, xmmword [r15]
movups xmmword [rbp - 0x39], xmm0
mov esi, 7
jmp 0x1400396f3
mov rsi, r12
or rsi, 7
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
cmova rsi, rax
lea rcx, [rsi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400398ab
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400396c7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400398ab
mov rcx, rax
call fcn.1400aa54c
mov rcx, rax
test rax, rax
je 0x1400396c0
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400396d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400396d3
call fcn.1400aa54c
jmp 0x1400396d6
mov rax, rdx
mov qword [rbp - 0x39], rax
lea r8, [r12*2 + 2]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov r14, qword [rbp - 0x41]
xor edx, edx
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], rsi
lea r9, [rbp - 0x59]
cmp r14, 8
cmovae r9, qword [rbp - 0x59]
lea r8, [rbp - 0x39]
cmp rsi, 8
cmovae r8, qword [rbp - 0x39]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rdx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x140039769
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039764
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400397b2
call fcn.1400aa4d4
xor eax, eax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], 7
mov word [rbp - 0x39], ax
mov rdx, qword [rbp - 0x41]
cmp rdx, 8
jb 0x1400397bf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400397b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400397b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400aa4d4
nop
cmp rdi, 8
jb 0x1400397fe
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400397f5
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400397f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400aa4d4
nop
mov rax, qword [rbp + 0x1f]
cmp rax, 8
jb 0x140039841
lea rdx, [rax*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x140039838
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039838
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r13
call fcn.1400aa4d4
nop
mov rax, qword [rbp - 1]
cmp rax, 8
jb 0x140039884
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003987f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003987f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400aa4d4
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140038a70
nop
call fcn.140038a70
nop
call fcn.140038a70
nop
call fcn.140038a70
nop
call fcn.140038a70
int3