Function at 0x1400020b0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x140097050]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov r15, rcx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
lea rcx, [rsp + 0x70]
call fcn.140001ba0
nop
movzx eax, byte [rbp - 0x70]
test al, al
jne 0x14000210f
lea esi, [r13 + 1]
jmp 0x140002b6f
lea rdx, [rsp + 0x70]
lea rcx, str.App_use_wsudo_bridge:__s
call fcn.140003660
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x14008da30]
movdqu xmmword [rbp + 0x20], xmm1
mov word [rbp + 0x10], r13w
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
lea rax, str.__parent
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 8
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140003100
lea rdx, [rbp + 0xc0]
mov ecx, edi
call fcn.1400011d0
lea rcx, [rbp + 0xc0]
sub rax, rcx
sar rax, 1
lea rcx, [rbp + 0xc0]
mov qword [rbp + 0xb0], rcx
mov qword [rbp + 0xb8], rax
movaps xmm0, xmmword [rbp + 0xb0]
movaps xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140003100
lea rcx, [rbp + 0x90]
call fcn.140001960
nop
cmp qword [rbp + 0xa0], 0
je 0x14000224f
lea rax, str.__pwd
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 5
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140003100
lea rax, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rax, qword [rbp + 0x90]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0xa0]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140003100
movzx edx, byte [r15 + 0x139]
lea rcx, [rbp + 0xb0]
call fcn.140003490
mov qword [rsp + 0x68], 0xa
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], r13w
mov dword [rsp + 0x30], 4
mov rdx, qword [rbp + 0xb8]
add rdx, 0xa
jne 0x1400022a5
mov qword [rbp + 0x40], rdx
mov word [rbp + rdx*2 + 0x30], r13w
jmp 0x1400022dd
cmp rdx, 7
ja 0x1400022c5
mov qword [rbp + 0x40], rdx
movzx eax, r13w
lea rdi, [rbp + 0x30]
mov rcx, rdx
rep stosw word [rdi], ax
mov word [rbp + rdx*2 + 0x30], r13w
jmp 0x1400022dd
mov word [rsp + 0x20], r13w
mov r9, rdx
movzx r8d, byte [rsp + 0x50]
lea rcx, [rbp + 0x30]
call fcn.140003960
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rcx, qword [rbp + 0x30]
movups xmm0, xmmword [str.__visible]
movups xmmword [rcx], xmm0
mov eax, dword [0x140065940]
mov dword [rcx + 0x10], eax
add rcx, 0x14
mov r8, qword [rbp + 0xb8]
test r8, r8
je 0x14000231e
add r8, r8
mov rdx, qword [rbp + 0xb0]
call fcn.14003cbb0
nop
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rax, qword [rbp + 0x30]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140003100
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x140002398
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002393
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002be8
call fcn.14003ac6c
mov ecx, 2
call fcn.1400410c4
mov rcx, rax
call fcn.140048c6c
mov ecx, eax
call fcn.140048bf4
mov dword [rsp + 0x30], r13d
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
cmp eax, 1
jne 0x140002402
cmp dword [rsp + 0x30], 0
je 0x140002402
lea rax, str.__attach
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 8
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140003100
mov r14d, 6
cmp byte [r15 + 0x13d], 0
jne 0x14000245e
cmp byte [r15 + 0x13c], 0
jne 0x140002430
cmp byte [r15 + 0x13e], 0
je 0x14000245e
cmp byte [r15 + 0x139], 0
jne 0x14000245e
lea rax, str.__wait
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r14
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140003100
cmp byte [0x140099558], 0
je 0x140002499
lea rax, str.__verbose
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 9
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140003100
movzx ecx, byte [r15 + 0x138]
sub ecx, r14d
je 0x1400024b8
cmp ecx, 1
jne 0x14000252c
lea rdi, str.trustedinstaller
jmp 0x1400024bf
lea rdi, [0x140065898]
lea rax, [0x140065984]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140003100
mov qword [rsp + 0x30], rdi
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140002500
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140003100
cmp qword [r15 + 0xe8], 0
je 0x1400025ae
lea rax, str.__cwd
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 5
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140003100
lea rcx, [r15 + 0xd8]
cmp qword [r15 + 0xf0], 8
jb 0x140002580
mov rcx, qword [r15 + 0xd8]
mov rax, qword [r15 + 0xe8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140003100
mov rbx, qword [r15 + 0xa0]
mov r12, qword [r15 + 0xa8]
cmp rbx, r12
je 0x140002724
lea rcx, [0x14006599c]
movabs rax, 0x7ffffffffffffffe
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], r13
mov rsi, qword [rbx + 0x10]
mov r14, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400025f6
mov r14, qword [rbx]
cmp rsi, rax
ja 0x140002bfa
mov qword [rbp + 0x48], 7
cmp rsi, 8
jae 0x14000261b
mov qword [rbp + 0x40], rsi
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x30], xmm0
jmp 0x14000266c
mov rdi, rsi
or rdi, 7
cmp rdi, rax
jbe 0x14000262c
mov rdi, rax
jmp 0x140002639
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp + 0x30]
call fcn.140003c60
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rdi
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.14003cbb0
lea rcx, [0x14006599c]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 2
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x60], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x10]
call fcn.140003100
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rax, qword [rbp + 0x30]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x10]
call fcn.140003100
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x140002711
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000270c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002bf4
call fcn.14003ac6c
add rbx, 0x20
cmp rbx, r12
jne 0x1400025c5
mov r14d, 6
lea rcx, [r15 + 0xb8]
cmp qword [r15 + 0xd0], 8
jb 0x14000273c
mov rcx, qword [r15 + 0xb8]
mov rax, qword [r15 + 0xc8]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x10]
call fcn.140003100
mov esi, 1
mov ebx, esi
mov rcx, qword [r15 + 0x88]
mov rax, qword [r15 + 0x90]
sub rax, rcx
sar rax, 5
cmp rax, rbx
jbe 0x1400027ed
mov edi, 0x20
lea rax, [rdi + rcx]
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x1400027a1
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x10]
call fcn.140003100
inc rbx
add rdi, 0x20
mov rcx, qword [r15 + 0x88]
mov rax, qword [r15 + 0x90]
sub rax, rcx
sar rax, 5
cmp rbx, rax
jb 0x140002790
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
lea rax, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rax, qword [rsp + 0x70]
mov qword [rbp - 0x48], rax
lea rax, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rax, qword [rbp + 0x10]
mov qword [rbp - 0x40], rax
lea rax, str.runas
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x60], 0x70
mov qword [rbp - 0x58], r13
mov dword [rbp - 0x30], r13d
mov dword [rbp - 0x5c], 0x40
lea rcx, [rbp - 0x60]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, esi
je 0x140002a9a
lea rax, [0x1400656e0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r13
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xb0]
call fcn.140001350
nop
mov ecx, 2
call fcn.1400410c4
mov rdi, rax
mov word [rbp + 0x40], r14w
lea rax, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 8
cmovae rax, qword [rbp + 0xb0]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [0x14008da30]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], r13w
lea rax, [rbp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, str.unable_create_process__s
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x18
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
mov r9, rsi
lea r8, [rbp + 0x30]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.14002b5c0
test al, al
jne 0x1400029a6
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov rcx, r13
mov qword [rbp + 0x80], rcx
mov edx, 7
mov qword [rbp + 0x88], rdx
mov word [rbp + 0x70], r13w
mov rax, qword [rbp + 0x68]
cmp rax, 8
jb 0x140002997
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002984
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002bee
call fcn.14003ac6c
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x80]
movdqa xmm0, xmmword [0x14008da30]
movdqu xmmword [rbp + 0x60], xmm0
jmp 0x1400029d9
movups xmm0, xmmword [rbp + 0x50]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rbp + 0x60]
movups xmmword [rbp + 0x80], xmm1
movdqa xmm0, xmmword [0x14008da30]
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rdx, xmm0
movq rcx, xmm1
mov word [rbp + 0x50], r13w
lea rax, [rbp + 0x70]
cmp rdx, 8
cmovae rax, qword [rbp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.14002f040
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x140002a52
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c00
call fcn.14003ac6c
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 8
jb 0x140002ab9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c06
call fcn.14003ac6c
jmp 0x140002ab9
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edi, eax
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
call fcn.1400016c0
mov esi, eax
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x140002aff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002afa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c0c
call fcn.14003ac6c
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], 7
mov word [rbp + 0x90], r13w
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x140002b59
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c12
call fcn.14003ac6c
movdqa xmm0, xmmword [0x14008da30]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], r13w
movzx eax, byte [rbp - 0x70]
test al, al
je 0x140002bb0
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140002bb0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002be2
call fcn.14003ac6c
mov eax, esi
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.14003ac10
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140041558
nop
call fcn.140041558
nop
call fcn.140041558
nop
call fcn.140041558
int3
call fcn.1400011b0
nop
call fcn.140041558
nop
call fcn.140041558
nop
call fcn.140041558
nop
call fcn.140041558
int3