Function at 0x14024e570
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov rcx, rdx
mov eax, dword [0x140b7e500]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x140b7e504], 0xa
setl dl
or dl, al
mov r8d, 0xdd9f01f7
mov eax, 0x8b57080c
cmove r8d, eax
mov edi, 0xaa1144be
cmove edi, eax
mov eax, 0xbef578ca
nop word [rax + rax]
cmp eax, 0x1c8d9815
je 0x14024e659
cmp eax, 0xbef578ca
jne 0x14024e5d0
mov edx, 0x44ea7b68
nop word [rax + rax]
cmp edx, 0xdb74a5a3
jle 0x14024e620
cmp edx, 0xdb74a5a4
je 0x14024e643
cmp edx, 0xdd9f01f7
je 0x14024e635
cmp edx, 0x44ea7b68
jne 0x14024e5f0
mov edx, edi
jmp 0x14024e5f0
cmp edx, 0x8b57080c
je 0x14024e63c
cmp edx, 0xaa1144be
jne 0x14024e5f0
mov edx, r8d
jmp 0x14024e5f0
mov edx, 0xdb74a5a4
jmp 0x14024e5f0
mov edx, 0xaa1144be
jmp 0x14024e5f0
mov qword [rbp - 0x58], 3
mov rdx, qword [rbp - 0x58]
mov eax, 0x1c8d9815
jmp 0x14024e5d0
mov qword [rbp + 0x20], rdx
mov r9, qword [rbp + 0x20]
lea r8, [0x140720c9b]
xor edx, edx
mov qword [rbp + 0x18], rcx
call fcn.140292ed0
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 0x28], xmm0
movabs rax, 0x4000000070
mov qword [rbp - 0x58], rax
movups xmmword [rbp - 0x50], xmm0
lea rax, str.cmd.exe
mov qword [rbp - 0x40], rax
mov rdi, qword [rbp + 0x18]
mov qword [rbp + 0x20], rdi
mov ecx, 0xf2cb6207
cmp ecx, 0xa24fa62d
je 0x14024e6d0
cmp ecx, 0xf2cb6207
jne 0x14024e6b0
mov rcx, qword [rbp + 0x20]
call fcn.14028f8b0
mov ecx, 0xa24fa62d
jmp 0x14024e6b0
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 0
mov dword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
lea rcx, [rbp - 0x58]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x14024e710
mov rcx, qword [rbp + 0x10]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x10]
lea rdx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.14028e1d0
mov eax, dword [0x140b7e450]
mov r8d, dword [0x140b7e454]
lea r9d, [rax - 1]
imul r9d, eax
test r9b, 1
sete al
cmp r8d, 0xa
setl cl
or cl, al
mov r10d, 0xb2fe4bca
mov eax, 0x2981e8b8
cmove r10d, eax
mov r11d, 0x126425cd
cmove r11d, eax
mov eax, 0xf51e10ff
mov ecx, 0xada87db8
cmovne ecx, eax
mov eax, 0xb700990
mov esi, 0xfbcf50e9
nop word cs:[rax + rax]
nop
cmp eax, 0xc9a49e72
je 0x14024e8eb
cmp eax, 0xb700990
jne 0x14024e790
test r9b, 1
sete byte [rbp + 0x37]
cmp r8d, 0xa
setl byte [rbp + 0x20]
mov eax, 0xf68c5743
jmp 0x14024e7c0
mov eax, 0xfbcf50e9
nop
mov edx, eax
cmp eax, 0xfbcf50e8
jg 0x14024e810
cmp edx, 0xdc2e8cb4
jle 0x14024e840
cmp edx, 0xf51e10ff
je 0x14024e897
cmp edx, 0xf68c5743
jne 0x14024e8a1
movzx edx, byte [rbp + 0x37]
cmp byte [rbp + 0x20], 0
mov eax, 0xfbcf50e9
jne 0x14024e7fd
mov eax, 0xada87db8
test dl, dl
cmovne eax, esi
jmp 0x14024e7c0
cmp edx, 0x15ed4564
jg 0x14024e870
mov eax, ecx
cmp edx, 0xfbcf50e9
je 0x14024e7c0
mov eax, edx
cmp edx, 0x126425cd
jne 0x14024e7c0
mov eax, r10d
jmp 0x14024e7c0
cmp edx, 0xada87db8
je 0x14024e7b9
mov eax, edx
cmp edx, 0xb2fe4bca
jne 0x14024e7c0
mov eax, 0xdc2e8cb5
jmp 0x14024e7c0
mov eax, r11d
cmp edx, 0x15ed4565
je 0x14024e7c0
mov eax, edx
cmp edx, 0x2981e8b8
jne 0x14024e7c0
mov eax, 0x126425cd
jmp 0x14024e7c0
mov eax, 0x15ed4565
jmp 0x14024e7c0
mov eax, edx
cmp edx, 0xdc2e8cb5
jne 0x14024e7c0
mov qword [rbp + 0x28], rdi
mov rax, qword [rbp + 0x28]
mov edx, 0xbf4c8571
nop dword [rax]
cmp edx, 0xbf4c8571
je 0x14024e8d2
cmp edx, 0xca648eed
jne 0x14024e8c0
jmp 0x14024e8d9
mov edx, 0xca648eed
jmp 0x14024e8c0
mov qword [rbp - 0x58], rax
mov rax, qword [rbp - 0x58]
mov eax, 0xc9a49e72
jmp 0x14024e790
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret