Function at 0x140007cf0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rsi
sub rsp, 0xb0
cmp qword [rcx + 0x18], 0xf
jbe 0x140007d0f
mov rax, qword [rcx]
mov qword [rsp + 0xc0], rax
lea rdx, [rsp + 0x54]
mov byte [rsp + 0xc8], 0
lea rcx, [rsp + 0xc8]
call fcn.140002900
mov rsi, rax
cmp byte [rax], 0
jne 0x1400088a3
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x88], r13
mov dword [rsp + 0xd0], 0
mov ecx, dword [rsp + 0xd0]
mov qword [rsp + 0x78], r15
movaps xmmword [rsp + 0x60], xmm6
call fcn.140003be0
movsx r9d, al
call fcn.140003bd0
movsx ecx, al
imul r9d, ecx
call fcn.140003c10
movsx r10d, al
lea eax, [r9 + r9*2]
lea eax, [r10 + rax*2]
mov dword [rsp + 0x50], eax
call fcn.140003bf0
movsx r11d, al
call fcn.140003c20
movsx ebx, al
call fcn.140003c00
movsd xmm5, qword [0x14001a9e0]
movsd xmm6, qword [0x14001a9d8]
movsd xmm3, qword [0x14001a9d0]
movsd xmm4, qword [0x14001a9c8]
mov r15d, dword [rsp + 0xc0]
mov r12d, dword [rsp + 0xc0]
mov r13d, dword [rsp + 0xc0]
mov qword [rsp + 0xa0], rbp
movsx edi, al
mov qword [rsp + 0x80], r14
nop dword [rax]
movsx ecx, byte [0x1400233d8]
imul ecx, r11d
lea edx, [rcx + rcx*4]
movsx ecx, byte [0x140023009]
add edx, edx
sub edx, ebx
add edx, edi
add ecx, edx
je 0x140008005
movsx eax, byte [0x14002300a]
lea r14d, [r9 + r9*2]
xor edx, edx
lea ebp, [r14 + r10]
movd xmm1, eax
movsx eax, byte [0x140023009]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm5
movsd qword [rsp + 0x30], xmm1
movsx eax, byte [0x14002300c]
movsx ecx, byte [0x14002300b]
add eax, ebp
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x140007ea3
movsx edx, byte [0x1400233d8]
movsx ecx, byte [0x140023009]
imul edx, r11d
add edx, edx
sub edx, ebx
add edx, edi
add ecx, edx
je 0x140007ea3
mov dword [rsp + 0xd8], 7
jmp 0x140007f00
movsx eax, byte [0x14002300c]
lea ecx, [r9 + r10]
lea ecx, [rcx + r9*8]
xor edx, edx
add eax, ecx
movsx ecx, byte [0x14002300b]
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x140007f00
movsx eax, byte [0x14002300c]
xor edx, edx
movsx ecx, byte [0x14002300b]
add eax, ebp
div ecx
movsx ecx, byte [0x140023008]
xorps xmm0, xmm0
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x30]
cvttsd2si eax, xmm0
mov dword [rsp + 0xd8], eax
movsx eax, byte [0x14002300a]
xor edx, edx
movd xmm1, eax
movsx eax, byte [0x140023009]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm5
movsd qword [rsp + 0x30], xmm1
movsx eax, byte [0x14002300c]
movsx ecx, byte [0x14002300b]
add eax, ebp
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x140007f73
movsx edx, byte [0x1400233d8]
movsx ecx, byte [0x140023009]
imul edx, r11d
add edx, edx
sub edx, ebx
add edx, edi
add ecx, edx
je 0x140007f73
mov r15d, 7
jmp 0x140007fce
movsx eax, byte [0x14002300c]
lea ecx, [r9 + r10]
lea ecx, [rcx + r9*8]
xor edx, edx
add eax, ecx
movsx ecx, byte [0x14002300b]
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x140007fce
movsx eax, byte [0x14002300c]
xor edx, edx
movsx ecx, byte [0x14002300b]
add eax, r10d
add eax, r14d
xorps xmm0, xmm0
div ecx
movsx ecx, byte [0x140023008]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x30]
cvttsd2si r15d, xmm0
movsxd rax, dword [rsp + 0xd0]
movzx r8d, byte [rax + rsi + 1]
movsxd rax, dword [rsp + 0xd0]
and r8b, r15b
add r8b, r8b
movzx edx, byte [rax + rsi + 1]
movsxd rax, dword [rsp + 0xd0]
sub dl, r8b
add dl, byte [rsp + 0xd8]
