Function at 0x14024a980
Capabilities:
Create process on windows

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xe0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x58], 0xfffffffffffffffe
mov rcx, rdx
lea r8, [0x140688ceb]
mov qword [rbp + 0x40], rdx
xor edx, edx
call fcn.14024ad00
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x38], xmm0
movabs rax, 0x4000000070
mov qword [rbp - 0x58], rax
mov eax, dword [0x140ae12b0]
mov ecx, dword [0x140ae12b4]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rbp + 0x57]
mov eax, 0x9ecd49b0
mov r9d, 0xa901fd55
cmove r9d, eax
cmp ecx, 0xa
setl byte [rbp + 0x56]
movups xmmword [rbp - 0x50], xmm0
mov ecx, dword [0x140ae0f00]
cmovl r9d, eax
lea eax, [rcx - 1]
imul eax, ecx
test al, 1
sete al
cmp dword [0x140ae0f04], 0xa
setl cl
or cl, al
mov ecx, 0xc4687fa2
mov eax, 0x7a96eb38
cmove ecx, eax
lea rdx, str.cmd.exe
mov r11d, 0x4a149d5f
cmove r11d, eax
mov qword [rbp - 0x40], rdx
mov edx, 0xbb82dfdc
mov r8d, 0xecd5f384
mov r10d, 0x4747f63
mov r14, qword [rbp + 0x40]
nop word cs:[rax + rax]
nop dword [rax]
cmp edx, 0xc6c94d1a
jg 0x14024aab0
cmp edx, 0x9ecd49b0
je 0x14024ac3c
cmp edx, 0xa901fd55
je 0x14024ac46
cmp edx, 0xbb82dfdc
jne 0x14024aa70
mov bl, byte [rbp + 0x57]
cmp byte [rbp + 0x56], 0
mov edx, 0xa901fd55
cmovne edx, r8d
test bl, bl
cmovne edx, r8d
jmp 0x14024aa70
cmp edx, 0xc6c94d1b
je 0x14024ac5c
cmp edx, 0xecd5f384
je 0x14024ac50
cmp edx, 0x342e8b9d
jne 0x14024aa70
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x38], rax
mov rdx, qword [rbp + 0x38]
mov qword [rbp + 0x28], rdx
mov rdx, qword [rax + 0x18]
mov edi, 0x17b62e27
jmp 0x14024ab00
mov edi, 0xe88bf9fb
mov rax, qword [rbp + 0x48]
nop word cs:[rax + rax]
nop
mov esi, edi
cmp edi, 0x4a149d5e
jg 0x14024ab60
cmp esi, 0xe88bf9fa
jle 0x14024ab90
cmp esi, 0x4747f63
je 0x14024abe4
cmp esi, 0x17b62e27
jne 0x14024ac24
mov rsi, qword [rbp + 0x28]
mov qword [rbp + 0x20], rsi
mov esi, 0xed9d7881
nop word [rax + rax]
cmp esi, 0xed9d7881
je 0x14024ab55
cmp esi, 0xb9f8daef
jne 0x14024ab40
jmp 0x14024abf6
mov esi, 0xb9f8daef
jmp 0x14024ab40
cmp esi, 0x739a6312
jg 0x14024abc0
mov edi, ecx
cmp esi, 0x4a149d5f
je 0x14024ab00
mov edi, esi
cmp esi, 0x645131b9
jne 0x14024ab00
mov edi, r11d
jmp 0x14024ab00
cmp esi, 0xc4687fa2
je 0x14024ac0e
mov edi, esi
cmp esi, 0xdb7c7b41
jne 0x14024ab00
mov rsi, qword [rbp + 0x18]
mov rsi, qword [rsi]
mov qword [rbp + 0x48], rsi
mov edi, 0x739a6313
jmp 0x14024ab00
cmp esi, 0x739a6313
je 0x14024aaeb
mov edi, esi
cmp esi, 0x7a96eb38
jne 0x14024ab00
mov edi, 0x4a149d5f
jmp 0x14024ab00
mov rsi, qword [rbp + 0x38]
mov qword [rbp + 0x18], rsi
mov edi, 0xdb7c7b41
jmp 0x14024ab00
cmp rdx, 0x10
setae byte [rbp + 0x54]
mov bl, byte [rbp + 0x54]
mov byte [rbp + 0x55], bl
mov edi, 0x645131b9
jmp 0x14024ab00
cmp byte [rbp + 0x55], 0
mov edi, 0xe88bf9fb
cmovne edi, r10d
mov rax, qword [rbp + 0x20]
jmp 0x14024ab00
mov edi, esi
cmp esi, 0xe88bf9fb
jne 0x14024ab00
mov edx, 0xc6c94d1b
jmp 0x14024aa70
mov edx, 0x342e8b9d
jmp 0x14024aa70
mov edx, 0xecd5f384
jmp 0x14024aa70
mov qword [rbp + 0x30], r14
mov edx, r9d
jmp 0x14024aa70
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 0
mov dword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
lea rcx, [rbp - 0x58]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x14024ac9c
mov rcx, qword [rbp + 0x10]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x10]
lea rdx, [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.14024afe0
nop
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret