Function at 0x1401f9a54
Capabilities:
Create process on windows

Disassembly:
jmp 0x1403853b0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x498
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xba
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4b8]
mov rax, qword [0x1406fa740]
xor rax, rbp
mov qword [rbp + 0x450], rax
lea rcx, [0x1420079e7]
call fcn.140205606
mov edx, 0x18
lea rcx, [rbp + 8]
call fcn.1401fe987
lea rcx, [rbp + 8]
call fcn.1401fac38
nop
mov rax, qword [rbp + 0x480]
cmp qword [rax + 0xa3350], 0
je 0x140385444
mov rax, qword [rbp + 0x480]
mov rax, qword [rax + 0xa3350]
add rax, 0xa2bc0
mov qword [rbp + 0x448], rax
jmp 0x140385458
mov rax, qword [rbp + 0x480]
add rax, 0xa2bc0
mov qword [rbp + 0x448], rax
mov rax, qword [rbp + 0x448]
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x480]
cmp qword [rax + 0xa3350], 0
je 0x140385491
mov rax, qword [rbp + 0x480]
mov rax, qword [rax + 0xa3350]
add rax, 0xa2c38
mov qword [rbp + 0x448], rax
jmp 0x1403854a5
mov rax, qword [rbp + 0x480]
add rax, 0xa2c38
mov qword [rbp + 0x448], rax
mov rax, qword [rbp + 0x448]
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x480]
add rax, 0x8e0
mov rdx, rax
mov rcx, qword [rbp + 0x480]
call fcn.1401f9914
mov rax, qword [rbp + 0x480]
add rax, 0xdff8
mov rdx, rax
mov rcx, qword [rbp + 0x480]
call fcn.1401f9914
mov rax, qword [rbp + 0x480]
add rax, 0x1b710
mov rdx, rax
mov rcx, qword [rbp + 0x480]
call fcn.1401f9914
mov rax, qword [rbp + 0x480]
add rax, 0x28e28
mov rdx, rax
mov rcx, qword [rbp + 0x480]
call fcn.1401f9914
mov rax, qword [rbp + 0x480]
add rax, 0x36540
mov r8, qword [rbp + 0x38]
mov rdx, rax
mov rcx, qword [rbp + 0x480]
call fcn.140204229
mov rax, qword [rbp + 0x480]
add rax, 0x87a20
mov r8, qword [rbp + 0x38]
mov rdx, rax
mov rcx, qword [rbp + 0x480]
call fcn.140204229
mov rax, qword [rbp + 0x480]
add rax, 0x43e10
mov r8, qword [rbp + 0x38]
mov rdx, rax
mov rcx, qword [rbp + 0x480]
call fcn.140204229
mov rax, qword [rbp + 0x480]
add rax, 0x952f0
mov r8, qword [rbp + 0x38]
mov rdx, rax
mov rcx, qword [rbp + 0x480]
call fcn.140204229
mov rax, qword [rbp + 0x480]
add rax, 0x516e0
mov r8, qword [rbp + 0x58]
mov rdx, rax
mov rcx, qword [rbp + 0x480]
call fcn.140204229
mov rax, qword [rbp + 0x480]
add rax, 0x5efb0
mov r8, qword [rbp + 0x58]
mov rdx, rax
mov rcx, qword [rbp + 0x480]
call fcn.140204229
mov rax, qword [rbp + 0x480]
add rax, 0x6c880
mov r8, qword [rbp + 0x38]
mov rdx, rax
mov rcx, qword [rbp + 0x480]
call fcn.140204229
mov rax, qword [rbp + 0x480]
add rax, 0x7a150
mov r8, qword [rbp + 0x38]
mov rdx, rax
mov rcx, qword [rbp + 0x480]
call fcn.140204229
mov rdx, qword [rbp + 0x488]
lea rcx, [rbp + 8]
call fcn.1401ffb57
movzx eax, al
test eax, eax
jne 0x140385659
mov rdx, qword [rbp + 0x488]
lea rcx, str.Cant_open_file:__s_n
call fcn.1401fe4d7
nop
lea rcx, [rbp + 8]
call fcn.14020607e
jmp 0x140385996
lea rcx, [rbp + 8]
call fcn.1401f84ab
lea rcx, [rbp + 0x78]
call fcn.1402054bc
nop
mov edx, 0x8000
lea rcx, [rbp + 0x78]
call fcn.1401faaf3
mov rax, qword [rbp + 0x480]
mov r9d, dword [rax + 0xa3200]
lea r8, str.Date:_d_r_n
mov edx, 0x1f4
lea rcx, [rbp + 0xc0]
call fcn.1401f8de8
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 8]
call fcn.1401fc88f
mov rax, qword [rbp + 0x480]
mov r9d, dword [rax + 0xa3200]
lea r8, str.Date:_d_r_n
mov edx, 0x1f4
lea rcx, [rbp + 0xc0]
call fcn.1401f8de8
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 8]
call fcn.1401fc88f
mov rax, qword [rbp + 0x480]
cmp qword [rax + 0xa3350], 0
je 0x14038579c
mov rax, qword [rbp + 0x480]
mov rax, qword [rax + 0xa3350]
add rax, 0x8e0
mov r8, rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x480]
call fcn.1401fe8dd
mov rax, qword [rbp + 0x480]
mov rax, qword [rax + 0xa3350]
add rax, 0xdff8
mov r8, rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x480]
call fcn.1401fe8dd
mov rax, qword [rbp + 0x480]
mov rax, qword [rax + 0xa3350]
add rax, 0x1b710
mov r8, rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x480]
call fcn.1401fe8dd
mov rax, qword [rbp + 0x480]
mov rax, qword [rax + 0xa3350]
add rax, 0x28e28
mov r8, rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x480]
call fcn.1401fe8dd
jmp 0x14038581c
mov rax, qword [rbp + 0x480]
add rax, 0x8e0
mov r8, rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x480]
call fcn.1401fe8dd
mov rax, qword [rbp + 0x480]
add rax, 0xdff8
mov r8, rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x480]
call fcn.1401fe8dd
mov rax, qword [rbp + 0x480]
add rax, 0x1b710
mov r8, rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x480]
call fcn.1401fe8dd
mov rax, qword [rbp + 0x480]
add rax, 0x28e28
mov r8, rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x480]
call fcn.1401fe8dd
mov rax, qword [rbp + 0x480]
add rax, 0x36540
mov r8, rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x480]
call fcn.140202db6
mov rax, qword [rbp + 0x480]
add rax, 0x87a20
mov r8, rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x480]
call fcn.140202db6
mov rax, qword [rbp + 0x480]
add rax, 0x43e10
mov r8, rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x480]
call fcn.140202db6
mov rax, qword [rbp + 0x480]
add rax, 0x952f0
mov r8, rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x480]
call fcn.140202db6
mov rax, qword [rbp + 0x480]
add rax, 0x516e0
mov r8, rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x480]
call fcn.140202db6
mov rax, qword [rbp + 0x480]
add rax, 0x5efb0
mov r8, rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x480]
call fcn.140202db6
mov rax, qword [rbp + 0x480]
add rax, 0x6c880
mov r8, rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x480]
call fcn.140202db6
mov rax, qword [rbp + 0x480]
add rax, 0x7a150
mov r8, rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x480]
call fcn.140202db6
lea rcx, [rbp + 8]
call fcn.140203bad
mov r8d, 0x1f4
xor edx, edx
lea rcx, [rbp + 0xc0]
call fcn.140201e5c
mov rax, qword [rbp + 0x488]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x488]
mov qword [rsp + 0x20], rax
lea r9, [0x140701a00]
lea r8, str._srar.exe_a__m5__ep__y__s.rar__s
mov edx, 0x1f3
lea rcx, [rbp + 0xc0]
call fcn.1401f8de8
mov edx, 1
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_WinExec]
nop
lea rcx, [rbp + 0x78]
call fcn.1401fa67f
nop
lea rcx, [rbp + 8]
call fcn.14020607e
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.140202ef1
mov rcx, qword [rbp + 0x450]
xor rcx, rbp
call fcn.1401fe6b7
lea rsp, [rbp + 0x468]
pop rdi
pop rbp
ret