Function at 0x140006af0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x140056070]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
mov rbx, rcx
xor r12d, r12d
lea rcx, str.appdata
call fcn.14002426c
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], setsockopt
mov byte [rsp + 0x50], r12b
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140006b60
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140001940
nop
mov r8d, 0x18
lea rdx, str.MicrosoftWindowsmisc_
lea rcx, [rsp + 0x50]
call fcn.140001aa0
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], setsockopt
mov byte [rax], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140006bf6
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006bf1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007660
call fcn.1400169a4
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], setsockopt
mov byte [rsp + 0x50], 0
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rax, qword [rbp - 0x30]
mov qword [rbp - 0x70], rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x68], rax
call fcn.1400148ac
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rbp - 0x10]
call fcn.1400033e0
nop
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rcx, qword [rbp - 0x10]
call fcn.1400149e8
shr rax, 0x20
test eax, eax
jne 0x140007666
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x140006ca2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006c9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007679
call fcn.1400169a4
xor ecx, ecx
call fcn.1400237f8
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140003220
nop
mov r8d, 4
lea rdx, str..exe
mov rcx, rax
call fcn.140001aa0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], setsockopt
mov byte [rax], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140006d24
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000767f
call fcn.1400169a4
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], setsockopt
mov byte [rbp - 0x50], 0
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rdx, qword [rbp - 0x10]
mov r8, qword [rbp]
lea rcx, [rbp - 0x30]
call fcn.140001aa0
lea r8, [rbp - 0x30]
lea rcx, [rbp - 0x70]
call fcn.14000d5b0
nop
mov r8d, 1
lea rdx, [0x14004f200]
mov rcx, rax
call fcn.140001aa0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], setsockopt
mov byte [rax], 0
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140006daf
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140001aa0
mov qword [rsp + 0x70], r12
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], setsockopt
mov byte [rax], 0
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140006e3c
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006e37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007685
call fcn.1400169a4
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], setsockopt
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140006e8a
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006e85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000768b
call fcn.1400169a4
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], setsockopt
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140006ee0
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ed3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007691
call fcn.1400169a4
nop dword [rax + rax]
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rax, qword [rbp - 0x30]
mov qword [rsp + 0x70], rax
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x78], rax
call fcn.1400148ac
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x70], xmm0
lea r8, [rbp - 0x70]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.1400033e0
nop
lea rcx, [rsp + 0x50]
call fcn.140003e10
test al, al
sete bl
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140006f6d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007697
call fcn.1400169a4
test bl, bl
je 0x140006f81
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140006ee0
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x1d0]
call fcn.140018ef0
mov r8d, 0x20
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x1d0]
call fcn.140009840
nop
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], setsockopt
mov byte [rbp + 0x10], 0
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x1d0]
call fcn.140013040
lea rcx, [rbp + 0x1e0]
call fcn.14000b300
mov edi, 6
lea esi, [rdi - 4]
test rax, rax
jne 0x140007013
mov rax, qword [rbp + 0x1d0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x1d0]
add rcx, rax
mov edx, edi
cmp qword [rcx + 0x48], 0
cmovne edx, esi
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.1400030f0
mov rbx, r12
nop word [rax + rax]
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
mov qword [rsp + 0x20], 1
lea r9, [0x14004efa8]
mov r8, rbx
mov rdx, qword [rbp + 0x20]
call fcn.14000e340
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140007154
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], setsockopt
mov byte [rsp + 0x50], 0
mov r8d, 1
lea rdx, [0x14004f21c]
lea rcx, [rsp + 0x50]
call fcn.140001940
nop
mov qword [rsp + 0x20], 1
mov r8, qword [rsp + 0x60]
mov rdx, rbx
lea rcx, [rbp + 0x10]
call fcn.14000b400
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400070df
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400070da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000769d
call fcn.1400169a4
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], setsockopt
mov r8d, 1
lea rdx, [0x14004f21c]
lea rcx, [rsp + 0x50]
call fcn.140001940
add rbx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140007020
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000714a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000769d
call fcn.1400169a4
jmp 0x140007020
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0xc0]
call fcn.140018ef0
mov r8d, 0x20
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0xc0]
call fcn.1400089d0
nop
mov edx, 4
lea rcx, [rsp + 0x70]
call fcn.140015b20
mov r8, qword [rax]
mov rcx, qword [rbp + 0xc0]
movsxd rdx, dword [rcx + 4]
lea rcx, [rbp + 0xc0]
add rcx, rdx
mov rdx, qword [rax + 8]
call r8
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x50]
call fcn.140004540
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x1400071c9
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0xc0]
call fcn.1400132f0
mov rcx, rax
call fcn.14000ce90
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14000721c
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007217
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400076a3
call fcn.1400169a4
lea rcx, [rbp + 0xc8]
call fcn.14000b300
test rax, rax
jne 0x140007257
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xc0]
add rcx, rax
cmp qword [rcx + 0x48], 0
cmovne edi, esi
or edi, dword [rcx + 0x10]
xor r8d, r8d
mov edx, edi
call fcn.1400030f0
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x54], xmm0
movups xmmword [rbp + 0x64], xmm0
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm0
movups xmmword [rbp + 0x94], xmm0
movups xmmword [rbp + 0xa4], xmm0
mov dword [rbp + 0xb4], eax
mov dword [rbp + 0x50], 0x68
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r13, qword [rbp + 8]
cmp r13, 0x10
setae r15b
mov rsi, qword [rbp]
mov r14, qword [rbp - 0x10]
movabs rcx, 0x7fffffffffffffff
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
lea rdi, [rbp - 0x10]
test r15b, r15b
cmovne rdi, r14
cmp rsi, 0x10
jae 0x140007330
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x68], setsockopt
jmp 0x1400073a2
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
cmova rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000737a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400076af
mov rcx, rax
call fcn.140016960
mov rcx, rax
test rax, rax
je 0x1400076a9
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140007389
test rcx, rcx
je 0x140007386
call fcn.140016960
jmp 0x140007389
mov rax, r12
mov qword [rsp + 0x50], rax
lea r8, [rsi + 1]
mov rdx, rdi
mov rcx, rax
call fcn.140018840
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rsi
lea rcx, [rsp + 0x50]
call fcn.140004260
test al, al
je 0x1400073c5
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400072f3
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rax, qword [rbp - 0x30]
mov qword [rsp + 0x70], rax
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x78], rax
call fcn.1400148ac
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.1400033e0
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
call fcn.140014d54
shr rax, 0x20
test eax, eax
jne 0x1400076b5
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140007468
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007462
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400076c9
call fcn.1400169a4
nop
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0xc0], rax
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0xbc], edx
lea rcx, [rbp + 0xc8]
call fcn.140009790
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0xc0], rax
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0xbc], edx
lea rbx, vtable.std::ios_base.0
mov qword [rbp + 0x168], rbx
lea rcx, [rbp + 0x168]
call fcn.1400158c8
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x14000752b
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007526
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400076cf
call fcn.1400169a4
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], setsockopt
mov byte [rbp + 0x10], 0
mov rax, qword [rbp + 0x1d0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x1d0], rax
mov rax, qword [rbp + 0x1d0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x1cc], edx
lea rcx, [rbp + 0x1e0]
call fcn.140009790
mov rax, qword [rbp + 0x1d0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x1d0], rax
mov rax, qword [rbp + 0x1d0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx + 0x1cc], edx
mov qword [rbp + 0x280], rbx
lea rcx, [rbp + 0x280]
call fcn.1400158c8
nop
test r15b, r15b
je 0x1400075f3
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400075ea
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400076d5
mov rcx, r14
call fcn.1400169a4
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14000762a
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007625
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000765a
call fcn.1400169a4
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.140016940
lea r11, [rsp + 0x3f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14001cd3c
nop
call fcn.14001cd3c
nop
lea r8, [rbp - 0x10]
mov edx, eax
lea rcx, str.create_directory
call fcn.140003d40
nop
call fcn.14001cd3c
nop
call fcn.14001cd3c
nop
call fcn.14001cd3c
nop
call fcn.14001cd3c
nop
call fcn.14001cd3c
int3
call fcn.14001cd3c
nop
call fcn.14001cd3c
nop
call fcn.14001cd3c
int3
call fcn.14001cd3c
int3
call fcn.140001280
nop
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, str.remove
call fcn.140003d40
nop
call fcn.14001cd3c
nop
call fcn.14001cd3c
nop
call fcn.14001cd3c
int3