Function at 0x140206196
Capabilities:
Create process on windows

Disassembly:
jmp 0x140316ff0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x1d98
call fcn.1401fa5d5
sub rsp, rax
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x5ce
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1db8]
mov rax, qword [0x1406fa740]
xor rax, rbp
mov qword [rbp + 0x1d28], rax
lea rcx, [0x1420073f3]
call fcn.140205606
mov edx, 0x18
lea rcx, [rbp + 8]
call fcn.140204508
lea rcx, [rbp + 8]
call fcn.1401f9a9a
nop
mov rdx, qword [rbp + 0x1d58]
lea rcx, [rbp + 8]
call fcn.140201fc4
movzx eax, al
test eax, eax
jne 0x140317095
mov rdx, qword [rbp + 0x1d58]
lea rcx, str.Cant_open_file:__s_n
call fcn.1401fe4d7
nop
lea rcx, [rbp + 8]
call fcn.1401fc989
jmp 0x140317445
lea rcx, [rbp + 8]
call fcn.140203b03
mov rax, qword [rbp + 0x1d50]
mov r8d, dword [rax + 0x1298]
lea rdx, str.Date:_d_r_n
lea rcx, [rbp + 0x40]
call fcn.1402044fe
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 8]
call fcn.140200273
lea rdx, str._rti__r_n
lea rcx, [rbp + 8]
call fcn.140200273
movzx eax, word [0x14071acdd]
mov r8d, eax
lea rdx, str._cnt:_d_r_n
lea rcx, [rbp + 0x40]
call fcn.1402044fe
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 8]
call fcn.140200273
mov dword [rbp + 0x444], 0
movzx eax, word [0x14071acdd]
mov dword [rbp + 0x464], eax
jmp 0x140317127
mov eax, dword [rbp + 0x444]
inc eax
mov dword [rbp + 0x444], eax
mov eax, dword [rbp + 0x464]
cmp dword [rbp + 0x444], eax
jge 0x1403173c7
movsxd rax, dword [rbp + 0x444]
mov rdx, rax
lea rcx, [0x14071ace8]
call fcn.14020611e
lea rdx, [rbp + 0x490]
mov rcx, rax
call fcn.1401fc0d8
mov eax, 1
imul rax, rax, 0
movzx eax, byte [rbp + rax + 0x493]
mov byte [rbp + 0x6c4], al
movsx eax, byte [rbp + 0x6c4]
test eax, eax
jne 0x140317187
mov byte [rbp + 0x6c4], 0x20
mov eax, 1
imul rax, rax, 1
movzx eax, byte [rbp + rax + 0x493]
mov byte [rbp + 0x6e4], al
movsx eax, byte [rbp + 0x6e4]
test eax, eax
jne 0x1403171b0
mov byte [rbp + 0x6e4], 0x20
mov eax, 1
imul rax, rax, 0
movzx eax, byte [rbp + rax + 0x4a0]
mov byte [rbp + 0x704], al
movsx eax, byte [rbp + 0x704]
test eax, eax
jne 0x1403171d9
mov byte [rbp + 0x704], 0x20
mov eax, 1
imul rax, rax, 1
movzx eax, byte [rbp + rax + 0x4a0]
mov byte [rbp + 0x724], al
movsx eax, byte [rbp + 0x724]
test eax, eax
jne 0x140317202
mov byte [rbp + 0x724], 0x20
movzx eax, byte [rbp + 0x495]
mov byte [rbp + 0x744], al
movsx eax, byte [rbp + 0x744]
test eax, eax
jne 0x140317221
mov byte [rbp + 0x744], gethostbyname
movsx eax, byte [rbp + 0x495]
test eax, eax
jne 0x140317235
mov byte [rbp + 0x1d14], gethostbyname
jmp 0x140317242
movzx eax, byte [rbp + 0x495]
mov byte [rbp + 0x1d14], al
movsx eax, byte [rbp + 0x1d14]
mov dword [rbp + 0x1d18], eax
movsx ecx, byte [rbp + 0x724]
movsx edx, byte [rbp + 0x704]
mov dword [rbp + 0x1d1c], edx
movsx r8d, byte [rbp + 0x6e4]
movsx r9d, byte [rbp + 0x6c4]
xor edx, edx
mov eax, dword [rbp + 0x498]
mov r10d, 0x3c
div r10d
mov eax, edx
mov dword [rbp + 0x1d20], eax
xor edx, edx
mov eax, dword [rbp + 0x498]
mov r10d, 0x3c
div r10d
xor edx, edx
mov r10d, 0x3c
div r10d
mov eax, edx
mov dword [rbp + 0x1d24], eax
xor edx, edx
mov eax, dword [rbp + 0x498]
mov r10d, 0xe10
div r10d
mov edx, dword [rbp + 0x1d18]
mov dword [rsp + 0x50], edx
mov dword [rsp + 0x48], ecx
mov ecx, dword [rbp + 0x1d1c]
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], r9d
mov ecx, dword [rbp + 0x1d20]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rbp + 0x1d24]
mov dword [rsp + 0x20], ecx
mov r9d, eax
mov r8d, dword [rbp + 0x444]
lea rdx, str.__d__02d_02d_02d__c_c__c_c__c__r_n
lea rcx, [rbp + 0x40]
call fcn.1402044fe
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 8]
call fcn.140200273
lea r8, [rbp + 0x5a1]
lea rdx, str.title:__s_r_n
lea rcx, [rbp + 0x40]
call fcn.1402044fe
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 8]
call fcn.140200273
lea r8, [rbp + 0x4a2]
lea rdx, str.stkid:__s_r_n
lea rcx, [rbp + 0x40]
call fcn.1402044fe
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 8]
call fcn.140200273
movsxd rax, dword [rbp + 0x444]
mov rdx, rax
lea rcx, [0x14071af18]
call fcn.140205eb7
movzx eax, word [rax]
sub rax, 4
mov qword [rbp + 0x1d18], rax
movsxd rax, dword [rbp + 0x444]
mov rdx, rax
lea rcx, [0x14071af18]
call fcn.140205eb7
add rax, 4
mov qword [rbp + 0x1d20], rax
mov r8, qword [rbp + 0x1d18]
mov rdx, qword [rbp + 0x1d20]
lea rcx, [rbp + 8]
call fcn.140201510
jmp 0x140317119
lea rcx, [rbp + 8]
call fcn.1401fb967
mov rax, qword [rbp + 0x1d50]
mov byte [rax + 0x1e99], 0
mov r8d, 0xfa0
xor edx, edx
lea rcx, [rbp + 0x770]
call fcn.140201e5c
mov rax, qword [rbp + 0x1d58]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x1d58]
mov qword [rsp + 0x20], rax
lea r9, [0x140701a00]
lea r8, str._srar.exe_a__m5__ep__y__s.rar__s
mov edx, 0xf9f
lea rcx, [rbp + 0x770]
call fcn.1401f8de8
mov edx, 1
lea rcx, [rbp + 0x770]
call qword [sym.imp.KERNEL32.dll_WinExec]
nop
lea rcx, [rbp + 8]
call fcn.1401fc989
lea rcx, [rbp - 0x60]
lea rdx, reloc.WS2_32.dll_connect
call fcn.140202ef1
mov rcx, qword [rbp + 0x1d28]
xor rcx, rbp
call fcn.1401fe6b7
lea rsp, [rbp + 0x1d38]
pop rdi
pop rbp
ret