Function at 0x140068660
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x160
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1401a9600]
xor rax, rsp
mov qword [rbp + 0x100], rax
lea rdx, [0x1401aa720]
lea rcx, [rbp + 0xa0]
call fcn.140063fc0
nop
lea rbx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova rbx, qword [rbp + 0xa0]
xor r14d, r14d
mov rax, qword [rbp + 0xb0]
cmp rax, 5
jb 0x140068755
lea rdi, [rax + rbx]
lea r8, [rdi - 4]
sub r8, rbx
lea edx, [r14 + 0x31]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
je 0x140068755
lea rsi, str.1.0.6
nop
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
cmp al, byte [rsi + rcx - 1]
jne 0x140068729
cmp rcx, 5
jne 0x140068710
mov eax, r14d
jmp 0x14006872e
sbb eax, eax
or eax, 1
test eax, eax
je 0x140068a82
inc r9
lea r8, [rdi - 4]
sub r8, r9
mov edx, Ordinal_50
mov rcx, r9
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
jne 0x140068700
movabs rax, 0xe39c97907b0b4b49
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x641ba690dc7522d5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xf2594cb7d77a3036
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xa18991f1a0d4aa4d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x3890d276e1aa6046
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x95ffcfc9fa7bae5b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x6562d302ea930c0b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rcx, 0xe750f01a37bddd1c
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs r13, 0x8abce5f51f6a2405
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs r12, 0x77ed4e0b91102a6
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs r15, 0x80296c9bb31f4457
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs r14, 0xd5a9dabe80a7d928
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rsi, 0x57fcbc018ece4029
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rdi, 0xe0dfb8ac945bca3a
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rbx, 0x6562f2679ef2687b
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0x40], ymm1
mov r9d, Ordinal_50
lea r8, str.Warning
lea rdx, [rbp + 0x20]
xor ecx, ecx
vzeroupper
call qword [sym.imp.USER32.dll_MessageBoxA]
movabs rax, 0xa593df866f1e506d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x6612b793cd7e6ed5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xb0195cb5d0763724
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xb4dda9d1e8c5bc5f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x22d3d16eede03059
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x8f9397c9e03aae4a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x150b8849ec970c1a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rcx, 0xe750f01a37bddd1c
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0x40], ymm1
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0x20]
lea rdx, str.open
xor ecx, ecx
vzeroupper
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
sub r9, rbx
cmp r9, 0xffffffffffffffff
je 0x140068755
lea rdx, [0x1401aa740]
lea rcx, [rbp + 0x80]
call fcn.140063fc0
nop
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova rdx, qword [rbp + 0x80]
mov r8, qword [rbp + 0x90]
lea rcx, [0x1401aa780]
call fcn.14006a3e0
lea rdx, [0x1401aa760]
lea rcx, [rbp + 0x60]
call fcn.140063fc0
nop
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova rdx, qword [rbp + 0x60]
mov r8, qword [rbp + 0x70]
lea rcx, [0x1401aa760]
call fcn.14006a3e0
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140068b3b
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140068b36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140068b36
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e970c
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x140068b8f
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140068b8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140068b8a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e970c
mov qword [rbp + 0x90], r14
mov qword [rbp + 0x98], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x140068bec
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140068be7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140068be7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e970c
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.1400e9b80
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret