Function at 0x140070840
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rcx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x140070bf5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140070c17
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp - 0x48], rax
lea rsi, str.bnBtYnNhcg
mov rdx, rsi
lea rcx, [rbp - 0x48]
call fcn.140031e00
mov rdi, 0xffffffffffffffff
test al, al
jne 0x1400708ea
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x1400708d0
mov r8d, eax
mov rdx, rsi
lea rcx, [rbp - 0x48]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140070c22
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp - 0x50], rax
lea rsi, str.cWZtdUdsQXNwcGNsckBwbXVxY3BdY3BwbXA
mov rdx, rsi
lea rcx, [rbp - 0x50]
call fcn.140031e00
test al, al
jne 0x14007093d
mov rax, rdi
inc rax
cmp word [rsi + rax*2], 0
jne 0x140070923
mov r8d, eax
mov rdx, rsi
lea rcx, [rbp - 0x50]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140070c2d
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp + 0x48], rax
lea rsi, str.JGNBbWJjOyNqcyRgcDtiY2Rfc2py
mov rdx, rsi
lea rcx, [rbp + 0x48]
call fcn.140031e00
test al, al
jne 0x140070990
mov rax, rdi
inc rax
cmp word [rsi + rax*2], 0
jne 0x140070976
mov r8d, eax
mov rdx, rsi
lea rcx, [rbp + 0x48]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140070c38
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp - 0x40], rax
mov r15, qword [rbp + 0x48]
lea rcx, [r15 - 0x18]
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x20]
call fcn.14004beb0
nop
mov r8d, ebx
mov rdx, qword [rax]
lea rcx, [rbp - 0x40]
call fcn.140025c80
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400709ff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140070c43
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp + 0x40], rax
lea rbx, [0x1401e3cf8]
mov rdx, rbx
lea rcx, [rbp + 0x40]
call fcn.140031e00
test al, al
jne 0x140070a5a
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140070a40
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x40]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140070c0c
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp + 0x38], rax
mov rdx, rbx
lea rcx, [rbp + 0x38]
call fcn.140031e00
test al, al
jne 0x140070aaa
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140070a90
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x38]
call fcn.140032190
nop
mov r14, qword [rbp - 0x50]
lea rcx, [r14 - 0x18]
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x10]
call fcn.14004beb0
mov rbx, rax
mov rsi, qword [rbp - 0x48]
lea rcx, [rsi - 0x18]
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x18]
call fcn.14004beb0
nop
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x38]
lea r8, [rbp - 0x40]
mov rdx, rbx
mov rcx, rax
call fcn.140061650
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140070b2d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140070b4b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140070b69
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140070b87
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140070ba5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [r15 - 8], eax
sub eax, 1
jg 0x140070bc1
mov rcx, qword [r15 - 0x18]
mov rax, qword [rcx]
lea rdx, [r15 - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
lock xadd dword [r14 - 8], eax
sub eax, 1
jg 0x140070bdd
mov rcx, qword [r14 - 0x18]
mov rax, qword [rcx]
lea rdx, [r14 - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lock xadd dword [rsi - 8], edi
sub edi, 1
jg 0x140070bf5
mov rcx, qword [rsi - 0x18]
mov rax, qword [rcx]
lea rdx, [rsi - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
int3