Function at 0x180062470
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x108]
sub rsp, 0x1d0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
xor r14d, r14d
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x118]
call fcn.180058efc
test eax, eax
je 0x18006284d
cmp dword [rbp + 0x110], r14d
je 0x1800624c2
mov ebx, r14d
jmp 0x180062853
lea rcx, [rbp + 0x120]
call fcn.1800597e0
mov ebx, eax
test eax, eax
jne 0x180062853
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
lea ecx, [rbx + 7]
mov qword [rsp + 0x70], rcx
lea r15d, [rbx + 0xf]
mov qword [rsp + 0x78], r15
mov rax, qword [str.gui.dll]
mov dword [rsp + 0x60], eax
movzx eax, word [0x1800dd1f4]
mov word [rsp + 0x64], ax
mov al, byte [0x1800dd1f6]
mov byte [rsp + 0x66], al
mov byte [rsp + 0x67], r14b
movups xmmword [rbp - 0x40], xmm0
lea ebx, [rcx - 3]
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], r15
mov dword [rbp - 0x40], 0x6e69616d
mov byte [rbp - 0x3c], r14b
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x14
lea r9, str.C:WindowsSysWOW64_
lea r8, [rsp + 0x60]
mov dl, byte [rbp + 0x110]
lea rcx, [rbp - 0x60]
call fcn.18004ce9c
nop
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rbp - 0x50]
sub rax, rcx
cmp rax, 0xe
jb 0x18006287b
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], r15
cmova rax, qword [rbp - 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xe
lea r9, str.rundll32.exe__
lea r8, [rbp - 0x60]
mov dl, byte [rbp + 0x110]
lea rcx, [rbp - 0x20]
call fcn.18004ce9c
nop
lea r8d, [r15 - 0xc]
lea rdx, [0x1800dd210]
lea rcx, [rbp - 0x20]
call fcn.1800520b0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r15
mov byte [rax], r14b
lea rdx, [rbp - 0x40]
mov r8d, ebx
lea rcx, [rbp - 0x80]
call fcn.1800520b0
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x18], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm6
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r15
mov byte [rax], r14b
mov r12d, 0x1000
mov rdx, qword [rbp - 0x68]
cmp rdx, r15
jbe 0x180062668
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, r12
jb 0x180062663
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180062881
call fcn.18006ef80
movdqa xmm0, xmmword [0x1800e0d50]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], r14b
mov rdx, qword [rbp - 8]
cmp rdx, r15
jbe 0x1800626af
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, r12
jb 0x1800626aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180062887
call fcn.18006ef80
movdqa xmm0, xmmword [0x1800e0d50]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], r14b
movq rcx, xmm6
inc rcx
call fcn.18006f4b0
mov rdx, rax
lea rcx, [rbp + 0x18]
movq rdi, xmm7
psrldq xmm6, 8
movq rsi, xmm6
cmp rsi, r15
cmova rcx, rdi
sub rdx, rcx
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x1800626ed
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea rcx, [rbp]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x180062760
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp rsi, r15
jbe 0x1800627a9
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, r12
jb 0x1800627a0
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006288d
mov rcx, rdi
call fcn.18006ef80
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, r15
jbe 0x1800627e0
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, r12
jb 0x1800627da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180062893
call fcn.18006ef80
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, r15
jbe 0x180062817
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, r12
jb 0x180062811
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180062899
call fcn.18006ef80
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, r15
jbe 0x180062853
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, r12
jb 0x180062846
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180062875
call fcn.18006ef80
jmp 0x180062853
mov ebx, dword [rbp + 0x118]
mov eax, ebx
lea r11, [rsp + 0x1d0]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18007616c
nop
call fcn.18003e374
nop
call fcn.18007616c
nop
call fcn.18007616c
nop
call fcn.18007616c
nop
call fcn.18007616c
nop
call fcn.18007616c
int3