Function at 0x4d41c0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x30], rdx
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0
mov rax, qword [rbp + 0x30]
mov qword [rax], 0
nop
mov rcx, qword [rbp + 0x30]
call fcn.004100d0
xor rax, rax
mov byte [rbp + 0x3f], al
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 0x68]
xor rdx, rdx
call qword [0x00bc3730]
test eax, eax
je 0x4d461a
mov dword [rbp + 0x6c], 4
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 0x68]
mov edx, 0x20000013
xor r8, r8
lea r9, [rbp + 0x68]
lea rax, [rbp + 0x6c]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
call qword [0x00bc3738]
test eax, eax
je 0x4d450e
mov eax, dword [rbp + 0x68]
sub eax, 0xc8
test eax, eax
je 0x4d4281
sub eax, 0x65
cmp eax, 3
jb 0x4d429d
sub eax, 0x64
test eax, eax
je 0x4d43b1
sub eax, 6
test eax, eax
jne 0x4d450e
jmp 0x4d44a4
mov rcx, qword [rbp + 0x40]
movzx rax, byte [rcx + 0xca]
mov byte [rcx + 0xcb], al
mov al, 1
mov byte [rbp + 0x3f], al
jmp 0x4d450e
mov dword [rbp + 0x6c], 0
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 0x68]
mov edx, 0x21
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x6c]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
call qword [0x00bc3738]
test eax, eax
jne 0x4d450e
cmp dword [rbp + 0x6c], 0
jbe 0x4d450e
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x4d450e
lea rcx, [rbp + 0x50]
mov edx, dword [rbp + 0x6c]
xor r8, r8
call fcn.00411590
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 0x68]
mov edx, 0x21
xor r8, r8
mov r9, qword [rbp + 0x50]
lea rax, [rbp + 0x6c]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
call qword [0x00bc3738]
test eax, eax
je 0x4d450e
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x50]
call fcn.00411eb0
lea rcx, [0x00b2dba0]
mov rdx, qword [rbp + 0x48]
xor r8, r8
call fcn.00411660
cmp byte [0x00b2db98], 0
je 0x4d4395
mov rax, qword [rbp + 0x40]
cmp byte [rax + 0x20], 0
jne 0x4d4395
mov rcx, qword [0x00b2dba0]
call fcn.00411320
xor rcx, rcx
xor rdx, rdx
mov r8, rax
xor r9, r9
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 1
call sub.shell32.dll_ShellExecuteA
mov rcx, qword [rbp + 0x40]
movzx rax, byte [rcx + 0xca]
mov byte [rcx + 0xcb], al
mov al, 1
mov byte [rbp + 0x3f], al
jmp 0x4d450e
mov rax, qword [rbp + 0x40]
cmp byte [rax + 0xca], 0
je 0x4d43cb
mov rax, qword [rbp + 0x40]
mov byte [rax + 0xcb], 0
jmp 0x4d43d6
mov rax, qword [rbp + 0x40]
mov byte [rax + 0xca], 1
mov rax, qword [rbp + 0x40]
cmp byte [rax + 0xb1], 0
jne 0x4d450e
mov rax, qword [rbp + 0x40]
cmp qword [rax + 0x38], 0
je 0x4d450e
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 0x68]
lea rdx, [rbp + 0x64]
lea r8, [rbp + 0x60]
lea r9, [rbp + 0x5c]
call qword [0x00bc3740]
test eax, eax
je 0x4d450e
mov rax, qword [rbp + 0x40]
mov byte [rax + 0xb1], 1
mov rcx, rbp
mov edx, dword [rbp + 0x64]
call fcn.004d4160
mov rcx, qword [rbp + 0x40]
mov dword [rcx + 0xb4], eax
