Function at 0x574510
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push rbp
sub rsp, 0x1a0
mov rbp, rsp
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0x100], 0
mov qword [rbp + 0xc8], rbp
mov qword [rbp + 0x1b0], rcx
mov qword [rbp + 0x1b8], rdx
mov qword [rbp + 0x1c0], r8
mov rcx, qword [rbp + 0x1b0]
call fcn.0040e540
mov rcx, qword [rbp + 0x1b8]
call fcn.0040e540
nop
mov byte [rbp + 0x197], 0
mov dword [rbp + 0x108], 0
lea rcx, [rbp + 0x110]
mov edx, 0x18
xor r8, r8
call fcn.0040a600
lea rcx, [rbp + 0x128]
mov edx, 0x68
xor r8, r8
call fcn.0040a600
mov dword [rbp + 0x128], 0x68
mov dword [rbp + 0x164], 1
mov word [rbp + 0x168], 5
lea rcx, [rbp + 0xc0]
mov rdx, qword [rbp + 0x1b0]
call fcn.0042db80
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0xf0], rax
lea rax, [0x00574db0]
cmp qword [rbp + 0xf0], rax
jne 0x574680
mov byte [rbp + 0xef], 1
jmp 0x5746bd
cmp qword [rbp + 0xf0], 0
je 0x574696
lea rax, [0x00574db0]
test rax, rax
jne 0x57469f
mov byte [rbp + 0xef], 0
jmp 0x5746bd
mov rcx, qword [rbp + 0xf0]
lea rdx, [0x00574db0]
call fcn.0042bc30
test eax, eax
sete al
mov byte [rbp + 0xef], al
nop
cmp byte [rbp + 0xef], 0
je 0x574704
lea rcx, [rbp + 0x100]
mov edx, 4
lea r8, [0x00574dc8]
mov r9, qword [rbp + 0x1b0]
lea rax, [0x00574dfc]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x1b8]
mov qword [rsp + 0x28], rax
call fcn.0040ff20
jmp 0x574803
lea rcx, [rbp + 0xb8]
mov rdx, qword [rbp + 0x1b0]
call fcn.0042db80
mov rax, qword [rbp + 0xb8]
mov qword [rbp + 0xe0], rax
lea rax, [0x00574e10]
cmp qword [rbp + 0xe0], rax
jne 0x57473e
mov byte [rbp + 0xdf], 1
jmp 0x57477b
cmp qword [rbp + 0xe0], 0
je 0x574754
lea rax, [0x00574e10]
test rax, rax
jne 0x57475d
mov byte [rbp + 0xdf], 0
jmp 0x57477b
mov rcx, qword [rbp + 0xe0]
lea rdx, [0x00574e10]
call fcn.0042bc30
test eax, eax
sete al
mov byte [rbp + 0xdf], al
nop
cmp byte [rbp + 0xdf], 0
je 0x5747bf
lea rcx, [rbp + 0x100]
mov edx, 4
lea r8, [0x00574e28]
mov r9, qword [rbp + 0x1b0]
lea rax, [0x00574dfc]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x1b8]
mov qword [rsp + 0x28], rax
call fcn.0040ff20
jmp 0x574803
lea rcx, [rbp + 0x100]
mov edx, 5
lea r8, [0x00574e50]
mov r9, qword [rbp + 0x1b0]
lea rax, [0x00574e50]
mov qword [rsp + 0x20], rax
lea rax, [0x00574e60]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x1b8]
mov qword [rsp + 0x30], rax
call fcn.0040ff20
mov rax, qword [0x005b6b30]
cmp qword [rax], 0
je 0x574840
lea rcx, [rbp + 0xb0]
lea rdx, [0x00574e70]
mov r8, qword [rbp + 0x100]
call fcn.0040fe00
mov rax, qword [0x005b6b30]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0xb0]
call fcn.00553120
mov dword [rbp + 0xd8], 0
cmp qword [rbp + 0x100], 0
je 0x574864
mov rax, qword [rbp + 0x100]
mov eax, dword [rax - 4]
mov dword [rbp + 0xd8], eax
mov ecx, dword [rbp + 0xd8]
add ecx, 2
add ecx, ecx
movsxd rcx, ecx
call fcn.00408c40
mov qword [rbp + 0xf8], rax
mov dword [rbp + 0xd4], 0
cmp qword [rbp + 0x100], 0
je 0x5748a2
mov rax, qword [rbp + 0x100]
mov eax, dword [rax - 4]
mov dword [rbp + 0xd4], eax
mov rcx, qword [rbp + 0xf8]
mov edx, dword [rbp + 0xd4]
add edx, 2
add edx, edx
movsxd rdx, edx
xor r8, r8
call fcn.0040a600
mov rcx, qword [rbp + 0xf8]
mov rdx, qword [rbp + 0x100]
call fcn.0042ddd0
xor rcx, rcx
mov rdx, qword [rbp + 0xf8]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x128]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x110]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x574994
mov byte [rbp + 0x197], 0
mov rax, qword [0x005b6b30]
cmp qword [rax], 0
je 0x574983
call sub.kernel32.dll_GetLastError_2
lea rcx, [rbp + 0xa0]
mov edx, eax
mov r8d, 8
call fcn.0042cbc0
lea rcx, [rbp + 0xa8]
lea rdx, [0x00574e94]
mov r8, qword [rbp + 0xa0]
call fcn.0040fe00
mov rax, qword [0x005b6b30]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0xa8]
call fcn.00553120
mov rcx, qword [rbp + 0xf8]
call fcn.00408c70
jmp 0x574cd8
mov rcx, qword [rbp + 0xf8]
call fcn.00408c70
cmp qword [rbp + 0x110], 0
je 0x574cce
mov rcx, qword [rbp + 0x110]
or edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov dword [rbp + 0x10c], eax
cmp dword [rbp + 0x10c], 0
jne 0x574b1c
mov rcx, qword [rbp + 0x110]
lea rdx, [rbp + 0x108]
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x574ab9
cmp dword [rbp + 0x108], 0x103
je 0x574a8a
mov rax, qword [0x005b6b30]
cmp qword [rax], 0
je 0x574a6f
lea rcx, [rbp + 0x90]
mov edx, dword [rbp + 0x108]
mov r8d, 8
call fcn.0042cbc0
lea rcx, [rbp + 0x98]
mov edx, 4
lea r8, [0x00574e70]
mov r9, qword [rbp + 0x1b0]
lea rax, [0x00574ed8]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x90]
mov qword [rsp + 0x28], rax
call fcn.0040ff20
mov rax, qword [0x005b6b30]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x98]
call fcn.00553120
mov rax, qword [rbp + 0x1c0]
mov ecx, dword [rbp + 0x108]
mov dword [rax], ecx
mov byte [rbp + 0x197], 1
jmp 0x574c40
mov rax, qword [0x005b6b30]
cmp qword [rax], 0
je 0x574aad
mov rax, qword [0x005b6b30]
mov rcx, qword [rax]
lea rdx, [0x00574f00]
call fcn.00553120
mov byte [rbp + 0x197], 0
jmp 0x574c40
mov rax, qword [0x005b6b30]
cmp qword [rax], 0
je 0x574b10
call sub.kernel32.dll_GetLastError_2
lea rcx, [rbp + 0x80]
mov edx, eax
mov r8d, 8
call fcn.0042cbc0
lea rcx, [rbp + 0x88]
lea rdx, [0x00574f60]
mov r8, qword [rbp + 0x80]
call fcn.0040fe00
mov rax, qword [0x005b6b30]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x88]
call fcn.00553120
mov byte [rbp + 0x197], 0
jmp 0x574c40
cmp dword [rbp + 0x10c], 0x102
jne 0x574b57
mov rax, qword [0x005b6b30]
cmp qword [rax], 0
je 0x574b4b
mov rax, qword [0x005b6b30]
mov rcx, qword [rax]
lea rdx, [0x00574fcc]
call fcn.00553120
mov byte [rbp + 0x197], 0
jmp 0x574c40
cmp dword [rbp + 0x10c], 0x80
jne 0x574b92
mov rax, qword [0x005b6b30]
cmp qword [rax], 0
je 0x574b86
mov rax, qword [0x005b6b30]
mov rcx, qword [rax]
lea rdx, [0x00575030]
call fcn.00553120
mov byte [rbp + 0x197], 0
jmp 0x574c40
cmp dword [rbp + 0x10c], 0xffffffff
jne 0x574bef
mov rax, qword [0x005b6b30]
cmp qword [rax], 0
je 0x574be6
call sub.kernel32.dll_GetLastError_2
lea rcx, [rbp + 0x70]
mov edx, eax
mov r8d, 8
call fcn.0042cbc0
lea rcx, [rbp + 0x78]
lea rdx, [0x0057508c]
mov r8, qword [rbp + 0x70]
call fcn.0040fe00
mov rax, qword [0x005b6b30]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x78]
call fcn.00553120
mov byte [rbp + 0x197], 0
jmp 0x574c40
mov rax, qword [0x005b6b30]
cmp qword [rax], 0
je 0x574c39
lea rcx, [rbp + 0x60]
mov edx, dword [rbp + 0x10c]
mov r8d, 8
call fcn.0042cbc0
lea rcx, [rbp + 0x68]
lea rdx, [0x00575108]
mov r8, qword [rbp + 0x60]
call fcn.0040fe00
mov rax, qword [0x005b6b30]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x68]
call fcn.00553120
mov byte [rbp + 0x197], 0
nop
mov rcx, qword [rbp + 0x110]
call sub.kernel32.dll_CloseHandle_1
jmp 0x574cd7
mov byte [rbp + 0x197], 0
jmp 0x574cd8
nop
lea rcx, [rbp + 0x50]
mov edx, 0xf
call fcn.0040e490
lea rcx, [rbp + 0x100]
call fcn.0040e3b0
lea rcx, [rbp + 0x1b0]
mov edx, 2
call fcn.0040e490
movzx rax, byte [rbp + 0x197]
lea rsp, [rbp + 0x1a0]
pop rbp
ret