Function at 0x1400a55a0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov rsi, rcx
xor r13d, r13d
mov r14, r13
mov qword [rsp + 0x70], r13
mov byte [rax + 8], r13b
mov byte [rax + 9], r13b
mov byte [rax + 0xa], r13b
mov dword [rsp + 0x178], r13d
mov eax, r13d
test rcx, rcx
setne al
test eax, eax
jne 0x1400a560a
call fcn.14009f140
mov dword [rax], reloc.WS2_32.dll_shutdown
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14009cfa0
xor eax, eax
jmp 0x1400a5d43
mov eax, r13d
test rdx, rdx
setne al
test eax, eax
jne 0x1400a563d
call fcn.14009f140
mov dword [rax], reloc.WS2_32.dll_shutdown
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14009cfa0
xor eax, eax
jmp 0x1400a5d43
cmp byte [rdx], 0x20
jne 0x1400a564b
add rdx, 1
cmp byte [rdx], 0x20
je 0x1400a5642
movzx eax, byte [rdx]
cmp al, 0x77
je 0x1400a567c
cmp al, 0x72
je 0x1400a567c
call fcn.14009f140
mov dword [rax], reloc.WS2_32.dll_shutdown
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14009cfa0
xor eax, eax
jmp 0x1400a5d43
mov byte [rsp + 0x160], al
add rdx, 1
cmp byte [rdx], 0x20
jne 0x1400a5699
nop
add rdx, 1
cmp byte [rdx], 0x20
je 0x1400a5690
movzx eax, byte [rdx]
test al, al
je 0x1400a56ce
cmp al, 0x74
je 0x1400a56ce
cmp al, 0x62
je 0x1400a56ce
call fcn.14009f140
mov dword [rax], reloc.WS2_32.dll_shutdown
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14009cfa0
xor eax, eax
jmp 0x1400a5d43
mov byte [rsp + 0x161], al
cmp al, 0x74
jne 0x1400a56e1
mov r8d, 0x4000
jmp 0x1400a56ef
mov r8d, r13d
mov ecx, 0x8000
cmp al, 0x62
cmove r8d, ecx
bts r8d, 7
mov edx, 0x400
lea rcx, [rsp + 0x58]
call fcn.1400ba570
cmp eax, 0xffffffff
je 0x1400a5d40
cmp byte [rsp + 0x160], 0x77
jne 0x1400a5731
mov ebx, r13d
mov r12d, r13d
mov dword [rsp + 0x170], r13d
mov r15d, 1
mov dword [rsp + 0x68], r15d
jmp 0x1400a5748
mov ebx, 1
mov r12d, ebx
mov dword [rsp + 0x170], ebx
mov r15d, r13d
mov dword [rsp + 0x68], r13d
mov ecx, 9
call fcn.1400b0a50
test eax, eax
jne 0x1400a576f
mov ecx, dword [rsp + 0x58]
call fcn.1400afd50
mov ecx, dword [rsp + 0x5c]
call fcn.1400afd50
xor eax, eax
jmp 0x1400a5d43
mov ecx, 9
call fcn.1400b0b60
nop
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x60], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
movsxd rdi, r12d
movsxd rcx, dword [rsp + rdi*4 + 0x58]
mov rdx, rcx
sar rdx, 5
lea r8, [0x14013c360]
and ecx, 0x1f
lea rcx, [rcx + rcx*4]
add rcx, rcx
mov rdx, qword [r8 + rdx*8]
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r13d
lea r9, [rsp + 0x80]
mov r8, rax
mov rdx, qword [rdx + rcx*8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1400a5d0f
mov ecx, dword [rsp + rdi*4 + 0x58]
call fcn.1400afd50
mov dword [rsp + rdi*4 + 0x60], r13d
movsxd rax, r15d
lea rdx, [rsp + 0x160]
mov ecx, dword [rsp + rax*4 + 0x58]
call fcn.1400ba240
mov r14, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x1400a5d0f
xor ecx, ecx
call fcn.1400a5500
mov r15, rax
test rax, rax
je 0x1400a5cf2
lea r8, str.COMSPEC
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.1400a7b20
mov edi, eax
test eax, eax
je 0x1400a5864
cmp eax, 0x16
jne 0x1400a5864
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14009cf00
test edi, edi
jne 0x1400a5872
mov r12, qword [rsp + 0x70]
test r12, r12
jne 0x1400a5899
mov dword [rsp + 0x50], r13d
lea rcx, [rsp + 0x50]
call fcn.14009f670
lea rax, str.command.com
lea r12, str.cmd.exe
bt dword [rsp + 0x50], 0xf
cmovb r12, rax
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0xb0]
call fcn.1400a0a70
mov dword [rsp + 0xb0], 0x68
mov dword [rsp + 0xec], 0x100
test ebx, ebx
jne 0x1400a58da
mov rax, qword [rsp + 0x80]
mov rdx, rax
mov rcx, qword [0x14013c360]
jmp 0x1400a58ec
mov rcx, qword [0x14013c360]
mov rdx, qword [rcx]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x100], rdx
cmp ebx, 1
je 0x1400a58fd
mov rax, qword [rcx + 0x50]
mov qword [rsp + 0x108], rax
mov rax, qword [rcx + 0xa0]
mov qword [rsp + 0x110], rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea rdi, [rdx + rcx + 4]