mov rax, qword [rbp + 0x40]
cmp dword [rax + 0xb4], 0
je 0x4d450e
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 0x38]
call fcn.00411e10
mov rbx, rax
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 0x40]
call fcn.00411e10
mov rcx, qword [rbp + 0x40]
mov rcx, qword [rcx + 0x68]
xor rdx, rdx
mov r8, qword [rbp + 0x40]
mov r8d, dword [r8 + 0xb4]
mov r9, rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
call qword [0x00bc3748]
test eax, eax
setne al
mov rcx, qword [rbp + 0x40]
mov byte [rcx + 0xb0], al
jmp 0x4d450e
mov rax, qword [rbp + 0x40]
cmp byte [rax + 0xb8], 0
jne 0x4d450e
mov rax, qword [rbp + 0x40]
cmp qword [rax + 0x48], 0
je 0x4d450e
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 0x68]
lea rdx, [rbp + 0x64]
lea r8, [rbp + 0x60]
lea r9, [rbp + 0x5c]
call qword [0x00bc3740]
test eax, eax
je 0x4d450e
mov rax, qword [rbp + 0x40]
mov byte [rax + 0xb8], 1
mov rcx, rbp
mov edx, dword [rbp + 0x64]
call fcn.004d4160
mov rcx, qword [rbp + 0x40]
mov dword [rcx + 0xbc], eax
cmp dword [rcx + 0xbc], 0
setne al
mov rcx, qword [rbp + 0x40]
mov byte [rcx + 0xb0], al
movzx rax, byte [rbp + 0x3f]
test al, al
je 0x4d4657
jmp 0x4d4565
lea rcx, [rbp + 0x50]
mov edx, dword [rbp + 0x6c]
xor r8, r8
call fcn.00411590
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 0x68]
mov rdx, qword [rbp + 0x50]
mov r8d, dword [rbp + 0x6c]
lea r9, [rbp + 0x6c]
call qword [0x00bc3758]
test eax, eax
je 0x4d4581
mov rcx, qword [rbp + 0x50]
call fcn.004108b0
cmp dword [rbp + 0x6c], eax
jne 0x4d4581
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x50]
call fcn.00410e60
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 0x68]
lea rdx, [rbp + 0x6c]
call qword [0x00bc3750]
test eax, eax
je 0x4d4581
cmp dword [rbp + 0x6c], 0
ja 0x4d451d
nop
mov rcx, qword [rbp + 0x30]
lea rdx, [0x004d46c8]
lea r8, [0x004d46dc]
xor r9, r9
mov rax, qword [0x00bb82f0]
call qword [rax]
mov rcx, qword [rbp + 0x30]
lea rdx, [0x004d46ec]
lea r8, [0x004d4700]
xor r9, r9
mov rax, qword [0x00bb82f0]
call qword [rax]
mov rcx, qword [rbp + 0x30]
lea rdx, [0x004d4710]
lea r8, [0x004d4724]
xor r9, r9
mov rax, qword [0x00bb82f0]
call qword [rax]
mov rcx, qword [rbp + 0x30]
lea rdx, [0x004d4734]
lea r8, [0x004d4748]
xor r9, r9
mov rax, qword [0x00bb82f0]
call qword [rax]
mov rcx, qword [rbp + 0x30]
lea rdx, [0x004d4758]
lea r8, [0x004d476c]
xor r9, r9
mov rax, qword [0x00bb82f0]
call qword [rax]
jmp 0x4d4657
mov rax, qword [rbp + 0x40]
cmp dword [rax + 0xb4], 0
jne 0x4d4641
mov rax, qword [rbp + 0x40]
cmp dword [rax + 0xbc], 0
jne 0x4d4641
call sub.kernel32.dll_GetLastError
cmp eax, 0x2f00
je 0x4d4646
xor rax, rax
jmp 0x4d4648
mov al, 1
mov rcx, qword [rbp + 0x40]
mov byte [rcx + 0xb0], al
call fcn.004d4770
nop
lea rcx, [rbp + 0x48]
call fcn.00410080
lea rcx, [rbp + 0x50]
call fcn.004100d0
movzx rax, byte [rbp + 0x3f]
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret