Function at 0x1401961d0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x140713740]
xor rax, rsp
mov qword [rbp + 0xe0], rax
xor edi, edi
lea rcx, str.winhttp.lib
mov dword [rbp - 0x40], edi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.Normaliz.lib
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.Ws2_32.lib
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.Wldap32.lib
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.Crypt32.lib
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.advapi32.lib
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.wininet.lib
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword gs:[0x58]
mov ecx, dword [0x140719430]
mov edx, 4
mov dword [0x140716b40], edi
mov rbx, qword [rax + rcx*8]
add rbx, rdx
mov eax, dword [rbx]
cmp dword [0x140715d20], eax
jg 0x140196d38
lea rcx, [0x140572348]
call fcn.14017ffe0
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_119]
mov eax, dword [rbx]
cmp dword [0x140715d60], eax
jg 0x140196d6e
lea rcx, [0x140715d28]
call fcn.1401ea4f0
xorps xmm0, xmm0
lea rdx, [0x14042dae4]
xorps xmm1, xmm1
lea rcx, [rbp - 0x60]
mov r8d, 3
movups xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.1400fe440
lea rdx, [rbp - 0x60]
lea rcx, [0x140715cc0]
call fcn.1401944c0
xor r8d, r8d
lea rdx, [0x14042d813]
mov rcx, rax
call fcn.14010d0a0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140196349
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140196344
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140196dd1
call fcn.1403e5198
xorps xmm0, xmm0
lea rdx, str.oUHqJ9IOlyjA4edqmyFdkeNi8J_xdte2AWlGRd2uTM
xorps xmm1, xmm1
lea rcx, [rsp + 0x70]
mov r8d, 0x2c
movups xmmword [rsp + 0x70], xmm0
movdqu xmmword [rbp - 0x80], xmm1
call fcn.1400fe440
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x38]
call fcn.14018e8b0
mov rdx, rax
lea rcx, [0x140570030]
call fcn.140107260
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x1401963c8
mov rcx, qword [rbp - 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401963c3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140196dd7
call fcn.1403e5198
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_519]
cmp byte [0x140716ac8], dil
jne 0x140196cae
lea rdx, [rbp - 0x38]
lea rcx, [0x140715d18]
call fcn.1401f8d40
xorps xmm0, xmm0
lea rdx, str.0.991
xorps xmm1, xmm1
lea rcx, [rsp + 0x70]
mov r8d, 5
mov rbx, rax
movups xmmword [rsp + 0x70], xmm0
movdqu xmmword [rbp - 0x80], xmm1
call fcn.1400fe440
lea r8, [0x140715cc0]
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1401642e0
mov ecx, 1
call fcn.1403e515c
lea rcx, [rsp + 0x58]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1401914e0]
xor ecx, ecx
mov dword [rsp + 0x20], edi
xor edx, edx
call fcn.1403f939c
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140196d29
cmp dword [rsp + 0x58], edi
je 0x140196ceb
movaps xmm0, xmmword [rsp + 0x50]
lea rcx, [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm0
call fcn.1403e3e50
test eax, eax
jne 0x140196ceb
xorps xmm0, xmm0
mov ecx, 1
movdqa xmmword [rsp + 0x50], xmm0
call fcn.1403e515c
lea rcx, [rsp + 0x58]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x140191520]
xor ecx, ecx
mov dword [rsp + 0x20], edi
xor edx, edx
call fcn.1403f939c
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140196e1b
cmp dword [rsp + 0x58], edi
je 0x140196e10
movaps xmm0, xmmword [rsp + 0x50]
lea rcx, [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm0
call fcn.1403e3e50
test eax, eax
jne 0x140196e10
cmp byte [0x140716ac8], dil
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm0
mov dword [0x140716b40], 1
jne 0x140196cae
cmp byte [0x140716b45], dil
jne 0x14019653f
mov qword [rbp - 0x70], 0xa
nop
lea rcx, [rbp - 0x70]
call fcn.140193f90
cmp byte [0x140716ac8], dil
jne 0x140196cae
cmp byte [0x140716b45], dil
je 0x140196520
lea rcx, [rbp - 0x70]
mov dword [0x140716b40], 2
mov qword [rbp - 0x70], 0x7d0
call fcn.140193f90
xorps xmm0, xmm0
lea rdx, [0x14042db28]
xorps xmm1, xmm1
lea rcx, [rsp + 0x50]
mov r8d, 3
movups xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x60], xmm1
call fcn.1400fe440
lea rdx, [rsp + 0x50]
lea rcx, [0x140715cc0]
call fcn.1401944c0
cmp qword [rax + 0x18], 0xf
mov r8, qword [rax + 0x10]
jbe 0x1401965a1
mov rax, qword [rax]
cmp r8, 4
jne 0x14019663c
lea rdx, str.1001
mov rcx, rax
call fcn.14041c7a0
test eax, eax
jne 0x14019663c
xorps xmm0, xmm0
lea rdx, [0x14042db30]
xorps xmm1, xmm1
lea rcx, [rbp - 0x60]
mov r8d, 6
movups xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x50], xmm1
call fcn.1400fe440
lea rdx, [rbp - 0x60]
lea rcx, [0x140715cc0]
call fcn.1401944c0
cmp qword [rax + 0x18], 0xf
mov r8, qword [rax + 0x10]
jbe 0x140196601
mov rax, qword [rax]
cmp r8, 3
jne 0x140196635
lea rdx, [0x14042db2c]
mov rcx, rax
call fcn.14041c7a0
test eax, eax
jne 0x140196635
cmp byte [0x140716ac8], dil
mov eax, 3
jne 0x140196641
cmp byte [0x140715cd0], dil
je 0x140196641
mov bl, 1
jmp 0x140196647
mov eax, 3
jmp 0x140196641
mov eax, 1
xor bl, bl
test al, 2
je 0x140196693
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140196682
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019667d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140196ddd
call fcn.1403e5198
movdqa xmm0, xmmword [0x140539e70]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], dil
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1401966d0
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401966cb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140196ddd
call fcn.1403e5198
test bl, bl
je 0x140196bdf
mov ecx, 0x20
call fcn.1403e515c
test rax, rax
je 0x1401966fb
xorps xmm0, xmm0
mov rcx, rax
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
call fcn.14017ca30
jmp 0x1401966fe
mov rax, rdi
mov qword [rbp - 0x70], rax
cmp byte [rax + 0x18], dil
jne 0x14019672e
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, str.Error_0x03
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_FatalAppExitW]
mov ecx, 8
call fcn.1403e515c
test rax, rax
je 0x140196746
lea rcx, [rbp - 0x70]
mov qword [rax], rcx
jmp 0x140196749
mov rax, rdi
lea rcx, [rsp + 0x58]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x140191560]
xor ecx, ecx
mov dword [rsp + 0x20], edi
xor edx, edx
call fcn.1403f939c
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140196dfb
lea rcx, [rsp + 0x50]
call fcn.140194e00
cmp dword [rsp + 0x58], edi
jne 0x140196de3
mov dword [0x140716b40], 3
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_119]
xorps xmm0, xmm0
lea rdx, str.dll_part_1
xorps xmm1, xmm1
lea rcx, [rsp + 0x70]
mov r8d, 0xa
movups xmmword [rsp + 0x70], xmm0
movdqu xmmword [rbp - 0x80], xmm1
call fcn.1400fe440
lea rdx, [rsp + 0x70]
lea rcx, [0x140715cc0]
call fcn.1401944c0
xorps xmm0, xmm0
lea rdx, str.dll_part_2
xorps xmm1, xmm1
lea rcx, [rsp + 0x50]
mov r8d, 0xa
mov rbx, rax
movups xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x60], xmm1
call fcn.1400fe440
lea rdx, [rsp + 0x50]
lea rcx, [0x140715cc0]
call fcn.1401944c0
mov r8, qword [rbx + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rdx, qword [rax + 0x10]
sub rcx, rdx
cmp rcx, r8
jb 0x140196de9
cmp qword [rax + 0x18], 0xf
mov r9, rax
jbe 0x14019683b
mov r9, qword [rax]
cmp qword [rbx + 0x18], 0xf
jbe 0x140196845
mov rbx, qword [rbx]
mov qword [rsp + 0x30], r8
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rbx
mov r8, rax
mov qword [rsp + 0x20], rdx
movzx edx, byte [rsp + 0x40]
call fcn.14015e8e0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1401968a2
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019689d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140196def
call fcn.1403e5198
mov rdx, qword [rbp - 0x78]
movdqa xmm0, xmmword [0x140539e70]
mov byte [rsp + 0x50], dil
movdqu xmmword [rsp + 0x60], xmm0
cmp rdx, 0xf
jbe 0x1401968f1
mov rcx, qword [rsp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401968ec
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140196def
call fcn.1403e5198
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_519]
xorps xmm0, xmm0
mov dword [0x140716b40], 4
xor eax, eax
movaps xmmword [rbp], xmm0
mov qword [rbp + 0x70], rax
lea rdx, [rbp]
mov dword [rbp + 0x78], eax
lea rcx, [rbp + 0x80]
mov qword [rbp + 0x98], rax
xorps xmm1, xmm1
mov dword [rbp + 0xd9], eax
xor r8d, r8d
mov word [rbp + 0xdd], ax
mov byte [rbp + 0xdf], al
lea rax, [0x14042dea8]
mov qword [rbp - 0x10], rax
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x80], rax
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x50], xmm0
movaps xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x88], rdi
mov qword [rbp + 0x90], rdi
movdqa xmmword [rbp + 0xa0], xmm0
movdqa xmmword [rbp + 0xb0], xmm1
movdqa xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], rdi
mov byte [rbp + 0xd8], dil
mov dword [rbp + 0x7c], 0x78
mov qword [rbp - 8], rdi
call fcn.1401711c0
mov rax, qword [rbp - 0x10]
mov r8d, 1
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx - 0x10], rax
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx - 0x14], edx
lea rdx, [rbp - 0x38]
lea rcx, [rbp]
call fcn.140194130
movzx ebx, byte [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x60], dil
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
nop word [rax + rax]
mov rax, qword [rbp - 0x10]
lea rdx, [rbp - 0x40]
movsxd rcx, dword [rax + 4]
mov eax, dword [rbp + rcx + 8]
and eax, 0xfffff9ff
bts eax, 0xb
mov dword [rbp + rcx + 8], eax
lea rcx, [rbp - 0x10]
call fcn.140190d50
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x140196a89
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x60]
mov r8, qword [rbp - 0x48]
cmp rdx, r8
jae 0x140196a74
lea rax, [rdx + 1]
cmp r8, 0xf
mov qword [rbp - 0x50], rax
cmova rcx, qword [rbp - 0x60]
movzx eax, byte [rbp - 0x40]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], dil
jmp 0x140196a10
movzx r9d, byte [rbp - 0x40]
movzx r8d, bl
mov edx, 1
call fcn.140148a60
jmp 0x140196a10
lea rcx, [rsp + 0x50]
mov dword [0x140716b40], 5
mov qword [rsp + 0x50], 0x7d0
call fcn.140193f90
call fcn.1401947c0
cmp qword [rbp - 0x48], 0xf
lea rdx, [rbp - 0x60]
mov r8d, dword [rbp - 0x50]
mov rcx, rax
cmova rdx, qword [rbp - 0x60]
call fcn.1401e7a20
test al, al
jne 0x140196b8f
mov dword [rsp + 0x28], 5
lea r9, str.cmd__c__echo_Error_injecting___color_c__pause
lea r8, [0x14042dba0]
mov qword [rsp + 0x20], rdi
lea rdx, [0x14042dba8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140196b32
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140196b2d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140196df5
call fcn.1403e5198
lea rcx, [rbp - 0x10]
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x60], dil
call fcn.140194680
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140196cae
mov rcx, qword [rbp - 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140196b85
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140196df5
call fcn.1403e5198
jmp 0x140196cae
mov dword [0x140716b40], 6
call fcn.1401947b0
mov rcx, rax
call fcn.14017c0a0
call fcn.14017f450
cmp byte [rax + 0x1fc], dil
jne 0x140196cf6
nop dword [rax + rax]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14017f450
cmp byte [rax + 0x1fc], dil
jne 0x140196cf6
jmp 0x140196bc0
xorps xmm0, xmm0
lea rdx, [0x14042dbb4]
xorps xmm1, xmm1
lea rcx, [rsp + 0x70]
mov r8d, 6
movups xmmword [rsp + 0x70], xmm0
movdqu xmmword [rbp - 0x80], xmm1
call fcn.1400fe440
lea rdx, [rsp + 0x70]
lea rcx, [0x140715cc0]
call fcn.1401944c0
cmp qword [rax + 0x18], 0xf
mov r8, qword [rax + 0x10]
jbe 0x140196c25
mov rax, qword [rax]
cmp r8, 3
jne 0x140196c42
lea rdx, [0x14042dbb0]
mov rcx, rax
call fcn.14041c7a0
test eax, eax
jne 0x140196c42
mov bl, 1
jmp 0x140196c44
xor bl, bl
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140196c80
mov rcx, qword [rsp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140196c7b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140196e0a
call fcn.1403e5198
xor ecx, ecx
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rdi
test bl, bl
je 0x140196cd4
lea r9, str.cmd__c__echo_Outdated_version__please_download_the_latest_version.___color_c__pause
lea r8, [0x14042dc18]
lea rdx, [0x14042dc20]
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.1403e5550
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
lea r9, str.cmd__c__echo_Error.___color_c__pause
lea r8, str.cmd.exe
lea rdx, str.runas
jmp 0x140196ca8
mov ecx, 1
call fcn.1403e4090
int3
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1401947c0
mov rcx, rax
call fcn.1401e7af0
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140196d21
mov edx, 1
call fcn.140194760
xor ecx, ecx
call fcn.1403ec53c
int3
mov ecx, 6
mov dword [rsp + 0x58], edi
call fcn.1403e4090
int3
lea rcx, [0x140715d20]
call fcn.1403e5618
cmp dword [0x140715d20], 0xffffffff
jne 0x14019629b
lea rcx, [0x1404243c0]
call fcn.1403e53c8
lea rcx, [0x140715d20]
call fcn.1403e55ac
jmp 0x14019629b
lea rcx, [0x140715d60]
call fcn.1403e5618
cmp dword [0x140715d60], 0xffffffff
jne 0x1401962bb
xorps xmm0, xmm0
lea rcx, [0x140715d28]
xor eax, eax
movups xmmword [0x140715d28], xmm0
mov qword [0x140715d58], rax
movups xmmword [0x140715d38], xmm0
movups xmmword [0x140715d48], xmm0
call fcn.140194280
lea rcx, [0x140424440]
call fcn.1403e53c8
lea rcx, [0x140715d60]
call fcn.1403e55ac
jmp 0x1401962bb
call fcn.1403eb834
int3
call fcn.1403eb834
int3
call fcn.1403eb834
int3
call fcn.1403f9238
int3
call fcn.1400fd2a0
int3
call fcn.1403eb834
int3
call fcn.1403eb834
int3
mov ecx, 6
mov dword [rsp + 0x58], edi
call fcn.1403e4090
int3
call fcn.1403eb834
int3
mov ecx, 1
call fcn.1403e4090
int3
mov ecx, 6
mov dword [rsp + 0x58], edi
call fcn.1403e4090
int3