lea edx, [rax + 1]
mov rcx, rdi
call fcn.1400ac420
mov r13, rax
test rax, rax
je 0x1400a5ce7
mov r8, r12
mov rdx, rdi
mov rcx, rax
call fcn.1400a0d40
test eax, eax
je 0x1400a5978
xor ebx, ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14009cf00
jmp 0x1400a597a
xor ebx, ebx
lea r8, str.__c
mov rdx, rdi
mov rcx, r13
call fcn.1400a0c80
test eax, eax
je 0x1400a59a4
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14009cf00
mov r8, rsi
mov rdx, rdi
mov rcx, r13
call fcn.1400a0c80
test eax, eax
je 0x1400a59ca
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14009cf00
call fcn.14009f140
mov esi, dword [rax]
mov dword [rsp + 0x50], esi
xor edx, edx
mov rcx, r12
call fcn.1400ba190
test eax, eax
jne 0x1400a5a2c
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
jmp 0x1400a5c8d
mov qword [rsp + 0x78], rbx
mov edx, 1
mov ecx, 0x104
call fcn.1400ac420
mov rbx, rax
test rax, rax
jne 0x1400a5a78
xor ecx, ecx
call fcn.14009ed20
mov rcx, r13
call fcn.14009ed20
mov rcx, qword [rsp + 0x70]
call fcn.14009ed20
call fcn.14009f140
mov dword [rax], esi
mov r12d, dword [rsp + 0x170]
xor r13d, r13d
jmp 0x1400a5cf2
lea r8, str.PATH
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.1400a7b20
mov edi, eax
test eax, eax
je 0x1400a5aae
cmp eax, 0x16
jne 0x1400a5aae
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14009cf00
test edi, edi
je 0x1400a5aed
mov rcx, qword [rsp + 0x78]
call fcn.14009ed20
mov rcx, rbx
call fcn.14009ed20
mov rcx, r13
call fcn.14009ed20
mov rcx, qword [rsp + 0x70]
call fcn.14009ed20
call fcn.14009f140
mov dword [rax], esi
mov r12d, dword [rsp + 0x170]
xor r13d, r13d
jmp 0x1400a5cf2
mov rsi, qword [rsp + 0x78]
mov r8d, 0x103
mov rdx, rbx
mov rcx, rsi
call fcn.1400ba0c0
mov rsi, rax
test rax, rax
je 0x1400a5c6c
cmp byte [rbx], 0
je 0x1400a5c63
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx + rbx - 2]
movzx eax, byte [rdi]
cmp al, 0x5c
jne 0x1400a5b76
mov edx, 0x5c
mov rcx, rbx
call fcn.1400ba0b0
cmp rdi, rax
je 0x1400a5baa
lea r8, [0x1400f72f8]
mov edx, 0x104
mov rcx, rbx
call fcn.1400a0c80
test eax, eax
je 0x1400a5baa
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14009cf00
jmp 0x1400a5baa
cmp al, 0x2f
je 0x1400a5baa
lea r8, [0x1400f72f8]
mov edx, 0x104
mov rcx, rbx
call fcn.1400a0c80
test eax, eax
je 0x1400a5baa
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14009cf00
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r12
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
add rdx, rcx
cmp rdx, 0x104
jae 0x1400a5c75
mov r8, r12
mov edx, 0x104
mov rcx, rbx
call fcn.1400a0c80
test eax, eax
je 0x1400a5c08
xor edi, edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14009cf00
jmp 0x1400a5c0a
xor edi, edi
xor edx, edx
mov rcx, rbx
call fcn.1400ba190
test eax, eax
jne 0x1400a5c5e
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
jmp 0x1400a5c77
jmp 0x1400a5af2
mov edi, dword [rsp + 0x178]
jmp 0x1400a5c77
mov edi, dword [rsp + 0x178]
jmp 0x1400a5c77
mov edi, eax
mov rcx, qword [rsp + 0x78]
call fcn.14009ed20
mov rcx, rbx
call fcn.14009ed20
mov esi, dword [rsp + 0x50]
mov rcx, r13
call fcn.14009ed20
mov rcx, qword [rsp + 0x70]
call fcn.14009ed20
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14009f140
mov dword [rax], esi
test edi, edi
je 0x1400a5cd7
mov rax, qword [rsp + 0x90]
mov qword [r15 + 8], rax
mov qword [r15], r14
jmp 0x1400a5d36
xor r13d, r13d
mov qword [r15], r13
mov r12d, dword [rsp + 0x170]
jmp 0x1400a5cf2
mov r12d, dword [rsp + 0x170]
xor r13d, r13d
mov rcx, r14
call fcn.14009ee10
movsxd r15, dword [rsp + 0x68]
mov dword [rsp + r15*4 + 0x60], r13d
mov r14, r13
mov qword [rsp + 0x88], r13
movsxd rax, r12d
cmp dword [rsp + rax*4 + 0x60], 0
je 0x1400a5d22
mov ecx, dword [rsp + rax*4 + 0x58]
call fcn.1400afd50
movsxd rax, r15d
cmp dword [rsp + rax*4 + 0x60], 0
je 0x1400a5d36
mov ecx, dword [rsp + rax*4 + 0x58]
call fcn.1400afd50
nop
mov ecx, 9
call fcn.1400b0a30
mov rax, r14
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret