Function at 0x140049dd0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x140212680]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov r13, rdx
mov rbx, rcx
mov qword [rsp + 0x60], rcx
mov qword [rbp - 0x10], rdx
cmp qword [rdx + 0xa0], 0
je 0x140049e20
add rdx, 0x90
lea rcx, [rbp + 0x40]
call fcn.1400068d0
nop
lea rdx, [rbx + 0x50]
lea rcx, [rbp - 8]
call fcn.1400068d0
nop
mov rsi, qword [rbp + 8]
mov r14, qword [rbp + 0x10]
test rsi, rsi
jne 0x140049f7b
lea r15, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova r15, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x50]
cmp rsi, r14
ja 0x140049e88
lea rbx, [rbp - 8]
cmp r14, 0xf
cmova rbx, qword [rbp - 8]
mov qword [rbp + 8], rsi
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call fcn.140134d20
mov byte [rsi + rbx], 0
jmp 0x14004a053
movabs rbx, 0x7fffffffffffffff
cmp rsi, rbx
ja 0x14004a4c8
mov rcx, rsi
or rcx, 0xf
cmp rcx, rbx
ja 0x140049eeb
mov rdx, r14
shr rdx, 1
mov rax, rbx
sub rax, rdx
cmp r14, rax
ja 0x140049eeb
lea rax, [rdx + r14]
mov rbx, rcx
cmp rcx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140049ed3
xor edi, edi
jmp 0x140049f20
cmp rcx, 0x1000
jb 0x140049f18
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004a4c2
jmp 0x140049ef9
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14010100c
test rax, rax
je 0x14004a4ce
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140049f20
call fcn.14010100c
mov rdi, rax
mov qword [rbp + 8], rsi
mov qword [rbp + 0x10], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call fcn.140134d20
mov byte [rsi + rdi], 0
cmp r14, 0xf
jbe 0x140049f72
lea rdx, [r14 + 1]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049f6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a4ce
call fcn.140101048
mov qword [rbp - 8], rdi
jmp 0x14004a057
lea r12, str._url_
cmp qword [0x140202048], 0xf
cmova r12, qword [str._url_]
lea rax, [rbp - 8]
mov rdi, qword [rbp - 8]
cmp r14, 0xf
cmova rax, rdi
mov qword [rbp + 0x20], rax
mov r15, qword [0x140202040]
cmp r15, rsi
ja 0x14004a05f
mov rcx, rsi
sub rcx, r15
test r15, r15
jne 0x140049fc5
xor ebx, ebx
jmp 0x14004a02d
inc rcx
add rcx, rax
mov qword [rbp + 0x60], rcx
movsx edx, byte [r12]
mov r8, rcx
sub r8, rax
mov rcx, rax
call fcn.140135760
mov rbx, rax
test rax, rax
je 0x14004a05f
nop word [rax + rax]
mov r8, r15
mov rdx, r12
mov rcx, rbx
call fcn.140135800
test eax, eax
je 0x14004a023
inc rbx
mov r8, qword [rbp + 0x60]
sub r8, rbx
movsx edx, byte [r12]
mov rcx, rbx
call fcn.140135760
mov rbx, rax
test rax, rax
jne 0x140049ff0
jmp 0x14004a05f
sub rbx, qword [rbp + 0x20]
cmp rbx, 0xffffffffffffffff
je 0x14004a05f
lea r9, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova r9, qword [rbp + 0x40]
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r8, r15
mov rdx, rbx
lea rcx, [rbp - 8]
call fcn.14003bbd0
mov rdi, qword [rbp - 8]
mov rsi, qword [rbp + 8]
mov r14, qword [rbp + 0x10]
mov r15, qword [rsp + 0x60]
mov rax, qword [r15]
cmp byte [rax + 0x80], 0
je 0x14004a156
cmp byte [r13 + 0x20], 0
je 0x14004a156
lea rax, [rbp - 8]
cmp r14, 0xf
cmova rax, rdi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rsi
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp + 0x60], xmm0
mov qword [rsp + 0x60], 0xd
lea rax, [rbp + 0x60]
mov qword [rsp + 0x68], rax
lea rax, str.__app
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], 8
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movaps xmm1, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x20], xmm1
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x80]
call fcn.14001fe10
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xf
jbe 0x14004a128
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a123
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a4ce
call fcn.140101048
movups xmm2, xmmword [rbp + 0x80]
movups xmmword [rbp - 8], xmm2
movups xmm1, xmmword [rbp + 0x90]
movups xmmword [rbp + 8], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r14, xmm0
movq rsi, xmm1
movq rdi, xmm2
cmp qword [r15 + 0x80], 0
je 0x14004a21a
mov rax, r14
sub rax, rsi
cmp rax, 1
jb 0x14004a18c
lea rax, [rsi + 1]
mov qword [rbp + 8], rax
lea rax, [rbp - 8]
cmp r14, 0xf
cmova rax, rdi
mov word [rax + rsi], 0x20
jmp 0x14004a1b0
mov qword [rsp + 0x20], 1
lea r9, [0x140142444]
movzx r8d, byte [rsp + 0x50]
mov edx, 1
lea rcx, [rbp - 8]
call fcn.1400061d0
lea r9, [r15 + 0x70]
mov rdi, qword [r9 + 0x10]
cmp qword [r9 + 0x18], 0xf
jbe 0x14004a1c2
mov r9, qword [r9]
mov rsi, qword [rbp + 8]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x14004a203
lea rax, [rdi + rsi]
mov qword [rbp + 8], rax
lea rbx, [rbp - 8]
cmp rcx, 0xf
cmova rbx, qword [rbp - 8]
lea rcx, [rbx + rsi]
mov r8, rdi
mov rdx, r9
call fcn.140134d20
lea rax, [rdi + rbx]
mov byte [rax + rsi], 0
jmp 0x14004a21a
mov qword [rsp + 0x20], rdi
movzx r8d, byte [rsp + 0x50]
mov rdx, rdi
lea rcx, [rbp - 8]
call fcn.1400061d0
mov rdx, qword [r15]
add rdx, 0x40
lea r8, [0x140142444]
lea rcx, [rbp + 0x60]
call fcn.140046160
nop
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova rdx, qword [rbp - 8]
mov r8, qword [rbp + 8]
mov rcx, rax
call fcn.140009250
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x80]
call fcn.14003cea0
cmp qword [rax + 0x18], 7
jbe 0x14004a2c2
mov rax, qword [rax]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
mov rdx, qword [rbp + 0x98]
cmp rdx, 7
jbe 0x14004a350
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a34b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a4d4
call fcn.140101048
test ebx, ebx
je 0x14004a37b
mov edx, 0x1388
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14004a3b6
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a3b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a4da
call fcn.140101048
movdqa xmm0, xmmword [0x140142560]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x14004a403
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a3fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a4e0
call fcn.140101048
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xf
jbe 0x14004a43e
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a439
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a4e6
call fcn.140101048
mov qword [rbp + 8], 0
mov qword [rbp + 0x10], 0xf
mov byte [rbp - 8], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14004a48a
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a484
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a4bc
call fcn.140101048
nop
mov rcx, r13
call fcn.140045430
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.140101160
mov rbx, qword [rsp + 0x200]
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140107114
nop
call fcn.1400091d0
int3
call fcn.140009210
int3
call fcn.140107114
nop
call fcn.140107114
nop
call fcn.140107114
nop
call fcn.140107114
nop
call fcn.140107114
int3