Function at 0x140104fc0
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x178
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], 0xfffffffffffffffe
mov qword [rbp + 0xa0], rcx
mov qword [rbp + 0xd8], 1
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov r15, qword [rdx]
mov qword [rbp + 0xa8], rdx
mov rax, qword [rdx + 0x10]
shl rax, 5
add rax, r15
mov qword [rbp + 0xd0], rax
jmp 0x140105024
add r15, 0x20
cmp r15, qword [rbp + 0xd0]
je 0x14010559f
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
mov rcx, rbp
call fcn.14022f390
mov rdx, qword [rbp + 0xe8]
cmp rdx, qword [rbp + 0xe0]
jne 0x140105063
lea rcx, [rbp + 0xd8]
call fcn.140076a80
mov rdx, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xd8]
mov byte [rax + rdx], 0x20
mov rdi, qword [rbp + 0xe8]
inc rdi
mov qword [rbp + 0xe8], rdi
mov rsi, qword [rbp]
mov r13, qword [rbp + 8]
test rsi, rsi
mov r12, rsi
cmove r12, r13
mov rbx, qword [rbp + 0x10]
test rbx, rbx
je 0x1401054e0
lea r14, [r12 + rbx]
mov rax, r12
jmp 0x1401050b9
cmp rax, r14
je 0x14010552e
movzx r9d, byte [rax]
movzx ecx, r9b
test cl, cl
js 0x1401050e0
inc rax
cmp ecx, 0x22
jbe 0x140105170
jmp 0x1401050b0
mov edx, ecx
and edx, 0x1f
movzx r10d, byte [rax + 1]
and r10d, 0x3f
cmp cl, 0xdf
jbe 0x140105139
movzx r8d, byte [rax + 2]
shl r10d, 6
and r8d, 0x3f
or r8d, r10d
cmp r9b, 0xf0
jb 0x14010514f
movzx ecx, byte [rax + 3]
and edx, 7
shl edx, 0x12
shl r8d, 6
and ecx, 0x3f
or ecx, r8d
or ecx, edx
cmp ecx, 0x110000
je 0x14010552e
add rax, 4
cmp ecx, 0x22
jbe 0x140105170
jmp 0x1401050b0
add rax, 2
shl edx, 6
or edx, r10d
mov ecx, edx
cmp ecx, 0x22
jbe 0x140105170
jmp 0x1401050b0
add rax, 3
shl edx, 0xc
or r8d, edx
mov ecx, r8d
cmp ecx, 0x22
ja 0x1401050b0
nop word cs:[rax + rax]
mov ecx, ecx
movabs rdx, 0x500000200
bt rdx, rcx
jae 0x1401050b0
cmp rdi, qword [rbp + 0xe0]
jne 0x1401051a5
lea rcx, [rbp + 0xd8]
mov rdx, rdi
call fcn.140076a80
mov rdi, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xd8]
mov byte [rax + rdi], 0x22
jmp 0x1401051d1
mov rdi, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xd8]
mov byte [rax + rdi], bl
mov rdi, qword [rbp + 0xe8]
inc rdi
jmp 0x1401051f5
mov rdi, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xd8]
mov word [rax + rdi], 0x225c
add rdi, 2
mov qword [rbp + 0xe8], rdi
cmp r12, r14
je 0x140105490
movzx ecx, byte [r12]
movzx ebx, cl
test bl, bl
js 0x140105220
inc r12
cmp ebx, 0x22
jne 0x140105290
jmp 0x140105360
mov eax, ebx
and eax, 0x1f
movzx edx, byte [r12 + 1]
and edx, 0x3f
cmp bl, 0xdf
jbe 0x140105270
movzx ebx, byte [r12 + 2]
shl edx, 6
and ebx, 0x3f
or ebx, edx
cmp cl, 0xf0
jb 0x140105342
movzx ecx, byte [r12 + 3]
add r12, 4
and eax, 7
shl eax, 0x12
shl ebx, 6
and ecx, 0x3f
or ecx, ebx
or ecx, eax
mov ebx, ecx
