Function at 0x1400083c4
Capabilities:
Create process on windows
Execute command
Set console window title
Terminate process

Disassembly:
push rbp
btr ax, 0x3e
rcl ah, cl
push r15
lea rbp, [rsp - 0x1c8]
sub rsp, 0x2c8
mov rax, qword [0x140006008]
xor rax, rsp
sal dx, 0x13
movzx rcx, r11w
bts ecx, r11d
mov qword [rbp + 0x1b8], rax
btc r8, 0x21
sal r8d, 0x37
cwd
movdqa xmm1, xmmword [0x140004430]
sbb rcx, rsp
rol cx, cl
btr edx, ecx
xorps xmm0, xmm0
cqo
movups xmmword [rsp + 0x50], xmm0
sub eax, eax
mov dword [rbp - 0x74], 0x59
bt r8w, 0xae
inc r8
movups xmmword [rsp + 0x60], xmm0
sub r15d, r15d
movzx r8, ax
shrd r8, rdx, 0x20
rol dx, cl
mov qword [rbp - 0x80], rax
mov dh, bh
clc
movzx ecx, r13w
movups xmmword [rsp + 0x70], xmm0
ror rcx, 0xaa
mov r8d, r15d
mov dword [rbp - 0x78], eax
movdqa xmm0, xmmword [0x140004480]
movdqa xmmword [rbp - 0x70], xmm0
or ch, al
rol ax, cl
movsx rcx, r9w
movdqa xmm0, xmmword [0x1400044d0]
movsx ecx, r13w
cmp sil, bpl
cqo
movdqa xmmword [rbp - 0x60], xmm1
shr ax, 0x8b
movzx dx, sil
movdqa xmm1, xmmword [0x1400044b0]
btc cx, r9w
movdqa xmmword [rbp - 0x50], xmm0
lahf
sar rcx, 0x2f
movdqa xmm0, xmmword [0x140004590]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm1, xmmword [0x140004540]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm0, xmmword [0x140004470]
cbw
ror dl, cl
movdqa xmmword [rbp - 0x20], xmm1
rcr edx, 0xad
movdqa xmm1, xmmword [0x1400044a0]
cmovg rdx, r8
movdqa xmmword [rbp - 0x10], xmm0
bswap edx
lahf
btr cx, r12w
movdqa xmm0, xmmword [0x140004510]
movdqa xmmword [rbp], xmm1
movsx ax, bh
movdqa xmm1, xmmword [0x140004460]
movsxd rdx, esp
lahf
movdqa xmmword [rbp + 0x10], xmm0
cdqe
movdqa xmm0, xmmword [0x140004410]
sbb ax, 0x7cba
bsr rax, rax
bts rcx, rsi
movdqa xmmword [rbp + 0x20], xmm1
add dh, 0xb9
stc
movdqa xmm1, xmmword [0x140004550]
shrd ecx, ecx, 0xb0
movdqa xmmword [rbp + 0x30], xmm0
xadd ah, al
shl ah, cl
shr ax, 0x19
movdqa xmm0, xmmword [0x140004440]
shl dl, cl
movdqa xmmword [rbp + 0x40], xmm1
movdqa xmm1, xmmword [0x140004520]
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmmword [rbp + 0x60], xmm1
mov dword [rbp + 0x70], 0x25
bsf rax, r14
test sp, 0x362a
adc dh, 0x80
mov dword [rbp + 0x74], 0x74
mov eax, dword [rbp + r8*4 - 0x74]
bsf cx, r14w
rcr dx, cl
movzx rdx, bp
sub eax, 8
imul ecx, eax, 0x22
rcr rdx, 0xa9
cwd
sbb rax, 0x658e3dae
mov eax, 0x81020409
movsx rdx, r11w
imul ecx
add edx, ecx
rcr al, cl
btr ax, 0xd
sar edx, 6
mov ax, ax
not eax
mov ah, 0xb3
mov eax, edx
cmp r8b, 0x15
test r12w, 0x3d12
shr eax, 0x1f
test bp, sp
add edx, eax
bsr eax, esi
sal ax, cl
nop
imul eax, edx, 0x7f
movsx edx, di
rol dh, 0xa4
sub ecx, eax
btc ax, r14w
mov eax, 0x81020409
shl dh, cl
btr dx, 0x17
add ecx, 0x7f
inc dh
or edx, 0x3d8aea0b
imul ecx
movzx eax, bp
mov al, 0x85
add edx, ecx
nop
or rax, rcx
sar edx, 6
and al, 0x84
add rax, 0x370f1818
mov eax, edx
jmp 0x140008630
shr eax, 0x1f
add edx, eax
test r14d, r14d
sar al, cl
xor ah, al
imul eax, edx, 0x7f
sub ecx, eax
jmp 0x140008646
mov byte [rsp + r8 + 0x50], cl
jmp 0x140008650
inc r8
clc
test r14w, r9w
cmp r8, 0x3b
jmp 0x140008661
jb 0x14000858a
lea rcx, [rsp + 0x50]
mov byte [rbp - 0x75], r15b
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
movdqa xmm1, xmmword [0x140004490]
lea rcx, [rbp + 0xc0]
xorps xmm0, xmm0
clc
test r13b, r10b
mov dword [rbp + 0x140], 0x68
test r9b, sil
xor eax, eax
movdqa xmmword [rbp + 0xe0], xmm1
jmp 0x1400086a8
movups xmmword [rbp + 0x148], xmm0
mov qword [rbp + 0xc0], rax
movups xmmword [rbp + 0x158], xmm0
mov dword [rbp + 0xc8], eax
jmp 0x1400086c8
movups xmmword [rbp + 0x168], xmm0
jmp 0x1400086d4
mov byte [rbp + 0xcc], al
jmp 0x1400086df
movups xmmword [rbp + 0x178], xmm0
jmp 0x1400086eb
movups xmmword [rbp + 0x188], xmm0
jmp 0x1400086f7
movups xmmword [rbp + 0x198], xmm0
jmp 0x140008703
movdqa xmm0, xmmword [0x140004580]
jmp 0x140008710
movdqa xmmword [rbp + 0xd0], xmm0
jmp 0x14000871d
movdqa xmm0, xmmword [0x140004570]
jmp 0x14000872a
movdqa xmmword [rbp + 0xf0], xmm0
jmp 0x140008737
call fcn.1400023f0
mov rcx, rax
xor r9d, r9d
not ah
dec ah
lea rax, [rbp + 0x80]
jmp 0x140008752
sub r8d, r8d
test sil, bpl
cmp bh, 0x9e
mov qword [rsp + 0x48], rax
sal ax, 0x3b
xor edx, edx
cmovle eax, r14d
movzx ax, r14b
lea rax, [rbp + 0x140]
jmp 0x14000877b
mov qword [rsp + 0x40], rax
jmp 0x140008785
mov qword [rsp + 0x38], r15
jmp 0x14000878f
mov qword [rsp + 0x30], r15
jmp 0x140008799
mov dword [rsp + 0x28], r15d
jmp 0x1400087a3
mov dword [rsp + 0x20], r15d
jmp 0x1400087ad
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jmp 0x1400087ba
jne 0x140008924
movdqa xmm1, xmmword [0x140004500]
mov ch, 0x10
lea rcx, [rbp + 0xc0]
test dl, dil
cmc
xorps xmm0, xmm0
stc
movdqa xmmword [rbp + 0xf0], xmm1
movdqa xmm1, xmmword [0x1400044c0]
xor eax, eax
jmp 0x1400087f1
movups xmmword [rbp + 0xc0], xmm0
jmp 0x1400087fd
mov qword [rbp + 0xd0], rax
movdqa xmm0, xmmword [0x1400044e0]
movdqa xmmword [rbp + 0xe0], xmm0
jmp 0x140008819
movdqa xmm0, xmmword [0x1400044f0]
jmp 0x140008826
movdqa xmmword [rbp + 0x100], xmm0
jmp 0x140008833
movdqa xmm0, xmmword [0x140004450]
jmp 0x140008840
movdqa xmmword [rbp + 0x110], xmm1
jmp 0x14000884d
movdqa xmm1, xmmword [0x1400043e0]
movdqa xmmword [rbp + 0x120], xmm0
mov word [rbp + 0xd8], ax
jmp 0x140008869
mov dword [rbp + 0xdc], 0x3d
jmp 0x140008878
movdqa xmmword [rbp + 0x130], xmm1
jmp 0x140008885
call fcn.140001d70
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov rdx, rax
jmp 0x140008899
call fcn.140002720
mov rcx, rax
xchg dl, dh
movsx dx, r11b
movzx rdx, bx
lea rdx, [0x1400028f0]
jmp 0x1400088b8
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movdqa xmm0, xmmword [0x1400043f0]
setns cl
rcl ch, cl
lea rcx, [rbp + 0x98]
stc
test bpl, 0x23
xor eax, eax
jmp 0x1400088de
mov dword [rbp + 0xb0], 0x43
mov dword [rbp + 0x98], eax
mov word [rbp + 0x9c], ax
jmp 0x1400088fa
movdqu xmmword [rbp + 0xa0], xmm0
jmp 0x140008907
call fcn.140001c10
mov rcx, rax
jmp 0x140008914
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 1
jmp 0x140008e84
mov rcx, qword [rbp + 0x80]
movsxd rdx, r12d
mov edx, 0xc8
jmp 0x140008938
mov qword [rsp + 0x2e0], rbx
jmp 0x140008958
mov qword [rsp + 0x2e8], rsi
jmp 0x140008965
mov qword [rsp + 0x2f0], rdi
mov qword [rsp + 0x2c0], r14
jmp 0x14000897a
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r8d, dword [rbp + 0x90]
test r8b, 0xa5
mov cl, 0xa8
stc
sub edx, edx
cmovbe ecx, r9d
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
stc
test r15b, dil
test rax, rax
jmp 0x1400089ae
jne 0x1400089c1
mov rdi, r15
jmp 0x1400089bc
jmp 0x140008a8c
mov r9d, 0x18
cmp r8w, r8w
bts r8w, r13w
lea r8, [rbp + 0x98]
movzx ecx, sp
clc
dec ch
sub edx, edx
movzx rcx, r9w
movzx cx, bl
mov rcx, rbx
jmp 0x1400089ef
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rcx, rbx
test r10, 0xffffffffcfaca0b2
cmp r12w, dx
test eax, eax
jmp 0x140008a0a
jne 0x140008a23
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, r15
jmp 0x140008a1e
jmp 0x140008a8c
mov rdx, qword [rbp + 0xa8]
not r9w
movsx r9, ax
movzx r8d, r15w
lea r8, [rbp + 0xc0]
seto r9b
jmp 0x140008a46
mov r9d, 0x30
jmp 0x140008a51
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov rcx, rbx
test eax, eax
jmp 0x140008a61
jne 0x140008a7a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, r15
jmp 0x140008a75
jmp 0x140008a8c
mov rdi, qword [rbp + 0xc8]
jmp 0x140008a86
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbp + 0x80]
mov cl, 0xb8
mov ecx, 7
jmp 0x140008a9f
mov dword [rbp + 0x1b0], 0x84b880
jmp 0x140008aae
mov word [rbp + 0x1b4], r15w
jmp 0x140008abb
mov byte [rbp + 0x1b6], r15b
jmp 0x140008ac7
call fcn.1400029d8
mov r9d, 7
movzx ecx, si
bswap si
mov qword [rsp + 0x20], r15
movzx ecx, cx
movzx si, al
mov r8, rax
movzx ecx, r15w
lea rdx, [rdi + 0x2c0f05]
movsx si, r13b
movzx esi, bp
mov rcx, rbx
mov rsi, 0x7f3b533c
mov si, ax
mov rsi, rax
jmp 0x140008b0f
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rsp + 0x2e0]
test eax, eax
jmp 0x140008b24
je 0x140008d0f
lea rax, [rbp + 0x1b0]
mov r9b, 0x16
sub r9b, 0x84
mov r9, rsi
jmp 0x140008b44
sub r9, rax
mov r8, r15
lea rcx, [rbp + 0x1b0]
movsx eax, ax
add rcx, r8
bt rax, 0x15
cmc
movzx eax, byte [rcx]
cmc
clc
cmp byte [rcx + r9], al
jmp 0x140008b6b
jne 0x140008d07
inc r8
cmp spl, 0x20
stc
cmp r8, 7
jb 0x140008b4a
mov rcx, rsi
jmp 0x140008b8b
call fcn.1400029d0
mov rcx, qword [rbp + 0x80]
bswap r9w
mov rdx, 0x36aa328b
setbe dl
lea r8, [0x1400043c8]
cwd
mov r9d, 0x10
cmovs edx, r11d
mov qword [rsp + 0x20], r15
lea rdx, [rdi + 0x2c0f05]
jmp 0x140008bc9
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbp + 0x80]
cqo
mov r9w, r11w
movzx r8w, bl
lea rdx, [rdi + 0x48c28d]
movzx r8, bx
mov r9, r9
mov r9d, 6
mov qword [rsp + 0x20], r15
movsx r8d, r11w
bswap r8
lea r8, [0x1400043b8]
jmp 0x140008c0d
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbp + 0x80]
movsx r8w, bpl
lea rdx, [rdi + 0x54c53f]
mov r9b, 0xa
mov r9d, 2
mov r8b, r13b
bswap r8
mov qword [rsp + 0x20], r15
xchg r8w, r8w
cmovnp r8d, r15d
movsx r8d, di
lea r8, [0x1400043c0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbp + 0x80]
movzx r9w, bpl
not r8b
cqo
lea rdx, [rdi + 0x54c623]
mov r9d, 2
movzx r8w, r12b
bswap r8w
movzx r8, bx
mov qword [rsp + 0x20], r15
xchg r8b, r8b
lea r8, [0x1400043d8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbp + 0x80]
jmp 0x140008ca2
lea rdx, [rdi + 0x54c726]
bswap r9w
movzx r8w, r10b
cmovs r8w, r10w
mov r9d, 1
movzx r8, ax
mov qword [rsp + 0x20], r15
bswap r8w
lea r8, [0x1400043be]
jmp 0x140008cd6
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbp + 0x80]
jmp 0x140008ce8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140008d02
jmp 0x140008e69
mov rcx, rsi
call fcn.1400029d0
mov rcx, qword [rbp + 0x80]
sub edx, edx
jmp 0x140008d1d
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movdqa xmm1, xmmword [0x140004420]
mov cl, 3
ror ch, cl
jmp 0x140008d34
lea rcx, [rbp + 0xc0]
cmc
jmp 0x140008d47
xorps xmm0, xmm0
test r13d, 0xa61f46b9
mov dword [rbp + 0xd4], 0x17
cmp r13b, 0x98
movups xmmword [rbp + 0xc0], xmm0
cmp sil, r9b
xor eax, eax
jmp 0x140008d70
mov dword [rbp + 0xd8], 7
jmp 0x140008d7f
movdqa xmm0, xmmword [0x140004560]
movdqa xmmword [rbp + 0xe0], xmm0
jmp 0x140008d94
movdqa xmm0, xmmword [0x140004400]
jmp 0x140008da1
movdqa xmmword [rbp + 0x100], xmm0
jmp 0x140008dae
mov byte [rbp + 0xd0], al
jmp 0x140008db9
mov dword [rbp + 0xdc], 0x1f
movdqa xmmword [rbp + 0xf0], xmm1
jmp 0x140008dd0
mov dword [rbp + 0x110], 0x45
call fcn.1400017e0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
cwd
mov dl, r9b
mov rdx, rax
jmp 0x140008df3
call fcn.140002720
mov rcx, rax
lea rdx, [0x1400028f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movdqa xmm0, xmmword [0x140004530]
ror ch, cl
ror ecx, 0xd
cmc
lea rcx, [rbp + 0x98]
clc
sub eax, eax
jmp 0x140008e25
mov dword [rbp + 0xb0], 0x16
jmp 0x140008e34
mov dword [rbp + 0x98], eax
jmp 0x140008e3f
mov word [rbp + 0x9c], ax
movdqu xmmword [rbp + 0xa0], xmm0
jmp 0x140008e53
call fcn.140001680
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 1
movsxd rsi, r14d
mov rdi, qword [rsp + 0x2f0]
mov rsi, qword [rsp + 0x2e8]
mov r14, qword [rsp + 0x2c0]
bswap cx
mov rcx, qword [rbp + 0x1b8]
xor rcx, rsp
jmp 0x140008e93
call fcn.1400029b0
add rsp, 0x2c8
mov r15d, 0xa9a12499
pop r15
xchg ebp, ebp
mov ebp, r13d
bswap bp
pop rbp
jmp 0x140008eb5
ret