Function at 0x14004a5f0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x300], rbx
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r15, r8
mov rbx, rdx
mov dword [rbp + 0xa0], 0
lea rdx, [rbp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
test eax, eax
je 0x14004a99c
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140047d40
nop
mov rdx, qword [rax]
movdqa xmm0, xmmword [0x1401f5810]
movdqu xmmword [rbp + 0x70], xmm0
mov byte [rbp + 0x60], 0
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rdx + r8], 0
jne 0x14004a681
lea rcx, [rbp + 0x60]
call fcn.14000d6b0
nop
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
cmp rcx, rax
je 0x14004a6a9
call fcn.1401b3018
mov rdx, r15
lea rcx, [rbp - 0x30]
call fcn.140047d40
nop
mov rdx, qword [rax]
movdqa xmm0, xmmword [0x1401f5810]
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], 0
mov r8, rdi
inc r8
cmp byte [rdx + r8], 0
jne 0x14004a6d3
lea rcx, [rbp + 0x80]
call fcn.14000d6b0
nop
lea rax, [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
cmp rcx, rax
je 0x14004a6fc
call fcn.1401b3018
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0xb0]
call fcn.1401afc90
lea rsi, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rsi, qword [rbp + 0x60]
mov r13, qword [rbp + 0x70]
cmp r13, 3
jb 0x14004a7a0
lea r8, [r13 - 2]
add r8, rsi
sub r8, rsi
mov edx, 0x63
mov rcx, rsi
call fcn.1401b09e0
test rax, rax
je 0x14004a7a0
mov ebx, dword [0x1401fdc8c]
movzx r14d, byte [0x1401fdc8e]
movzx r12d, byte [0x1401fdc8d]
nop word [rax + rax]
cmp byte [rax], bl
jne 0x14004a774
cmp byte [rax + 1], r12b
jne 0x14004a774
cmp byte [rax + 2], r14b
jne 0x14004a774
xor ecx, ecx
jmp 0x14004a779
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x14004a81d
inc rax
lea r8, [r13 - 2]
add r8, rsi
sub r8, rax
mov edx, 0x63
mov rcx, rax
call fcn.1401b09e0
test rax, rax
jne 0x14004a760
lea rsi, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
mov rax, qword [rbp + 0x60]
cmovae rsi, rax
cmp r13, 0xa
jb 0x14004a8f6
lea r14, [rsi + r13]
lea r8, [r14 - 9]
sub r8, rsi
mov edx, 0x70
mov rcx, rsi
call fcn.1401b09e0
mov rbx, rax
test rax, rax
je 0x14004a8f6
nop
mov r8d, 0xa
lea rdx, [0x1401fdca8]
mov rcx, rbx
call fcn.1401affb0
test eax, eax
je 0x14004a85e
inc rbx
lea r8, [r14 - 9]
sub r8, rbx
mov edx, 0x70
mov rcx, rbx
call fcn.1401b09e0
mov rbx, rax
test rax, rax
jne 0x14004a7e0
jmp 0x14004a8f6
sub rax, rsi
cmp rax, 0xffffffffffffffff
je 0x14004a7a0
lea r9, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae r9, qword [rbp + 0x80]
lea r8, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
mov rax, qword [rbp + 0x60]
cmovae r8, rax
lea rdx, str._s__K__cd__d__s_
jmp 0x14004a8ea
sub rbx, rsi
cmp rbx, 0xffffffffffffffff
je 0x14004a8f6
mov qword [rsp + 0x20], r15
inc rdi
cmp word [r15 + rdi*2], 0
jne 0x14004a870
mov qword [rsp + 0x28], rdi
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call fcn.140034220
test al, al
je 0x14004a8be
lea rax, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rax, qword [rbp + 0x80]
mov qword [rbp + 0x90], 0
mov byte [rax], 0
lea r9, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae r9, qword [rbp + 0x80]
lea r8, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae r8, qword [rbp + 0x60]
lea rdx, str._s___NoExit___Command___cd___s__
lea rcx, [rbp + 0xb0]
call fcn.14004dbf0
mov edx, 1
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_WinExec]
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x14004a94a
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a945
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a9ce
call fcn.1401606e8
movdqa xmm0, xmmword [0x1401f5810]
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x14004a998
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a993
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a9c8
call fcn.1401606e8
mov al, 1
jmp 0x14004a99e
xor al, al
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140160a40
mov rbx, qword [rsp + 0x300]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1401b3260
nop
call fcn.1401b3260
nop
int3