Function at 0x1400782d0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x1401e4c00]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov r12, rcx
mov qword [rbp - 0x68], rcx
xor r13d, r13d
mov esi, r13d
mov dword [rsp + 0x30], r13d
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x190], xmm1
mov r8d, 4
lea rdx, str..exe
lea rcx, [rbp + 0x180]
call fcn.140048050
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1b0], xmm1
mov r8d, 4
lea rdx, str..ps1
lea rcx, [rbp + 0x1a0]
call fcn.140048050
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1d0], xmm1
mov r8d, 4
lea rdx, str..cmd
lea rcx, [rbp + 0x1c0]
call fcn.140048050
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1f0], xmm1
mov r8d, 4
lea rdx, str..vbs
lea rcx, [rbp + 0x1e0]
call fcn.140048050
nop
mov rax, qword [r12]
mov r15d, r13d
test rax, rax
je 0x1400783ee
mov ecx, 0x5a4d
cmp cx, word [rax]
sete r15b
lea r14, [rbp + 0x180]
movzx ebx, byte [rsp + 0x34]
nop word [rax + rax]
test r15, r15
je 0x140078429
mov rax, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x140078412
mov rax, qword [r14]
cmp qword [r14 + 0x10], 4
jne 0x1400789e0
cmp dword [rax], 0x6578652e
jne 0x1400789e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], send
mov byte [rsp + 0x38], 0
or esi, 1
mov dword [rsp + 0x30], esi
mov edi, reloc.SHLWAPI.dll_SHCreateMemStream
movabs r13, 0x948b0fcd6e9e0653
lea r12, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_________._
nop dword [rax + rax]
call fcn.14009ac4c
movsxd rcx, eax
mov rax, r13
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 6
imul rax, rax, 0x51
sub rcx, rax
movzx r9d, byte [rcx + r12]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
cmp rcx, rdx
jae 0x1400784cc
lea rax, [rcx + 1]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x38]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400784df
movzx r8d, bl
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.1400486b0
sub rdi, 1
jne 0x140078470
mov r12, qword [rbp - 0x68]
xor r13d, r13d
mov rdx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x1400784f9
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
lea rcx, [rsp + 0x38]
call fcn.140043ad0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], send
mov byte [rax], 0
or esi, 2
mov dword [rsp + 0x30], esi
lea rax, [rbp - 0x60]
mov qword [rbp + 0x10], rax
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rax, qword [rsp + 0x58]
mov qword [rbp - 0x10], rax
mov rax, qword [rsp + 0x68]
mov qword [rbp - 8], rax
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp], xmm0
lea rdx, [rbp]
lea rcx, [rbp - 0x60]
call fcn.14004f090
or esi, 4
mov dword [rsp + 0x30], esi
and esi, 0xfffffffb
mov dword [rsp + 0x30], esi
lea rcx, [rbp - 0x40]
call fcn.14007b230
or esi, 8
mov dword [rsp + 0x30], esi
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x48]
call fcn.14002ff50
nop
and esi, 0xfffffff7
mov dword [rsp + 0x30], esi
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x1400785f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400785ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078a4e
call fcn.1400b5fd0
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x140078644
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007863f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078a54
call fcn.1400b5fd0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r13w
and esi, 0xfffffffd
mov dword [rsp + 0x30], esi
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140078699
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078694
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078a5a
call fcn.1400b5fd0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], send
mov byte [rsp + 0x58], 0
and esi, 0xfffffffe
mov dword [rsp + 0x30], esi
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x1400786f0
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400786eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078a60
call fcn.1400b5fd0
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], send
mov byte [rsp + 0x38], 0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x70]
call fcn.1400fdb10
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 7
cmova rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x70]
call fcn.140078f30
nop
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x70], rdi
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x6c], edx
cmp qword [rbp + 0xf8], 0
je 0x140078908
mov rdx, qword [r12]
mov r8, qword [r12 + 8]
sub r8, rdx
lea rcx, [rbp + 0x70]
call fcn.140078d60
lea rcx, [rbp + 0x70]
call fcn.1400442e0
lea rcx, [rbp + 0x78]
call fcn.140054da0
test rax, rax
jne 0x1400787c8
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
mov eax, 6
cmp qword [rbp + rcx + 0xb8], 0
mov edx, 2
cmovne eax, edx
or eax, dword [rbp + rcx + 0x80]
and eax, 0x17
mov dword [rbp + rcx + 0x80], eax
and eax, dword [rbp + rcx + 0x84]
jne 0x140078a66
call fcn.14007cde0
lea rdx, str.open
test eax, eax
lea rax, str.runas
cmovne rdx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140078800
lea rcx, [rbp + 0x28]
call fcn.140037630
nop
lea rdx, [rbp + 0x48]
lea rcx, [rsp + 0x78]
call fcn.1400378c0
or esi, 0x10
mov dword [rsp + 0x30], esi
lea r8, [rsp + 0x78]
cmp qword [rbp - 0x70], 7
cmova r8, qword [rsp + 0x78]
lea rdx, [rbp + 0x28]
cmp qword [rbp + 0x40], 7
cmova rdx, qword [rbp + 0x28]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
and esi, 0xffffffef
mov dword [rsp + 0x30], esi
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x1400788a5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400788a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078ab5
call fcn.1400b5fd0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r13w
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x1400788f7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400788f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078a42
call fcn.1400b5fd0
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
lea rax, [rbp + 0x118]
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x70], rdi
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x6c], edx
lea rcx, [rbp + 0x78]
call fcn.1400546e0
nop
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x70], rax
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x6c], edx
lea rax, [rbp + 0x118]
mov qword [rbp + 0x20], rax
lea rax, vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x118], rax
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 0x118]
call fcn.1400ec95c
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 7
jbe 0x1400789cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400789ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078a48
call fcn.1400b5fd0
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], 7
mov word [rbp + 0x48], r13w
add r14, 0x20
lea rax, [rbp + 0x200]
cmp r14, rax
jne 0x140078400
lea r9, [fcn.1400426c0]
mov edx, 0x20
mov r8d, 4
lea rcx, [rbp + 0x180]
call fcn.1400b6014
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.1400b5fb0
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140093bc4
nop
call fcn.140093bc4
nop
call fcn.140093bc4
nop
call fcn.140093bc4
nop
call fcn.140093bc4
nop
call fcn.140093bc4
nop
test al, 4
je 0x140078a73
lea rbx, str.ios_base::badbit_set
jmp 0x140078a87
test dl, al
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rbp]
call fcn.14002e300
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.14002f500
lea rdx, [0x1401e1948]
lea rcx, [rbp - 0x40]
call fcn.1400b85d8
nop
call fcn.140093bc4
int3