Function at 0x1400b34d0
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov eax, dword [0x1402b5f58]
lea ecx, [rax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp dword [0x1402b5f5c], 0xa
setl cl
test cl, al
jne 0x1400b3522
xor cl, al
jne 0x1400b3522
nop dword [rax + rax]
jmp 0x1400b3520
lea r8, [0x14029bf4c]
mov qword [rbp + 0x10], rdx
mov rcx, rdx
xor edx, edx
call fcn.1400d7b30
mov eax, dword [0x1402b5f58]
lea ecx, [rax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp dword [0x1402b5f5c], 0xa
setl cl
movabs rsi, 0x4000000070
test cl, al
mov r15, qword [rbp + 0x10]
jne 0x1400b3574
xor cl, al
je 0x1400b3605
jmp 0x1400b3574
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x60], rsi
movups xmmword [rbp - 0x58], xmm0
lea rax, str.cmd.exe
mov qword [rbp - 0x48], rax
mov rcx, r15
call fcn.14000cf50
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 0
mov dword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
lea rcx, [rbp - 0x60]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov edx, dword [0x1402b5f58]
mov ecx, dword [0x1402b5f5c]
lea r8d, [rdx + 1]
imul r8d, edx
mov edx, r8d
xor edx, 0xfffffffe
and edx, r8d
setne r8b
sete r10b
cmp ecx, 0xa
setge r9b
setl r11b
xor r11b, r10b
jne 0x1400b3661
or r9b, r8b
je 0x1400b3661
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x60], rsi
movups xmmword [rbp - 0x58], xmm0
lea rax, str.cmd.exe
mov qword [rbp - 0x48], rax
mov rcx, r15
call fcn.14000cf50
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 0
mov dword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
lea rcx, [rbp - 0x60]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
jmp 0x1400b3574
test eax, eax
je 0x1400b3742
mov rcx, qword [rbp + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x1402b5f58]
lea ecx, [rax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp dword [0x1402b5f5c], 0xa
setl cl
test cl, al
jne 0x1400b36f6
xor cl, al
jne 0x1400b36f6
mov rsi, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [rax + rax]
mov rcx, qword [rbp + 8]
mov edx, 0xffffffff
call rsi
mov rcx, qword [rbp + 8]
mov edx, 0xffffffff
call rsi
mov eax, dword [0x1402b5f58]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete dl
setne al
cmp dword [0x1402b5f5c], 0xa
setl r8b
setge cl
cmp r8b, dl
jne 0x1400b36f6
or cl, al
jne 0x1400b36b0
mov rcx, qword [rbp + 8]
lea rdx, [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1402b5f58]
mov ecx, dword [0x1402b5f5c]
lea r8d, [rax + 1]
imul r8d, eax
mov edx, r8d
xor edx, 0xfffffffe
and edx, r8d
sete al
cmp ecx, 0xa
setl r8b
test r8b, al
jne 0x1400b3749
xor r8b, al
jne 0x1400b3749
nop
jmp 0x1400b3740
mov esi, 0xffffffff
jmp 0x1400b374c
mov esi, dword [rbp + 0x18]
test edx, edx
sete al
cmp ecx, 0xa
setl cl
test cl, al
jne 0x1400b3762
xor cl, al
jne 0x1400b3762
nop
jmp 0x1400b3760
mov eax, 0x8e514f33
mov edi, 0x559d78c6
mov ebx, 0xb5ee369a
mov r14d, 0xa1dae94d
nop word [rax + rax]
cmp eax, 0xe9738f9d
je 0x1400b38ce
cmp eax, 0x8e514f33
jne 0x1400b3780
mov rcx, r15
call fcn.1400e2980
mov eax, dword [0x1402b5af0]
mov ecx, dword [0x1402b5af4]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [rbp + 0x1f]
cmp ecx, 0xa
setl byte [rbp + 0x18]
mov eax, 0xc7dc8da9
nop word cs:[rax + rax]
cmp eax, 0x354e3b8b
jg 0x1400b3810
cmp eax, 0xa1dae94d
je 0x1400b3857
cmp eax, 0xb5ee369a
je 0x1400b3861
cmp eax, 0xc7dc8da9
jne 0x1400b37d0
movzx ecx, byte [rbp + 0x1f]
movzx eax, byte [rbp + 0x18]
mov edx, ecx
xor dl, al
test al, al
mov eax, 0xb5ee369a
cmovne eax, edi
test cl, cl
cmove eax, ebx
test dl, dl
cmovne eax, edi
jmp 0x1400b37d0
cmp eax, 0x354e3b8c
je 0x1400b38c4
cmp eax, 0x559d78c6
je 0x1400b386b
cmp eax, 0x66202512
jne 0x1400b37d0
mov eax, 0x51eaacfe
mov rcx, qword [rbp - 0x60]
nop word cs:[rax + rax]
cmp eax, 0x51eaacfe
je 0x1400b3850
cmp eax, 0x89bfb55a
jne 0x1400b3840
jmp 0x1400b38b5
mov eax, 0x89bfb55a
jmp 0x1400b3840
mov eax, 0x66202512
jmp 0x1400b37d0
mov eax, 0x559d78c6
jmp 0x1400b37d0
mov eax, dword [0x1402b5af0]
mov ecx, dword [0x1402b5af4]
lea edx, [rax + 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete r8b
cmp ecx, 0xa
setl r9b
xor r9b, r8b
mov r8d, 0xb5ee369a
cmovne r8d, r14d
test eax, edx
mov eax, r8d
cmove eax, r14d
cmp ecx, 0xa
mov qword [rbp - 0x60], r15
cmovge eax, r8d
jmp 0x1400b37d0
call fcn.1400c0b30
mov eax, 0x354e3b8c
jmp 0x1400b37d0
mov eax, 0xe9738f9d
jmp 0x1400b3780
mov eax, dword [0x1402b5f58]
lea ecx, [rax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp dword [0x1402b5f5c], 0xa
setl cl
test cl, al
jne 0x1400b3902
xor cl, al
jne 0x1400b3902
nop word [rax + rax]
jmp 0x1400b3900
mov eax, esi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret