Function at 0x1400040c0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x1c0], rbx
mov rax, qword [0x140137088]
xor rax, rsp
mov qword [rbp + 0x60], rax
movzx r13d, dl
mov r12, rcx
mov qword [rbp - 0x48], rcx
xor ebx, ebx
mov dword [rsp + 0x38], ebx
lea r8d, [rbx + 3]
lea rdx, [0x1400f8778]
call fcn.140009030
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
lea rcx, [rbp]
call fcn.140020400
nop
mov r8, rax
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140009cd0
nop
lea rcx, [rbp]
call fcn.140002380
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x140101490]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp - 0x20], bx
lea r8d, [rbx + 0xc]
lea rdx, [0x1400f84e0]
lea rcx, [rbp - 0x20]
call fcn.140002400
nop
lea rcx, [rbp]
call fcn.140020400
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x140101490]
movdqu xmmword [rbp - 0x30], xmm1
mov word [rbp - 0x40], bx
lea rdx, [rbp - 0x40]
lea rcx, [rbp]
call fcn.140021050
lea edx, [rbx + 0x10]
lea rcx, [rbp - 0x40]
call fcn.14001e870
nop
lea rcx, [rbp]
call fcn.140002380
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x40]
call fcn.14001ede0
nop
mov r15, qword [rsp + 0x28]
cmp qword [rsp + 0x30], r15
je 0x14000420d
mov qword [r15 + 0x10], rbx
mov qword [r15 + 0x18], rbx
movups xmm0, xmmword [rax]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r15 + 0x10], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
add r15, 0x20
mov qword [rsp + 0x28], r15
jmp 0x140004222
mov r8, rax
mov rdx, r15
lea rcx, [rsp + 0x20]
call fcn.140009cd0
mov r15, qword [rsp + 0x28]
lea rcx, [rbp + 0x40]
call fcn.140002380
nop
mov dword [rsp + 0x38], ebx
lea rcx, [rbp - 0x40]
call fcn.140002380
nop
lea rcx, [rbp - 0x20]
call fcn.140002380
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [0x140101490]
movdqu xmmword [rbp + 0x30], xmm1
mov word [rbp + 0x20], bx
lea rcx, [rbp + 0x20]
call fcn.14002c490
test al, al
jne 0x14000428f
lea rcx, [rbp + 0x20]
call fcn.140002380
nop
lea rcx, [rsp + 0x20]
call fcn.140008f80
nop
mov rcx, r12
call fcn.140002380
nop
xor al, al
jmp 0x14000452f
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rbx
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x140101490]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp - 0x20], bx
mov r8d, 0xc
lea rdx, str.cduninst.exe
lea rcx, [rbp - 0x20]
call fcn.140002400
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x40]
call fcn.14001ede0
nop
mov r8, rax
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.140009cd0
nop
lea rcx, [rbp + 0x40]
call fcn.140002380
nop
lea rcx, [rbp - 0x20]
call fcn.140002380
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x140101490]
movdqu xmmword [rbp + 0x10], xmm1
mov word [rbp], bx
mov r8d, 0xc
lea rdx, [0x1400f84e0]
lea rcx, [rbp]
call fcn.140002400
nop
lea r8, [rbp]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x40]
call fcn.14001ede0
nop
mov rdx, qword [rbp - 0x38]
cmp qword [rbp - 0x30], rdx
je 0x140004378
mov qword [rdx + 0x10], rbx
mov qword [rdx + 0x18], rbx
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
add rdx, 0x20
mov qword [rbp - 0x38], rdx
jmp 0x140004385
mov r8, rax
lea rcx, [rbp - 0x40]
call fcn.140009cd0
nop
lea rcx, [rbp + 0x40]
call fcn.140002380
nop
lea rcx, [rbp]
call fcn.140002380
nop
mov r14d, ebx
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rbp - 0x40]
cmp rbx, r15
je 0x140004431
mov rcx, rbx
call fcn.140020e90
test al, al
je 0x1400043db
movsxd rdi, r14d
shl rdi, 5
add rdi, rsi
mov rcx, rdi
call fcn.14002c2e0
mov rdx, rdi
mov rcx, rbx
call fcn.14002c1d0
test al, al
je 0x1400043e4
add rbx, 0x20
inc r14d
jmp 0x1400043a5
dec r14d
test r14d, r14d
jle 0x140004402
mov ebx, r14d
nop
mov rcx, rsi
call fcn.14002c2e0
add rsi, 0x20
sub rbx, 1
jne 0x1400043f0
lea rcx, [rbp - 0x40]
call fcn.140008f80
nop
lea rcx, [rbp + 0x20]
call fcn.140002380
nop
lea rcx, [rsp + 0x20]
call fcn.140008f80
nop
mov rcx, r12
call fcn.140002380
nop
xor al, al
jmp 0x14000452f
xor eax, eax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov dword [rbp - 0x54], eax
mov dword [rsp + 0x40], 0x70
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], 0x440
lea rcx, str.runas
lea rax, str.open
test r13b, r13b
cmovne rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsi + 0x18], 8
jb 0x14000448d
mov rsi, qword [rsi]
mov qword [rsp + 0x58], rsi
lea rax, [0x1400f7030]
mov qword [rsp + 0x68], rax
mov rax, r12
cmp qword [r12 + 0x18], 8
jb 0x1400044ad
mov rax, qword [r12]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x70], 1
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1400044f5
lea rcx, [rbp - 0x40]
call fcn.140008f80
nop
lea rcx, [rbp + 0x20]
call fcn.140002380
nop
lea rcx, [rsp + 0x20]
call fcn.140008f80
nop
mov rcx, r12
call fcn.140002380
nop
xor al, al
jmp 0x14000452f
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140004505
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x40]
call fcn.140008f80
nop
lea rcx, [rbp + 0x20]
call fcn.140002380
nop
lea rcx, [rsp + 0x20]
call fcn.140008f80
nop
mov rcx, r12
call fcn.140002380
nop
mov al, 1
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1400a8f20
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret