Function at 0x567ce0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push rbp
sub rsp, 0x110
mov rbp, rsp
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x120], rcx
mov qword [rbp + 0x128], rdx
mov qword [rbp + 0x130], r8
mov rcx, qword [rbp + 0x120]
call fcn.0040e540
mov rcx, qword [rbp + 0x128]
call fcn.0040e540
nop
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x567d48
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x00568090]
call fcn.00553130
mov byte [rbp + 0x107], 0
mov dword [rbp + 0x78], 0
lea rcx, [rbp + 0x80]
mov edx, 0x18
xor r8, r8
call fcn.0040a600
lea rcx, [rbp + 0x98]
mov edx, 0x68
xor r8, r8
call fcn.0040a600
mov dword [rbp + 0x98], 0x68
mov dword [rbp + 0xd4], 1
mov word [rbp + 0xd8], 0
cmp qword [rbp + 0x120], 0
jne 0x567db9
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0x128]
call fcn.0040ea60
jmp 0x567dfa
lea rcx, [rbp + 0x70]
mov edx, 5
lea r8, [0x005680d4]
mov r9, qword [rbp + 0x120]
lea rax, [0x005680d4]
mov qword [rsp + 0x20], rax
lea rax, [0x005680e4]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x128]
mov qword [rsp + 0x30], rax
call fcn.0040ff20
mov dword [rbp + 0x64], 0
cmp qword [rbp + 0x70], 0
je 0x567e12
mov rax, qword [rbp + 0x70]
mov eax, dword [rax - 4]
mov dword [rbp + 0x64], eax
mov ecx, dword [rbp + 0x64]
add ecx, 2
add ecx, ecx
movsxd rcx, ecx
call fcn.00408c40
mov qword [rbp + 0x68], rax
mov dword [rbp + 0x60], 0
cmp qword [rbp + 0x70], 0
je 0x567e3e
mov rax, qword [rbp + 0x70]
mov eax, dword [rax - 4]
mov dword [rbp + 0x60], eax
mov rcx, qword [rbp + 0x68]
mov edx, dword [rbp + 0x60]
add edx, 2
add edx, edx
movsxd rdx, edx
xor r8, r8
call fcn.0040a600
mov rcx, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x70]
call fcn.0042ddd0
xor rcx, rcx
mov rdx, qword [rbp + 0x68]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x98]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x567ef8
mov byte [rbp + 0x107], 0
call sub.kernel32.dll_GetLastError_2
mov rcx, qword [rbp + 0x130]
mov dword [rcx], eax
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x567eea
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x005680f4]
call fcn.00553130
mov rcx, qword [rbp + 0x68]
call fcn.00408c70
jmp 0x567ff4
mov rcx, qword [rbp + 0x68]
call fcn.00408c70
mov rax, qword [0x005b6b40]
cmp qword [rax], 0
je 0x567f24
mov rax, qword [0x005b6b40]
mov rcx, qword [rax]
lea rdx, [0x00568140]
call fcn.00553130
cmp qword [rbp + 0x80], 0
je 0x567fea
mov rcx, qword [rbp + 0x80]
or edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov dword [rbp + 0x7c], eax
cmp dword [rbp + 0x7c], 0
jne 0x567f8e
mov rcx, qword [rbp + 0x80]
lea rdx, [rbp + 0x78]
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x567f85
cmp dword [rbp + 0x78], 0x103
je 0x567f7c
mov rax, qword [rbp + 0x130]
mov ecx, dword [rbp + 0x78]
mov dword [rax], ecx
mov byte [rbp + 0x107], 1
jmp 0x567fc8
mov byte [rbp + 0x107], 0
jmp 0x567fc8
mov byte [rbp + 0x107], 0
jmp 0x567fc8
cmp dword [rbp + 0x7c], 0x102
jne 0x567fa0
mov byte [rbp + 0x107], 0
jmp 0x567fc8
cmp dword [rbp + 0x7c], 0x80
jne 0x567fb2
mov byte [rbp + 0x107], 0
jmp 0x567fc8
cmp dword [rbp + 0x7c], 0xffffffff
jne 0x567fc1
mov byte [rbp + 0x107], 0
jmp 0x567fc8
mov byte [rbp + 0x107], 0
nop
mov rcx, qword [rbp + 0x80]
call sub.kernel32.dll_CloseHandle_1
jmp 0x567ff3
mov byte [rbp + 0x107], 0
jmp 0x567ff4
nop
lea rcx, [rbp + 0x70]
call fcn.0040e3b0
lea rcx, [rbp + 0x120]
mov edx, 2
call fcn.0040e490
movzx rax, byte [rbp + 0x107]
lea rsp, [rbp + 0x110]
pop rbp
ret