Function at 0x1400061c0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x140042010]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov r14, r8
mov r13d, edx
mov r15d, ecx
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x60]
mov rdi, r9
call fcn.140013cf0
xor eax, eax
xor esi, esi
mov ebx, 1
mov qword [rbp - 0x78], rax
cmp dword [reloc.WS2_32.dll_accept], ebx
mov dword [rbp - 0x70], eax
mov byte [rbp - 0x6c], al
jne 0x1400062be
xor edx, edx
mov dword [reloc.WS2_32.dll_accept], esi
lea rcx, str.echo_____NUL
call qword [sym.imp.KERNEL32.dll_WinExec]
lea r8, str.LM_ELOG_MUTE_ALL
mov qword [rsp + 0x70], rsi
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x78], rsi
lea rcx, [rsp + 0x70]
call fcn.14001e92c
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000627d
cmp byte [rcx], 0x31
mov eax, dword [0x140043f0c]
cmove eax, ebx
mov dword [0x140043f0c], eax
call fcn.14001eac8
lea r8, str.LM_ELOG_MUTE
mov qword [rsp + 0x70], rsi
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x70]
call fcn.14001e92c
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400062be
cmp byte [rcx], 0x31
mov eax, dword [0x140043f08]
cmove eax, ebx
mov dword [0x140043f08], eax
call fcn.14001eac8
mov qword [rsp + 0x70], rsi
cmp dword [0x140043f0c], ebx
je 0x14000671e
cmp dword [0x140043f08], ebx
jne 0x1400062dc
cmp r15d, 3
jl 0x14000671e
cmp r15d, ebx
je 0x14000671e
lea rcx, [r14 + 0x28]
mov qword [rsp + 0x1b8], r12
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [r14 + 0x28]
mov word [r14 + 0x38], ax
movzx eax, word [r14 + 0x2a]
mov word [r14 + 0x3a], ax
movzx eax, word [r14 + 0x2e]
mov word [r14 + 0x3c], ax
movzx eax, word [r14 + 0x30]
mov word [r14 + 0x3e], ax
movzx eax, word [r14 + 0x32]
mov word [r14 + 0x40], ax
movzx eax, word [r14 + 0x34]
mov word [r14 + 0x42], ax
movzx eax, word [r14 + 0x36]
mov word [r14 + 0x44], ax
cmp dword [r14 + 0xc], esi
je 0x1400063c8
lea rbx, [r14 + 4]
cmp dword [r14 + 8], esi
jne 0x14000635b
mov dword [rbx], esi
mov dword [r14 + 8], 1
mov eax, 1
xchg dword [rbx], eax
test eax, eax
jne 0x140006716
cmp qword [r14 + 0x20], rsi
jne 0x14000637b
xor ecx, ecx
call fcn.14001f7ac
mov qword [r14 + 0x20], rax
xor ecx, ecx
call fcn.14001f7ac
mov ecx, dword [r14 + 0xc]
add rcx, qword [r14 + 0x20]
cmp rcx, rax
ja 0x140006397
mov qword [r14 + 0x20], rax
mov dword [r14 + 0x14], esi
mov eax, dword [r14 + 0x10]
test eax, eax
je 0x1400063b5
mov ecx, dword [r14 + 0x14]
cmp eax, ecx
jbe 0x1400063b5
lea eax, [rcx + 1]
mov ecx, 1
mov dword [r14 + 0x14], eax
jmp 0x1400063bb
inc dword [r14 + 0x18]
mov ecx, esi
mov eax, esi
xchg dword [rbx], eax
cmp ecx, 1
jne 0x140006716
lea rbx, [rbp + 0x138]
call fcn.140001790
mov rcx, qword [rbp + 0x130]
lea rdx, [rbp - 0x60]
mov r9d, 0xff
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax]
lea r8d, [r9 + 1]
call fcn.1400173c4
mov qword [rbp - 0x80], rsi
mov rax, 0xffffffffffffffff
cmp r15d, 3
jne 0x140006490
inc rax
cmp byte [rdi + rax], sil
jne 0x140006415
dec eax
mov edx, esi
test eax, eax
jle 0x140006458
movsxd r9, eax
add r9, rdi
nop dword [rax]
movzx r8d, byte [r9]
mov ecx, eax
cmp r8b, 0x2e
cmovne ecx, edx
mov edx, ecx
cmp r8b, 0x5c
je 0x140006456
cmp r8b, 0x2f
je 0x140006456
dec eax
dec r9
test eax, eax
jg 0x140006430
jmp 0x140006458
inc eax
cmp eax, edx
jge 0x140006482
sub edx, eax
movsxd rcx, eax
mov r8d, recv
cmp edx, r8d
cmovg edx, r8d
movsxd r8, edx
lea rdx, [rcx + rdi]
lea rcx, [rbp - 0x78]
call fcn.140014600
mov byte [rbp - 0x6c], sil
lea rcx, str.__04d_02d_02d__02d_02d_02d._03d__e_0me_2_36mLMe_0m___e_0me_1_31mERRe_0m__R:_02d__S:_04d_____12s:_04d___s
jmp 0x1400065e9
cmp byte [rdi + rax + 1], sil
lea rax, [rax + 1]
jne 0x140006490
lea ecx, [rax - 1]
mov edx, esi
cmp r15d, 2
jne 0x14000650e
test ecx, ecx
jle 0x1400064d8
movsxd r9, ecx
add r9, rdi
movzx r8d, byte [r9]
mov eax, ecx
cmp r8b, 0x2e
cmovne eax, edx
mov edx, eax
cmp r8b, 0x5c
je 0x1400064d6
cmp r8b, 0x2f
je 0x1400064d6
dec ecx
dec r9
test ecx, ecx
jg 0x1400064b0
jmp 0x1400064d8
inc ecx
cmp ecx, edx
jge 0x140006502
sub edx, ecx
movsxd rax, ecx
mov r8d, recv
lea rcx, [rbp - 0x78]
cmp edx, r8d
cmovg edx, r8d
movsxd r8, edx
lea rdx, [rax + rdi]
call fcn.140014600
mov byte [rbp - 0x6c], sil
lea rcx, str.__04d_02d_02d__02d_02d_02d._03d__e_0me_2_36mLMe_0m___e_0me_1_33mWRNe_0m__R:_02d__S:_04d_____12s:_04d___s
jmp 0x1400065e9
test r15d, r15d
jne 0x14000657b
test ecx, ecx
jle 0x140006548
movsxd r9, ecx
add r9, rdi
nop dword [rax]
movzx r8d, byte [r9]
mov eax, ecx
cmp r8b, 0x2e
cmovne eax, edx
mov edx, eax
cmp r8b, 0x5c
je 0x140006546
cmp r8b, 0x2f
je 0x140006546
dec ecx
dec r9
test ecx, ecx
jg 0x140006520
jmp 0x140006548
inc ecx
cmp ecx, edx
jge 0x140006572
sub edx, ecx
movsxd rax, ecx
mov r8d, recv
lea rcx, [rbp - 0x78]
cmp edx, r8d
cmovg edx, r8d
movsxd r8, edx
lea rdx, [rax + rdi]
call fcn.140014600
mov byte [rbp - 0x6c], sil
lea rcx, str.__04d_02d_02d__02d_02d_02d._03d__e_0me_2_36mLMe_0m___e_0me_1_36mINFe_0m__R:_02d__S:_04d_____12s:_04d___s
jmp 0x1400065e9
test ecx, ecx
jle 0x1400065b8
movsxd r9, ecx
add r9, rdi
nop word [rax + rax]
movzx r8d, byte [r9]
mov eax, ecx
cmp r8b, 0x2e
cmovne eax, edx
mov edx, eax
cmp r8b, 0x5c
je 0x1400065b6
cmp r8b, 0x2f
je 0x1400065b6
dec ecx
dec r9
test ecx, ecx
jg 0x140006590
jmp 0x1400065b8
inc ecx
cmp ecx, edx
jge 0x1400065e2
sub edx, ecx
movsxd rax, ecx
mov r8d, recv
lea rcx, [rbp - 0x78]
cmp edx, r8d
cmovg edx, r8d
movsxd r8, edx
lea rdx, [rax + rdi]
call fcn.140014600
mov byte [rbp - 0x6c], sil
lea rcx, str.__04d_02d_02d__02d_02d_02d._03d__e_0me_2_36mLMe_0m___NOR__R:_02d__S:_04d_____12s:_04d___s
mov edi, dword [r14 + 0x18]
lea rax, [rbp - 0x60]
movzx esi, word [r14 + 0x44]
movzx ebx, word [r14 + 0x42]
movzx r11d, word [r14 + 0x40]
movzx r10d, word [r14 + 0x3e]
movzx r9d, word [r14 + 0x3c]
movzx r8d, word [r14 + 0x3a]
movzx edx, word [r14 + 0x38]
mov qword [rsp + 0x60], rax
mov eax, dword [rbp + 0x128]
mov dword [rsp + 0x58], eax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], r10d
call fcn.140006160
mov edi, dword [r14 + 0x18]
xor esi, esi
mov eax, esi
lock xadd dword [0x140044f98], eax
lea rcx, [0x140044fa0]
cmp eax, 1
je 0x1400066ae
mov qword [0x140044fa0], rcx
xor r8d, r8d
mov qword [0x140044fa8], rcx
xor edx, edx
xor ecx, ecx
mov dword [0x140044fb0], esi
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x140044fb8], rax
mov edx, 1
mov ecx, edx
mov eax, esi
xchg dword [0x140044fc0], eax
xchg dword [0x140044f98], ecx
lea rcx, [0x140044fa0]
jmp 0x1400066b3
mov edx, 1
xor eax, eax
lock cmpxchg dword [0x140044fb0], edx
jne 0x1400066b3
mov rax, qword [0x140044fa0]
cmp rax, rcx
je 0x140006704
nop dword [rax + rax]
mov r10, qword [rax + 0x10]
mov rbx, qword [rax]
test r10, r10
je 0x1400066fc
lea rax, [rbp - 0x60]
mov r8d, edi
lea r9, [r14 + 0x38]
mov qword [rsp + 0x20], rax
mov edx, r13d
mov ecx, r15d
call r10
lea rcx, [0x140044fa0]
mov rax, rbx
cmp rbx, rcx
jne 0x1400066d0
mov eax, esi
xchg dword [0x140044fb0], eax
cmp dword [r14 + 0xc], esi
je 0x140006716
mov dword [r14 + 0x18], esi
mov r12, qword [rsp + 0x1b8]
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.140012f80
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret