Function at 0x1400882b0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0xca8]
sub rsp, 0xd90
mov qword [rax + 8], rbx
lea r8, [rbp + 0x360]
mov qword [rax + 0x18], rdi
xor r15d, r15d
mov qword [rax - 0x20], r12
mov r14, rcx
lea rax, [rsp + 0x58]
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], rax
lea rax, [0x1401b7168]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x54], 0x200
mov word [rsp + 0x58], r15w
call fcn.140060720
mov rbx, qword [rsp + 0x48]
lea r12, [r15 - 1]
test rbx, rbx
je 0x14008838c
mov edi, dword [rsp + 0x54]
test edi, edi
je 0x140088364
mov dword [rsp + 0x28], edi
lea r8, [rbp + 0x360]
mov r9d, r12d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jg 0x14008835f
jne 0x14008835b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14008835b
lea eax, [rdi - 1]
mov word [rbx + rax*2], r15w
jmp 0x14008835f
mov word [rbx], r15w
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x140088383
mov edx, dword [rsp + 0x54]
mov rcx, rbx
call fcn.14003c464
mov rbx, qword [rsp + 0x48]
mov rcx, rax
mov dword [rsp + 0x50], eax
jmp 0x140088390
mov ecx, r15d
mov dword [rsp + 0x50], ecx
jmp 0x140088390
mov ecx, dword [rsp + 0x50]
lea rdx, [r14 + 0x86a6]
cmp word [rdx], r15w
je 0x140088669
test rbx, rbx
je 0x140088443
lea eax, [rcx + 5]
cmp eax, dword [rsp + 0x54]
jae 0x1400883f1
movsd xmm0, qword [str.ref]
mov eax, ecx
movsd qword [rbx + rax*2], xmm0
lea rcx, [rbx + rax*2]
movzx eax, word [0x1401c6a60]
mov word [rcx + 8], ax
mov eax, dword [rsp + 0x50]
add eax, 5
mov dword [rsp + 0x50], eax
mov ecx, eax
mov rax, qword [rsp + 0x48]
mov word [rax + rcx*2], r15w
mov ecx, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x140088443
test rdx, rdx
je 0x140088443
mov rdi, r12
nop
inc rdi
cmp word [rdx + rdi*2], r15w
jne 0x140088400
test edi, edi
je 0x140088443
lea eax, [rcx + rdi]
cmp eax, dword [rsp + 0x54]
jae 0x140088443
mov eax, ecx
mov r8d, edi
add r8, r8
lea rcx, [rbx + rax*2]
call fcn.14014cbf0
mov eax, dword [rsp + 0x50]
add eax, edi
mov dword [rsp + 0x50], eax
mov ecx, eax
mov rax, qword [rsp + 0x48]
mov word [rax + rcx*2], r15w
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0xdb8], rsi
mov qword [rsp + 0xd80], r13
test rbx, rbx
je 0x140088659
lea rdx, [0x1401b6678]
mov rcx, rbx
mov rsi, r15
mov rdi, r15
call fcn.1400308bc
mov rbx, rax
test rax, rax
je 0x140088551
lea r13, [0x1401b6368]
test rdi, rdi
jne 0x1400884b4
mov esi, dword [rsp + 0x54]
mov eax, 2
mul rsi
lea rdx, [0x14014fdc0]
cmovo rax, r12
mov rcx, rax
call fcn.14002e8b0
mov rdi, rax
test rax, rax
je 0x140088551
lea rcx, [rbx + 2]
mov word [rbx], r15w
mov qword [rsp + 0x30], rcx
lea r9, [0x1401b6680]
mov rcx, qword [rsp + 0x48]
mov r8, r12
mov qword [rsp + 0x28], r13
mov rdx, rsi
mov qword [rsp + 0x20], rcx
mov rcx, rdi
call fcn.140003a90
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x50], eax
cmp eax, ecx
jb 0x1400884f8
lea eax, [rcx - 1]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x48]
mov rdx, rdi
mov r8d, eax
add r8, r8
call fcn.14014cbf0
mov ecx, dword [rsp + 0x50]
lea rdx, [0x1401b6678]
mov rax, qword [rsp + 0x48]
mov word [rax + rcx*2], r15w
mov rax, qword [rsp + 0x48]
sub rbx, rax
add rax, 6
sar rbx, 1
lea rcx, [rax + rbx*2]
call fcn.1400308bc
mov rbx, rax
test rax, rax
jne 0x140088484
test rdi, rdi
je 0x140088551
mov rcx, rdi
call fcn.14002e8a8
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x140088659
lea rdx, [0x1401b6798]
mov rcx, rbx
mov rsi, r15
mov rdi, r15
call fcn.1400308bc
mov rbx, rax
test rax, rax
je 0x140088654
lea r13, [0x1401b6370]
test rdi, rdi
jne 0x1400885b7
mov esi, dword [rsp + 0x54]
mov eax, 2
mul rsi
lea rdx, [0x14014fdc0]
cmovo rax, r12
mov rcx, rax
call fcn.14002e8b0
mov rdi, rax
test rax, rax
je 0x140088654
lea rcx, [rbx + 4]
mov word [rbx], r15w
mov qword [rsp + 0x30], rcx
lea r9, [0x1401b6680]
mov rcx, qword [rsp + 0x48]
mov r8, r12
mov qword [rsp + 0x28], r13
mov rdx, rsi
mov qword [rsp + 0x20], rcx
mov rcx, rdi
call fcn.140003a90
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x50], eax
cmp eax, ecx
jb 0x1400885fb
lea eax, [rcx - 1]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x48]
mov rdx, rdi
mov r8d, eax
add r8, r8
call fcn.14014cbf0
mov ecx, dword [rsp + 0x50]
lea rdx, [0x1401b6798]
mov rax, qword [rsp + 0x48]
mov word [rax + rcx*2], r15w
mov rax, qword [rsp + 0x48]
sub rbx, rax
add rax, 6
sar rbx, 1
lea rcx, [rax + rbx*2]
call fcn.1400308bc
mov rbx, rax
test rax, rax
jne 0x140088587
test rdi, rdi
je 0x140088654
mov rcx, rdi
call fcn.14002e8a8
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0xdb8]
mov r13, qword [rsp + 0xd80]
lea rdx, [r14 + 0x7c84]
mov r8, rbx
call fcn.140058870
mov r12, qword [rsp + 0xd88]
mov rdi, qword [rsp + 0xdc0]
mov rbx, qword [rsp + 0xdb0]
test al, al
jne 0x14008871e
mov r8, qword [rsp + 0x48]
lea rax, [rbp + 0x478]
mov qword [rbp + 0x468], rax
lea rdx, str.https:__www.mql5.com__lang__auth_register_nobannertrueutm_campaignmql5.registerutm_mediumspecialutm_sourceweb.installer_s
lea rax, [0x1401b66a0]
mov dword [rbp + 0x470], r15d
lea rcx, [rbp + 0x460]
mov qword [rbp + 0x460], rax
mov dword [rbp + 0x474], 0x400
mov word [rbp + 0x478], r15w
call fcn.140003670
lea r8, str.enruzhjadeptesfrkoittr
lea rdx, [rbp + 0x460]
call fcn.14006f220
mov r8, qword [rbp + 0x468]
lea rdx, str.open
xor r9d, r9d
mov dword [rsp + 0x28], 1
xor ecx, ecx
mov qword [rsp + 0x20], r15
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rax, qword [rbp + 0xcd0]
and dword [r14 + 0x7c70], 0xfffffffb
mov dword [rax], 1
xor eax, eax
add rsp, 0xd90
pop r15
pop r14
pop rbp
ret