mov byte [rax + rsi + 1], dl
movsx eax, byte [0x14002300c]
xor edx, edx
add eax, dword [rsp + 0x50]
movsx ecx, byte [0x14002300b]
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x14000864b
movsx ecx, byte [0x1400233d8]
imul ecx, r11d
lea edx, [rcx + rcx*4]
movsx ecx, byte [0x140023009]
sub edx, ebx
add edx, edi
add ecx, edx
je 0x140008224
movsx eax, byte [0x14002300a]
lea r14d, [r9 + r9*2]
xor edx, edx
lea ebp, [r14 + r10]
movd xmm1, eax
movsx eax, byte [0x140023009]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm6
movsd qword [rsp + 0x30], xmm1
movsx eax, byte [0x14002300c]
movsx ecx, byte [0x14002300b]
add eax, ebp
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x1400080c8
movsx edx, byte [0x1400233d8]
movsx ecx, byte [0x140023009]
imul edx, r11d
add edx, edx
sub edx, ebx
add edx, edi
add ecx, edx
je 0x1400080c8
mov dword [rsp + 0x38], 7
jmp 0x140008122
movsx eax, byte [0x14002300c]
lea ecx, [r9 + r10]
lea ecx, [rcx + r9*8]
xor edx, edx
add eax, ecx
movsx ecx, byte [0x14002300b]
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x140008122
movsx eax, byte [0x14002300c]
xor edx, edx
movsx ecx, byte [0x14002300b]
add eax, ebp
div ecx
movsx ecx, byte [0x140023008]
xorps xmm0, xmm0
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x30]
cvttsd2si eax, xmm0
mov dword [rsp + 0x38], eax
movsx eax, byte [0x14002300a]
xor edx, edx
movd xmm1, eax
movsx eax, byte [0x140023009]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm6
movsd qword [rsp + 0x30], xmm1
movsx eax, byte [0x14002300c]
movsx ecx, byte [0x14002300b]
add eax, ebp
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x140008195
movsx edx, byte [0x1400233d8]
movsx ecx, byte [0x140023009]
imul edx, r11d
add edx, edx
sub edx, ebx
add edx, edi
add ecx, edx
je 0x140008195
mov r12d, 7
jmp 0x1400081f0
movsx eax, byte [0x14002300c]
lea ecx, [r9 + r10]
lea ecx, [rcx + r9*8]
xor edx, edx
add eax, ecx
movsx ecx, byte [0x14002300b]
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x1400081f0
movsx eax, byte [0x14002300c]
xor edx, edx
movsx ecx, byte [0x14002300b]
add eax, r10d
add eax, r14d
xorps xmm0, xmm0
div ecx
movsx ecx, byte [0x140023008]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x30]
cvttsd2si r12d, xmm0
movsxd rax, dword [rsp + 0xd0]
movzx r8d, byte [rax + rsi + 1]
movsxd rax, dword [rsp + 0xd0]
and r8b, r12b
add r8b, r8b
movzx edx, byte [rax + rsi + 1]
movsxd rax, dword [rsp + 0xd0]
sub dl, r8b
add dl, byte [rsp + 0x38]
mov byte [rax + rsi + 1], dl
movsx ecx, byte [0x1400233d8]
imul ecx, r11d
lea edx, [rcx + rcx*4]
movsx ecx, byte [0x140023009]
add edx, edx
sub edx, ebx
add edx, edi
add ecx, edx
je 0x140008420
movsx eax, byte [0x14002300a]
lea r14d, [r9 + r9*2]
xor edx, edx
lea ebp, [r14 + r10]
movd xmm1, eax
movsx eax, byte [0x140023009]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm3
movsd qword [rsp + 0x30], xmm1
movsx eax, byte [0x14002300c]
movsx ecx, byte [0x14002300b]
add eax, ebp
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x1400082c4
movsx edx, byte [0x1400233d8]
movsx ecx, byte [0x140023009]
imul edx, r11d
add edx, edx
sub edx, ebx
add edx, edi
add ecx, edx
je 0x1400082c4
mov dword [rsp + 0x3c], 7
jmp 0x14000831e
movsx eax, byte [0x14002300c]
lea ecx, [r9 + r10]
lea ecx, [rcx + r9*8]
xor edx, edx
add eax, ecx
movsx ecx, byte [0x14002300b]
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x14000831e
movsx eax, byte [0x14002300c]
xor edx, edx
movsx ecx, byte [0x14002300b]
add eax, ebp
div ecx
movsx ecx, byte [0x140023008]
xorps xmm0, xmm0
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x30]
cvttsd2si eax, xmm0
mov dword [rsp + 0x3c], eax
movsx eax, byte [0x14002300a]
xor edx, edx
movd xmm1, eax
movsx eax, byte [0x140023009]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm3
movsd qword [rsp + 0x30], xmm1
movsx eax, byte [0x14002300c]
movsx ecx, byte [0x14002300b]
add eax, ebp
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x140008391
movsx edx, byte [0x1400233d8]
movsx ecx, byte [0x140023009]
imul edx, r11d
add edx, edx
sub edx, ebx
add edx, edi
add ecx, edx
je 0x140008391
mov r13d, 7
jmp 0x1400083ec
movsx eax, byte [0x14002300c]
lea ecx, [r9 + r10]
lea ecx, [rcx + r9*8]
xor edx, edx
add eax, ecx
movsx ecx, byte [0x14002300b]
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x1400083ec
movsx eax, byte [0x14002300c]
xor edx, edx
movsx ecx, byte [0x14002300b]
add eax, r14d
add eax, r10d
xorps xmm0, xmm0
div ecx
movsx ecx, byte [0x140023008]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x30]
cvttsd2si r13d, xmm0
movsxd rax, dword [rsp + 0xd0]
movzx r8d, byte [rax + rsi + 1]
movsxd rax, dword [rsp + 0xd0]
and r8b, r13b
add r8b, r8b
movzx edx, byte [rax + rsi + 1]
movsxd rax, dword [rsp + 0xd0]
sub dl, r8b
add dl, byte [rsp + 0x3c]
mov byte [rax + rsi + 1], dl
movsx eax, byte [0x14002300c]
xor edx, edx
movsx ecx, byte [0x14002300b]
add eax, r9d
add eax, r10d
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x14000864b
mov eax, dword [rsp + 0xd0]
lea r14d, [r9 + r9*2]
sub eax, 0xb
lea ebp, [r14 + r10]
xor edx, edx
movd xmm2, eax
movsx eax, byte [0x14002300a]
cvtdq2pd xmm2, xmm2
movd xmm1, eax
movsx eax, byte [0x140023009]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x30], xmm1
movsx eax, byte [0x14002300c]
movsx ecx, byte [0x14002300b]
add eax, ebp
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x1400084d6
movsx edx, byte [0x1400233d8]
movsx ecx, byte [0x140023009]
imul edx, r11d
add edx, edx
sub edx, ebx
add edx, edi
add ecx, edx
je 0x1400084d6
mov dword [rsp + 0x44], 7
jmp 0x140008530
movsx eax, byte [0x14002300c]
lea ecx, [r9 + r10]
lea ecx, [rcx + r9*8]
xor edx, edx
add eax, ecx
movsx ecx, byte [0x14002300b]
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x140008530
movsx eax, byte [0x14002300c]
xor edx, edx
movsx ecx, byte [0x14002300b]
add eax, ebp
div ecx
movsx ecx, byte [0x140023008]
xorps xmm0, xmm0
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x30]
cvttsd2si eax, xmm0
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0xd0]
xor edx, edx
sub eax, 0xb
movd xmm2, eax
movsx eax, byte [0x14002300a]
cvtdq2pd xmm2, xmm2
movd xmm1, eax
movsx eax, byte [0x140023009]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x30], xmm1
movsx eax, byte [0x14002300c]
movsx ecx, byte [0x14002300b]
add eax, ebp
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x1400085b7
movsx edx, byte [0x1400233d8]
movsx ecx, byte [0x140023009]
imul edx, r11d
add edx, edx
sub edx, ebx
add edx, edi
add ecx, edx
je 0x1400085b7
mov dword [rsp + 0x40], 7
jmp 0x140008615
movsx eax, byte [0x14002300c]
lea ecx, [r9 + r10]
lea ecx, [rcx + r9*8]
xor edx, edx
add eax, ecx
movsx ecx, byte [0x14002300b]
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x140008615
movsx eax, byte [0x14002300c]
xor edx, edx
movsx ecx, byte [0x14002300b]
add eax, r14d
add eax, r10d
xorps xmm0, xmm0
div ecx
movsx ecx, byte [0x140023008]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x30]
cvttsd2si eax, xmm0
mov dword [rsp + 0x40], eax
movsxd rax, dword [rsp + 0xd0]
movzx r8d, byte [rax + rsi + 1]
movsxd rax, dword [rsp + 0xd0]
and r8b, byte [rsp + 0x40]
add r8b, r8b
movzx edx, byte [rax + rsi + 1]
movsxd rax, dword [rsp + 0xd0]
sub dl, r8b
add dl, byte [rsp + 0x44]
mov byte [rax + rsi + 1], dl
movsx edx, byte [0x1400233d8]
movsx ecx, byte [0x140023009]
imul edx, r11d
sub edx, ebx
add edx, edi
add ecx, edx
je 0x140008849
movsx eax, byte [0x14002300a]
lea r14d, [r9 + r9*2]
xor edx, edx
lea ebp, [r14 + r10]
movd xmm1, eax
movsx eax, byte [0x140023009]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm4
movsd qword [rsp + 0x30], xmm1
movsx eax, byte [0x14002300c]
movsx ecx, byte [0x14002300b]
add eax, ebp
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x1400086e6
movsx edx, byte [0x1400233d8]
movsx ecx, byte [0x140023009]
imul edx, r11d
add edx, edx
sub edx, ebx
add edx, edi
add ecx, edx
je 0x1400086e6
mov dword [rsp + 0x4c], 7
jmp 0x140008740
movsx eax, byte [0x14002300c]
lea ecx, [r9 + r10]
lea ecx, [rcx + r9*8]
xor edx, edx
add eax, ecx
movsx ecx, byte [0x14002300b]
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x140008740
movsx eax, byte [0x14002300c]
xor edx, edx
movsx ecx, byte [0x14002300b]
add eax, ebp
div ecx
movsx ecx, byte [0x140023008]
xorps xmm0, xmm0
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x30]
cvttsd2si eax, xmm0
mov dword [rsp + 0x4c], eax
movsx eax, byte [0x14002300a]
xor edx, edx
movd xmm1, eax
movsx eax, byte [0x140023009]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm4
movsd qword [rsp + 0x30], xmm1
movsx eax, byte [0x14002300c]
movsx ecx, byte [0x14002300b]
add eax, ebp
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x1400087b5
movsx edx, byte [0x1400233d8]
movsx ecx, byte [0x140023009]
imul edx, r11d
add edx, edx
sub edx, ebx
add edx, edi
add ecx, edx
je 0x1400087b5
mov dword [rsp + 0x48], 7
jmp 0x140008813
movsx eax, byte [0x14002300c]
lea ecx, [r9 + r10]
lea ecx, [rcx + r9*8]
xor edx, edx
add eax, ecx
movsx ecx, byte [0x14002300b]
div ecx
movsx ecx, byte [0x140023008]
cmp eax, ecx
je 0x140008813
movsx eax, byte [0x14002300c]
xor edx, edx
movsx ecx, byte [0x14002300b]
add eax, r14d
add eax, r10d
xorps xmm0, xmm0
div ecx
movsx ecx, byte [0x140023008]
sub eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x30]
cvttsd2si eax, xmm0
mov dword [rsp + 0x48], eax
movsxd rax, dword [rsp + 0xd0]
movzx r8d, byte [rax + rsi + 1]
movsxd rax, dword [rsp + 0xd0]
and r8b, byte [rsp + 0x48]
add r8b, r8b
movzx edx, byte [rax + rsi + 1]
movsxd rax, dword [rsp + 0xd0]
sub dl, r8b
add dl, byte [rsp + 0x4c]
mov byte [rax + rsi + 1], dl
mov eax, dword [rsp + 0xd0]
inc eax
mov dword [rsp + 0xd0], eax
mov eax, dword [rsp + 0xd0]
cmp eax, 5
jb 0x140007e00
movaps xmm6, xmmword [rsp + 0x60]
mov r15, qword [rsp + 0x78]
mov r14, qword [rsp + 0x80]
mov r13, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xc0]
lea rdx, [rsi + 1]
mov dword [rsp + 0x28], 1
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], 0
mov byte [rsi], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
add rsp, 0xb0
pop rsi
ret