Function at 0x140033cf8
Capabilities:
Create process on windows
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x1403b9010]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov qword [rbp - 0x38], r8
mov dil, dl
mov byte [rsp + 0x58], dl
mov r15, rcx
mov qword [rsp + 0x60], rcx
xor r14d, r14d
mov qword [r8], r14
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x68], r14
mov r12d, r14d
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x60], r14
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
mov ebx, r14d
mov qword [rbp - 0x58], rbx
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov dword [rbp - 0x80], r14d
call fcn.140034f08
mov rcx, rax
test rax, rax
je 0x14003488b
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x170]
test dil, dil
jne 0x140033e44
call fcn.1400497d8
mov edi, eax
test eax, eax
jns 0x140033e54
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140033dda
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140033dea
call fcn.14006c080
nop
mov rbx, qword [rbp - 0x58]
test rbx, rbx
je 0x140033e05
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov rcx, rbx
call fcn.14006c080
nop
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140033e18
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x78], r14
mov eax, edi
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.14005f5e0
mov rbx, qword [rsp + 0x4d8]
add rsp, 0x490
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140033bfc
nop
mov edi, eax
test eax, eax
jne 0x140033dba
lea rcx, [rbp + 0x170]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140033e5f
mov r8d, eax
lea rdx, [rbp + 0x170]
lea rcx, [rsp + 0x50]
call fcn.1400348c4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x30], 2
mov r13d, 1
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r14d
lea r9, [rbp - 0x78]
mov r8, rdi
mov rdx, qword [r15]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x140033ede
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov esi, 0x80004005
test edi, edi
cmovns edi, esi
jmp 0x140033dba
mov rsi, qword [rbp - 0x78]
mov edx, 8
mov rcx, r13
call fcn.140070d18
mov r14, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140034880
mov eax, 1
mov edi, eax
mov qword [rsp + 0x78], rax
mov qword [r14], rsi
mov esi, eax
mov qword [rsp + 0x70], rax
mov rcx, qword [r15 + 0x28]
test rcx, rcx
je 0x140033fa9
mov r8d, eax
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x140033f58
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
xor r14d, r14d
test eax, eax
cmovle edi, eax
mov esi, 0x80004005
test edi, edi
cmovns edi, esi
jmp 0x14003484e
mov r13, qword [r15 + 0x28]
mov qword [rbp - 0x68], r13
mov edx, 8
lea ecx, [rdx - 6]
call fcn.140070d18
mov rsi, rax
test rax, rax
je 0x140034896
mov rcx, qword [r14]
mov qword [rax], rcx
mov rcx, r14
call fcn.14006c080
mov r14, rsi
mov qword [rsp + 0x68], rsi
mov eax, 2
mov edi, eax
mov qword [rsp + 0x78], rax
mov qword [rsi + 8], r13
mov esi, eax
mov qword [rsp + 0x70], rax
lea eax, [rsi - 1]
mov r8d, eax
mov edx, eax
mov rcx, qword [r15 + 0x30]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x140033fd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
xor r14d, r14d
mov esi, 0x80004005
jmp 0x1400346ec
mov r12, qword [r15 + 0x30]
lea r15, [rsi + 1]
cmp r15, rdi
jbe 0x140034014
mov edx, 8
test r14, r14
jne 0x14003419d
mov rcx, r15
call fcn.140070d18
mov r14, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400348a1
mov rdi, r15
mov qword [rsp + 0x78], r15
mov qword [r14 + rsi*8], r12
lea r13, [rsi + 1]
mov qword [rsp + 0x70], r13
mov edx, 1
mov r8d, edx
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsi + 0x38]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x140033fbc
mov rsi, qword [rsi + 0x38]
mov qword [rbp - 0x70], rsi
cmp r13, rdi
jb 0x140034081
lea rsi, [r13 + 1]
cmp rsi, rdi
jbe 0x140034081
mov edx, 8
test r14, r14
jne 0x140034203
mov rcx, rsi
call fcn.140070d18
mov r14, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400348ac
mov rdi, rsi
mov qword [rsp + 0x78], rsi
mov rsi, qword [rsp + 0x70]
mov rax, qword [rbp - 0x70]
mov qword [r14 + rsi*8], rax
inc rsi
mov qword [rsp + 0x70], rsi
mov edx, 1
mov r8d, edx
mov r15, qword [rsp + 0x60]
mov rcx, qword [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x140033fbc
mov rax, qword [r15 + 0x40]
mov qword [rbp - 0x60], rax
cmp rsi, rdi
jb 0x1400340fc
lea r15, [rsi + 1]
cmp r15, rdi
jbe 0x1400340f7
mov edx, 8
test r14, r14
jne 0x140034269
mov rcx, r15
call fcn.140070d18
mov r14, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400348b7
mov qword [rsp + 0x78], r15
mov r15, qword [rsp + 0x60]
mov rdi, qword [rbp - 0x60]
mov qword [r14 + rsi*8], rdi
inc rsi
mov qword [rsp + 0x70], rsi
lea rdx, str.__CHILDSERVER
or rax, 0xffffffffffffffff
xor esi, esi
inc rax
cmp word [rdx + rax*2], si
jne 0x140034119
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.1400348c4
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8d, [r9 + 1]
lea rdx, [rbp + 0x58]
mov rcx, qword [rbp - 0x78]
call fcn.14006c00c
lea rcx, [rbp + 0x58]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x14003414e
mov r8d, eax
lea rdx, [rbp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.1400348c4
lea rdx, [0x14037c8d0]
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], si
jne 0x140034173
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.1400348c4
mov rdx, qword [r15 + 8]
test rdx, rdx
jne 0x1400342c7
mov eax, esi
jmp 0x1400342d4
mov rcx, rdi
shr rcx, 1
mov rax, r15
sub rax, rdi
cmp rax, rcx
cmovbe rax, rcx
add rax, rdi
mov rdi, r15
cmp r15, rax
cmovb rdi, rax
mov rcx, rdi
call fcn.140070d18
mov r15, rax
test rax, rax
je 0x1400348a1
lea r8, [rsi*8]
test r8, r8
je 0x1400341e9
mov rdx, r14
mov rcx, rax
call fcn.14006b740
mov rcx, r14
call fcn.14006c080
mov r14, r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x78], rdi
jmp 0x140034014
mov rcx, rdi
shr rcx, 1
mov rax, rsi
sub rax, rdi
cmp rax, rcx
cmovbe rax, rcx
add rax, rdi
mov rdi, rsi
cmp rsi, rax
cmovb rdi, rax
mov rcx, rdi
call fcn.140070d18
mov rsi, rax
test rax, rax
je 0x1400348ac
lea r8, [r13*8]
test r8, r8
je 0x14003424f
mov rdx, r14
mov rcx, rax
call fcn.14006b740
mov rcx, r14
call fcn.14006c080
mov r14, rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rdi
jmp 0x140034081
mov rcx, rdi
shr rcx, 1
mov rax, r15
sub rax, rdi
cmp rax, rcx
cmovbe rax, rcx
add rax, rdi
cmp r15, rax
cmovb r15, rax
mov rcx, r15
call fcn.140070d18
mov rdi, rax
test rax, rax
je 0x1400348b7
lea r8, [rsi*8]
test r8, r8
je 0x1400342b2
mov rdx, r14
mov rcx, rax
call fcn.14006b740
mov rcx, r14
call fcn.14006c080
mov r14, rdi
mov qword [rsp + 0x68], rdi
jmp 0x1400340f2
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], si
jne 0x1400342cb
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.1400348c4
lea rdx, [0x14037c8d8]
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], si
jne 0x1400342ec
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.1400348c4
lea rcx, [r15 + 0x10]
mov r8d, SafeArrayAllocDescriptorEx
lea rdx, [rbp + 0x120]
call qword [sym.imp.ole32.dll_StringFromGUID2]
lea rcx, [rbp + 0x120]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x140034324
mov r8d, eax
lea rdx, [rbp + 0x120]
lea rcx, [rsp + 0x50]
call fcn.1400348c4
lea rdx, [0x14037c8e0]
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], si
jne 0x14003434c
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.1400348c4
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8d, [r9 - 7]
lea rdx, [rbp + 0x40]
mov ecx, dword [r15 + 0x20]
call fcn.14006c030
lea rcx, [rbp + 0x40]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x140034381
mov r8d, eax
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1400348c4
lea rcx, [0x14037c8e8]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x1400343a6
mov r8d, eax
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.1400348c4
cmp byte [rsp + 0x58], sil
jne 0x1400343fd
movzx r8d, word [r15 + 0x24]
lea rdx, [0x14037c8ec]
lea rcx, [rsp + 0x50]
call fcn.1400349d8
or rax, 0xffffffffffffffff
lea rdx, [0x14037c8e8]
inc rax
cmp word [rdx + rax*2], si
jne 0x1400343e7
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.1400348c4
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8d, [r9 + 1]
lea rdx, [rbp + 0x80]
mov rcx, qword [rbp - 0x68]
call fcn.14006c00c
lea rcx, [rbp + 0x80]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x140034422
mov r8d, eax
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x50]
call fcn.1400348c4
or rax, 0xffffffffffffffff
lea rcx, [0x14037c8e8]
inc rax
cmp word [rcx + rax*2], si
jne 0x14003444a
mov r8d, eax
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.1400348c4
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8d, [r9 + 1]
lea rdx, [rbp + 0xa8]
mov rcx, r12
call fcn.14006c00c
lea rcx, [rbp + 0xa8]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x140034487
mov r8d, eax
lea rdx, [rbp + 0xa8]
lea rcx, [rsp + 0x50]
call fcn.1400348c4
or rax, 0xffffffffffffffff
lea rcx, [0x14037c8e8]
inc rax
cmp word [rcx + rax*2], si
jne 0x1400344af
mov r8d, eax
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.1400348c4
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8d, [r9 + 1]
lea rdx, [rbp + 0xd0]
mov rcx, qword [rbp - 0x70]
call fcn.14006c00c
lea rcx, [rbp + 0xd0]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x1400344ed
mov r8d, eax
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.1400348c4
or rax, 0xffffffffffffffff
lea rcx, [0x14037c8e8]
inc rax
cmp word [rcx + rax*2], si
jne 0x140034515
mov r8d, eax
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.1400348c4
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8d, [r9 + 1]
lea rdx, [rbp + 0xf8]
mov rcx, rdi
call fcn.14006c00c
lea rcx, [rbp + 0xf8]
or rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [rcx + rax*2], si
jne 0x140034555
mov r8d, eax
lea rdx, [rbp + 0xf8]
lea rcx, [rsp + 0x50]
call fcn.1400348c4
mov rax, rdi
cmp byte [r15 + 0x48], sil
je 0x14003458d
lea rdx, str.__silent
inc rax
cmp word [rdx + rax*2], si
jne 0x140034582
jmp 0x14003459d
lea rdx, str.__silent_
inc rax
cmp word [rdx + rax*2], si
jne 0x140034594
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.1400348c4
mov rax, rdi
cmp byte [r15 + 0x49], sil
je 0x1400345c5
lea rdx, str.__servicemode
inc rax
cmp word [rdx + rax*2], si
jne 0x1400345ba
jmp 0x1400345d5
lea rdx, str.__servicemode_
inc rax
cmp word [rdx + rax*2], si
jne 0x1400345cc
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.1400348c4
cmp byte [0x1403e51b8], sil
je 0x14003460b
lea rdx, str.__FallbackLoadRemoteManagedPdbs
mov rax, rdi
inc rax
cmp word [rdx + rax*2], si
jne 0x1400345f5
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.1400348c4
mov qword [rsp + 0x60], rsi
lea r9, [rsp + 0x60]
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov esi, 0x80004005
mov r15d, 0x80070000
test eax, eax
jne 0x140034653
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, r15d
xor ecx, ecx
test eax, eax
cmovle edi, eax
test edi, edi
cmovns edi, esi
cmp edi, 0x8007007a
jne 0x1400346a6
mov rcx, qword [rsp + 0x60]
call fcn.14006c078
mov r13, rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
xor ecx, ecx
test eax, eax
jne 0x14003469d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, r15d
test eax, eax
cmovle edi, eax
test edi, edi
cmovns edi, esi
mov rcx, r13
call fcn.14006c080
xor ecx, ecx
jmp 0x1400346a6
mov rbx, r13
mov qword [rbp - 0x58], rbx
mov edi, ecx
test edi, edi
js 0x1400347eb
mov eax, dword [rsp + 0x70]
shl rax, 3
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r9, r14
xor edx, edx
mov r8d, 0x20002
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
xor r14d, r14d
test eax, eax
jne 0x1400346fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, r15d
test eax, eax
cmovle edi, eax
test edi, edi
cmovns edi, esi
jmp 0x1400347ee
mov rax, qword [rsp + 0x50]
cmp dword [rax - 8], 1
jle 0x140034713
mov edx, dword [rax - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140034bd8
mov dword [rbp - 0x30], WSAStartup
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x28]
call fcn.1400612f0
mov qword [rbp + 0x38], rbx
lea rax, [rbp - 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80084
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14003478d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, r15d
test eax, eax
cmovle edi, eax
test edi, edi
cmovns edi, esi
jmp 0x140034790
mov edi, r14d
mov rbx, qword [rsp + 0x50]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.14006c1e4
test eax, eax
js 0x140034875
cmp eax, dword [rbx - 0xc]
jg 0x140034875
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r14w
test edi, edi
jne 0x1400347ee
mov rdx, qword [rbp - 0x50]
lea rcx, [0x1403e45b0]
call fcn.140211570
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x38]
mov qword [rcx], rax
mov qword [rbp - 0x50], r14
jmp 0x1400347ee
xor r14d, r14d
mov rax, qword [rbp - 0x68]
test rax, rax
je 0x140034807
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test r12, r12
je 0x14003481c
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rbp - 0x70]
test rax, rax
je 0x140034835
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rbp - 0x60]
test rax, rax
je 0x14003484e
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14003485d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140033dba
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140033dba
mov ecx, 0x80070057
call fcn.140034ce8
int3
mov ecx, 0x8007000e
call fcn.140034ce8
nop
mov ecx, 0x80004005
call fcn.140034ce8
nop
mov ecx, 0x8007000e
call fcn.140034ce8
int3
mov ecx, 0x8007000e
call fcn.140034ce8
int3
mov ecx, 0x8007000e
call fcn.140034ce8
int3
mov ecx, 0x8007000e
call fcn.140034ce8
int3