Function at 0x14003b310
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
xor r15d, r15d
mov qword [rbp - 0x59], r15
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x41], 7
lea r8d, [r15 + 0xc]
lea rdx, str.msvcp140.sys
lea rcx, [rbp - 0x59]
call fcn.140046fa0
lea rdx, [rbp - 0x59]
lea rcx, [rbp + 7]
call fcn.14003ae30
nop
mov qword [rbp - 0x79], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x61], 7
lea r8d, [r15 + 0xd]
lea rdx, str.BEService.exe
lea rcx, [rbp - 0x79]
call fcn.140046fa0
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x19]
call fcn.14003ae30
nop
mov qword [rbp - 0x59], r15
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x41], r15
lea rdi, [rbp + 7]
mov r13, qword [rbp + 7]
mov r12, qword [rbp + 0x1f]
cmp r12, 8
cmovae rdi, r13
movabs rcx, 0x7ffffffffffffffe
movabs rdx, 0x7fffffffffffffff
mov rsi, qword [rbp + 0x17]
cmp rsi, 8
jae 0x14003b3e5
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x59], xmm0
lea r14d, [r15 + 7]
mov rbx, qword [rbp - 0x59]
jmp 0x14003b475
mov r14, rsi
or r14, 7
cmp r14, rcx
cmova r14, rcx
lea rcx, [r14 + 1]
cmp rcx, rdx
ja 0x14003b95f
add rcx, rcx
cmp rcx, 0x1000
jb 0x14003b438
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003b95f
mov rcx, rax
call fcn.140049540
test rax, rax
je 0x14003b8a8
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14003b44a
test rcx, rcx
je 0x14003b447
call fcn.140049540
mov rbx, rax
jmp 0x14003b44a
mov rbx, r15
mov qword [rbp - 0x59], rbx
lea r8, [rsi*2 + 2]
mov rdx, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
movabs rcx, 0x7ffffffffffffffe
movabs rdx, 0x7fffffffffffffff
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x49], rsi
mov qword [rbp - 0x79], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x61], r15
lea r15, [rbp + 7]
cmp r12, 8
cmovae r15, r13
cmp rsi, 8
jae 0x14003b4aa
movups xmm0, xmmword [r15]
movups xmmword [rbp - 0x79], xmm0
mov edi, 7
jmp 0x14003b528
mov rdi, rsi
or rdi, 7
cmp rdi, rcx
cmova rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, rdx
ja 0x14003b959
add rcx, rcx
cmp rcx, 0x1000
jb 0x14003b503
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003b959
mov rcx, rax
call fcn.140049540
mov rcx, rax
test rax, rax
je 0x14003b4fc
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003b511
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14003b50f
call fcn.140049540
jmp 0x14003b511
xor eax, eax
mov qword [rbp - 0x79], rax
lea r8, [rsi*2 + 2]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x69], rsi
mov qword [rbp - 0x61], rdi
lea rcx, [rbp - 0x79]
call fcn.14003b1a0
xor eax, eax
mov qword [rbp - 0x79], rax
mov qword [rbp - 0x69], rax
mov qword [rbp - 0x61], rax
lea r15, [rbp - 0x19]
mov r13, qword [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae r15, r13
mov r12, qword [rbp - 9]
cmp r12, 8
jae 0x14003b572
movups xmm0, xmmword [r15]
movups xmmword [rbp - 0x79], xmm0
lea edi, [rax + 7]
jmp 0x14003b600
mov rdi, r12
or rdi, 7
movabs rcx, 0x7ffffffffffffffe
cmp rdi, rcx
cmova rdi, rcx
lea rcx, [rdi + 1]
movabs rdx, 0x7fffffffffffffff
cmp rcx, rdx
ja 0x14003b971
add rcx, rcx
cmp rcx, 0x1000
jb 0x14003b5df
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003b971
mov rcx, rax
call fcn.140049540
mov rcx, rax
test rax, rax
je 0x14003b5d8
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003b5e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14003b5e9
call fcn.140049540
mov qword [rbp - 0x79], rax
lea r8, [r12*2 + 2]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x69], r12
mov qword [rbp - 0x61], rdi
lea rcx, [rbp - 0x79]
call fcn.14003b030
lea rax, [rbp - 0x79]
mov qword [rbp + 0x67], rax
xor edx, edx
mov qword [rbp - 0x79], rdx
mov qword [rbp - 0x69], rdx
mov qword [rbp - 0x61], rdx
lea r15, [rbp - 0x59]
cmp r14, 8
cmovae r15, rbx
cmp rsi, 8
jae 0x14003b649
movups xmm0, xmmword [r15]
movups xmmword [rbp - 0x79], xmm0
lea edi, [rdx + 7]
jmp 0x14003b6db
mov rdi, rsi
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14003b96b
add rcx, rcx
cmp rcx, 0x1000
jb 0x14003b6b3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003b96b
mov rcx, rax
call fcn.140049540
mov rcx, rax
test rax, rax
je 0x14003b86c
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003b6c2
test rcx, rcx
je 0x14003b6bf
call fcn.140049540
jmp 0x14003b6c2
mov rax, rdx
mov qword [rbp - 0x79], rax
lea r8, [rsi*2 + 2]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor edx, edx
mov qword [rbp - 0x69], rsi
mov qword [rbp - 0x61], rdi
mov qword [rbp - 0x39], rdx
mov qword [rbp - 0x29], rdx
mov qword [rbp - 0x21], rdx
lea r15, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae r15, r13
cmp r12, 8
jae 0x14003b714
movups xmm0, xmmword [r15]
movups xmmword [rbp - 0x39], xmm0
mov esi, 7
jmp 0x14003b7ad
mov rsi, r12
or rsi, 7
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
cmova rsi, rax
lea rcx, [rsi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14003b965
add rcx, rcx
cmp rcx, 0x1000
jb 0x14003b781
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003b965
mov rcx, rax
call fcn.140049540
mov rcx, rax
test rax, rax
je 0x14003b77a
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003b790
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14003b78d
call fcn.140049540
jmp 0x14003b790
mov rax, rdx
mov qword [rbp - 0x39], rax
lea r8, [r12*2 + 2]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rdi, qword [rbp - 0x61]
xor edx, edx
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], rsi
lea r9, [rbp - 0x79]
cmp rdi, 8
cmovae r9, qword [rbp - 0x79]
lea r8, [rbp - 0x39]
cmp rsi, 8
cmovae r8, qword [rbp - 0x39]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rdx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x14003b823
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b81e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b86c
call fcn.14004957c
xor eax, eax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], 7
mov word [rbp - 0x39], ax
mov rdx, qword [rbp - 0x61]
cmp rdx, 8
jb 0x14003b879
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x79]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b873
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003b873
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004957c
nop
cmp r14, 8
jb 0x14003b8b8
lea rdx, [r14*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14003b8af
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003b8af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14004957c
nop
mov rax, qword [rbp - 1]
cmp rax, 8
jb 0x14003b8fb
lea rdx, [rax*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x14003b8f2
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003b8f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r13
call fcn.14004957c
nop
mov rax, qword [rbp + 0x1f]
cmp rax, 8
jb 0x14003b93e
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b939
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003b939
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004957c
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400038d0
nop
call fcn.1400038d0
nop
call fcn.1400038d0
nop
call fcn.1400038d0
int3
call fcn.1400038d0
int3