Function at 0x14004b550
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x30]
sub rsp, 0x130
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
lea r8d, [r14 + 0xb]
lea rdx, str.zzmapss.sys
lea rcx, [rsp + 0x50]
call fcn.140060760
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.14004af90
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
lea r8d, [r14 + 0xb]
lea rdx, str.zzmapss.exe
lea rcx, [rsp + 0x70]
call fcn.140060760
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x10]
call fcn.14004af90
nop
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rdx, qword [rbp - 0x70]
mov rax, qword [rbp - 0x60]
lea rsi, [rdx + rax*2]
lea rdi, [rbp - 0x70]
cmova rdi, qword [rbp - 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
cmp rdi, rsi
jne 0x14004b61f
mov edi, r14d
mov qword [rsp + 0x40], r14
mov eax, 0xf
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x30], dil
jmp 0x14004b731
mov rax, rsi
sub rax, rdi
sar rax, 1
mov rdx, r14
mov qword [rsp + 0x40], rdx
mov ebx, 0xf
mov qword [rsp + 0x48], rbx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x14004bb23
cmp rax, rbx
jbe 0x14004b6e0
mov rbx, rax
or rbx, 0xf
cmp rbx, rcx
jbe 0x14004b69a
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140069a2c
mov rcx, rax
test rax, rax
je 0x14004ba51
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rsp + 0x40]
jmp 0x14004b6d6
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14004b6c2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004bb1d
jmp 0x14004b673
test rcx, rcx
je 0x14004b6d3
call fcn.140069a2c
mov rdx, qword [rsp + 0x40]
jmp 0x14004b6d6
mov rax, r14
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
cmp rbx, 0xf
cmova rcx, qword [rsp + 0x30]
movzx eax, byte [rdi]
mov byte [rdx + rcx], al
mov rdx, qword [rsp + 0x40]
inc rdx
mov qword [rsp + 0x40], rdx
add rdi, 2
cmp rdi, rsi
je 0x14004b712
mov rbx, qword [rsp + 0x48]
jmp 0x14004b6e0
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rax, qword [rsp + 0x30]
mov byte [rax + rdx], 0
mov rax, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
lea rbx, [rsp + 0x30]
cmp rax, 0xf
cmova rbx, qword [rsp + 0x30]
call fcn.14006a9c8
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rdi
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.140049f70
nop
lea rcx, [rbp - 0x30]
call fcn.14004ad70
nop
lea r8, [rsp + 0x50]
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.14004a470
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14004b7c0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b7bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b7bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400698fc
movdqa xmm0, xmmword [0x1400dd7a0]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r14w
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14004b817
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b812
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b812
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400698fc
movdqa xmm0, xmmword [0x1400dd7a0]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r14w
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call fcn.14006ab98
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x14004bb0f
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x70]
call fcn.14005d960
mov rcx, rax
call fcn.14004b1d0
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x70]
call fcn.14005d960
mov rcx, rax
call fcn.14004b390
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x10]
call fcn.14005d960
nop
lea rax, [rbp - 0x30]
mov qword [rbp + 0x50], rax
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x30]
call fcn.14005d960
mov rdi, rax
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x50]
call fcn.14005d960
mov rbx, rax
mov r9, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14004b8bd
mov r9, qword [rdi]
mov r8, rbx
cmp qword [rax + 0x18], 7
jbe 0x14004b8ca
mov r8, qword [rax]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x14004b922
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14004b91d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004b9bb
mov rcx, r8
call fcn.1400698fc
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x14004b96d
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14004b968
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004b9bb
mov rcx, r8
call fcn.1400698fc
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 7
mov word [rdi], r14w
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x14004b9c8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b9c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b9c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400698fc
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14004ba0b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ba06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004ba06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400698fc
movdqa xmm0, xmmword [0x1400dd7a0]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r14w
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14004ba5d
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ba58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004ba58
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400698fc
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x14004bab4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004baae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004baae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400698fc
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x14004baf7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004baf2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004baf2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400698fc
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
shr rdx, 0x20
lea r8, [rbp - 0x50]
call fcn.14004aca0
nop
call fcn.140008980
int3
call fcn.140049810
int3