Function at 0x14004b580
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
lea r8d, [r14 + 0xb]
lea rdx, str.zzmapss.sys
lea rcx, [rsp + 0x70]
call fcn.14005e260
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x70]
call fcn.14004afc0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
lea r8d, [r14 + 0xb]
lea rdx, str.zzmapss.exe
lea rcx, [rsp + 0x50]
call fcn.14005e260
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.14004afc0
nop
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rdx, qword [rbp - 0x70]
mov rax, qword [rbp - 0x60]
lea rsi, [rdx + rax*2]
lea rdi, [rbp - 0x70]
cmova rdi, qword [rbp - 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r14
cmp rdi, rsi
jne 0x14004b64f
mov edi, r14d
mov eax, 0xf
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x30], dil
jmp 0x14004b759
sub rsi, rdi
sar rsi, 1
mov qword [rsp + 0x48], 0xf
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x14004bb4d
mov ebx, 0xf
cmp rsi, rbx
jbe 0x14004b715
mov rbx, rsi
or rbx, 0xf
cmp rbx, rax
jbe 0x14004b6c8
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14006745c
mov rcx, rax
test rax, rax
je 0x14004ba7b
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], rbx
jmp 0x14004b71a
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14004b6f0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004bb47
jmp 0x14004b69c
test rcx, rcx
je 0x14004b706
call fcn.14006745c
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], rbx
jmp 0x14004b71a
mov rax, r14
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], rbx
jmp 0x14004b71a
mov rax, qword [rsp + 0x30]
lea r8, [rsp + 0x30]
cmp rbx, 0xf
cmova r8, rax
mov rcx, r8
mov rdx, rsi
test rsi, rsi
je 0x14004b745
movzx eax, byte [rdi]
mov byte [rcx], al
lea rcx, [rcx + 1]
lea rdi, [rdi + 2]
sub rdx, 1
jne 0x14004b732
mov qword [rsp + 0x40], rsi
mov byte [r8 + rsi], 0
mov rax, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
lea rbx, [rsp + 0x30]
cmp rax, 0xf
cmova rbx, qword [rsp + 0x30]
call fcn.1400683f8
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.140049fa0
nop
lea rcx, [rbp - 0x30]
call fcn.14004ada0
nop
lea r8, [rsp + 0x70]
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.14004a4a0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14004b7e8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b7e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b7e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006732c
movdqa xmm0, xmmword [0x1400da600]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r14w
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x14004b83e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b839
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b839
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006732c
movdqa xmm0, xmmword [0x1400da600]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], r14w
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call fcn.1400685c8
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x14004bb39
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x50]
call fcn.14005b570
mov rcx, rax
call fcn.14004b200
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x50]
call fcn.14005b570
mov rcx, rax
call fcn.14004b3c0
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x50]
call fcn.14005b570
nop
lea rax, [rbp - 0x30]
mov qword [rbp + 0x30], rax
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x30]
call fcn.14005b570
mov rdi, rax
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x70]
call fcn.14005b570
mov rbx, rax
mov r9, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14004b8e5
mov r9, qword [rdi]
mov r8, rbx
cmp qword [rax + 0x18], 7
jbe 0x14004b8f2
mov r8, qword [rax]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x14004b94a
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14004b945
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004b9e5
mov rcx, r8
call fcn.14006732c
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x14004b995
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14004b990
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004b9e5
mov rcx, r8
call fcn.14006732c
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 7
mov word [rdi], r14w
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14004b9f2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b9ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b9ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14006732c
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14004ba35
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ba30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004ba30
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006732c
movdqa xmm0, xmmword [0x1400da600]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r14w
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14004ba87
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ba82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004ba82
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006732c
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x14004bade
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bad8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004bad8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006732c
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x14004bb21
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bb1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004bb1c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006732c
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
shr rdx, 0x20
lea r8, [rbp - 0x50]
call fcn.14004acd0
nop
call fcn.140008a30
int3
call fcn.140049840
int3