cmp ebx, 0x22
jne 0x140105290
jmp 0x140105360
add r12, 2
shl eax, 6
or eax, edx
mov ebx, eax
cmp ebx, 0x22
je 0x140105360
nop word cs:[rax + rax]
cmp ebx, 0x5c
je 0x140105300
cmp ebx, 0x110000
je 0x140105490
cmp ebx, 0x80
jb 0x140105460
mov dword [rbp + 0xb0], 0
mov eax, ebx
cmp ebx, 0x800
jae 0x14010538e
shr eax, 6
or al, 0xc0
mov byte [rbp + 0xb0], al
and bl, 0x3f
or bl, 0x80
mov byte [rbp + 0xb1], bl
mov ebx, 2
mov rax, qword [rbp + 0xe0]
sub rax, rdi
cmp rax, rbx
jb 0x14010541b
jmp 0x140105434
mov rax, qword [rbp + 0xe0]
sub rax, rdi
cmp rax, 1
ja 0x14010532c
mov r8d, 2
lea rcx, [rbp + 0xd8]
mov rdx, rdi
call fcn.140259880
mov rdi, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xd8]
mov word [rax + rdi], 0x5c5c
add rdi, 2
jmp 0x1401051f5
add r12, 3
shl eax, 0xc
or ebx, eax
cmp ebx, 0x22
jne 0x140105290
nop word cs:[rax + rax]
mov rax, qword [rbp + 0xe0]
sub rax, rdi
cmp rax, 1
ja 0x1401051e4
mov r8d, 2
lea rcx, [rbp + 0xd8]
mov rdx, rdi
call fcn.140259880
jmp 0x1401051dd
cmp ebx, 0x10000
jae 0x1401053d2
shr eax, 0xc
or al, 0xe0
mov byte [rbp + 0xb0], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rbp + 0xb1], al
and bl, 0x3f
or bl, 0x80
mov byte [rbp + 0xb2], bl
mov ebx, 3
mov rax, qword [rbp + 0xe0]
sub rax, rdi
cmp rax, rbx
jb 0x14010541b
jmp 0x140105434
shr eax, 0x12
or al, 0xf0
mov byte [rbp + 0xb0], al
mov eax, ebx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [rbp + 0xb1], al
mov eax, ebx
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rbp + 0xb2], al
and bl, 0x3f
or bl, 0x80
mov byte [rbp + 0xb3], bl
mov ebx, 4
mov rax, qword [rbp + 0xe0]
sub rax, rdi
cmp rax, rbx
jae 0x140105434
lea rcx, [rbp + 0xd8]
mov rdx, rdi
mov r8, rbx
call fcn.140259880
mov rdi, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xd8]
add rcx, rdi
lea rdx, [rbp + 0xb0]
mov r8, rbx
call fcn.140258830
add rdi, rbx
jmp 0x1401051f5
cmp rdi, qword [rbp + 0xe0]
jne 0x1401051c7
lea rcx, [rbp + 0xd8]
mov rdx, rdi
call fcn.140076a80
jmp 0x1401051c0
cmp rdi, qword [rbp + 0xe0]
jne 0x1401054af
lea rcx, [rbp + 0xd8]
mov rdx, rdi
call fcn.140076a80
mov rdi, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xd8]
mov byte [rax + rdi], 0x22
mov rdi, qword [rbp + 0xe8]
inc rdi
mov qword [rbp + 0xe8], rdi
test rsi, rsi
jne 0x140105580
jmp 0x140105020
mov rax, qword [rbp + 0xe0]
sub rax, rdi
cmp rax, 1
ja 0x14010550c
mov r8d, 2
lea rcx, [rbp + 0xd8]
mov rdx, rdi
call fcn.140259880
mov rdi, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xd8]
mov word [rax + rdi], 0x2222
add rdi, 2
mov qword [rbp + 0xe8], rdi
test rsi, rsi
jne 0x140105580
jmp 0x140105020
mov rax, qword [rbp + 0xe0]
sub rax, rdi
cmp rax, rbx
jae 0x140105556
lea rcx, [rbp + 0xd8]
mov rdx, rdi
mov r8, rbx
call fcn.140259880
mov rdi, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xd8]
add rcx, rdi
mov rdx, r12
mov r8, rbx
call fcn.140258830
add rdi, rbx
mov qword [rbp + 0xe8], rdi
test rsi, rsi
je 0x140105020
nop
test r13, r13
je 0x140105020
mov r8d, 1
mov rcx, rsi
mov rdx, r13
call fcn.1401047d0
jmp 0x140105020
mov rcx, qword [rbp + 0xa8]
mov rax, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x28]
add rcx, rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rcx
mov word [rbp - 0x28], 0
mov dword [rbp - 0x20], 1
lea rcx, [rbp + 0x70]
lea rdx, [rbp - 0x38]
call fcn.140104ba0
mov rax, qword [rbp + 0xd8]
mov rcx, qword [rbp + 0xe8]
add rcx, rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rcx
mov word [rbp - 0x48], 0
mov dword [rbp - 0x40], 1
lea rcx, [rbp - 0x18]
lea rdx, [rbp - 0x58]
call fcn.140104ba0
mov rsi, qword [rbp + 0x70]
mov rax, qword [rbp - 0x18]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0xa8]
mov bl, byte [rax + 0x39]
mov dword [rbp + 0xcc], 0
xorps xmm0, xmm0
movaps xmmword [rbp + 0x60], xmm0
movaps xmmword [rbp + 0x50], xmm0
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
lea rax, str.runas
mov qword [rbp + 0xb0], rax
lea rax, [0x14061ac5a]
mov qword [rbp + 0xb8], rax
mov word [rbp + 0xc0], 0
lea rcx, [rbp + 0x88]
lea rdx, [rbp + 0xb0]
call fcn.140104810
mov r15, qword [rbp + 0xa0]
xor ecx, ecx
mov edx, 6
call qword [sym.imp.ole32.dll_CoInitializeEx]
xor eax, eax
test bl, bl
sete al
movabs rcx, 0x14000000070
mov qword [rbp], rcx
mov rdi, qword [rbp + 0x88]
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], rsi
mov rcx, qword [rbp + 0xd0]
mov qword [rbp + 0x20], rcx
mov dword [rbp + 0x30], eax
mov rcx, rbp
call qword [sym.imp.shell32.dll_ShellExecuteExW]
test eax, eax
je 0x14010572a
mov rcx, qword [rbp + 0x68]
test rcx, rcx
je 0x14010572a
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x68]
lea rdx, [rbp + 0xcc]
call qword [sym.imp.kernel32.dll_GetExitCodeProcess]
mov ebx, eax
mov r14d, dword [rbp + 0xcc]
mov rdx, qword [rbp + 0x90]
test rdx, rdx
je 0x14010571e
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.1401047d0
xor eax, eax
cmp ebx, 1
sbb eax, eax
or eax, r14d
jmp 0x14010574c
mov rdx, qword [rbp + 0x90]
test rdx, rdx
je 0x140105747
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.1401047d0
mov eax, 0xffffffff
mov dword [r15 + 4], eax
mov dword [r15], 0
mov rdx, qword [rbp - 0x10]
test rdx, rdx
je 0x140105775
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0xd0]
call fcn.1401047d0
mov rdx, qword [rbp + 0x78]
test rdx, rdx
je 0x14010578f
add rdx, rdx
mov r8d, 2
mov rcx, rsi
call fcn.1401047d0
mov rdx, qword [rbp + 0xe0]
test rdx, rdx
je 0x1401057ad
mov rcx, qword [rbp + 0xd8]
mov r8d, 1
call fcn.1401047d0
mov rax, r15
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret