Function at 0x14006c43c
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp + 0x20], rcx
mov dword [rbp + 0x28], edx
mov eax, dword [rbp + 0x28]
and eax, 2
test eax, eax
jne 0x14006c467
mov ecx, 5
call fcn.140041d20
jmp 0x14006caf1
mov rax, qword [0x14074d808]
test rax, rax
jne 0x14006c489
mov edx, 0
mov ecx, 0
call fcn.1400437be
mov qword [0x14074d808], rax
mov rax, qword [0x14074d810]
test rax, rax
jne 0x14006c4ab
mov edx, 0
mov ecx, 0
call fcn.1400437be
mov qword [0x14074d810], rax
mov rax, qword [0x14074d818]
test rax, rax
jne 0x14006c4cd
mov edx, 0
mov ecx, 0
call fcn.1400437be
mov qword [0x14074d818], rax
mov rax, qword [0x14074d820]
test rax, rax
jne 0x14006c4ef
mov edx, 0
mov ecx, 0
call fcn.1400437be
mov qword [0x14074d820], rax
mov rax, qword [0x14074d7f8]
test rax, rax
jne 0x14006c511
mov edx, 0
mov ecx, 0
call fcn.1400437be
mov qword [0x14074d7f8], rax
mov rax, qword [rbp + 0x20]
mov eax, dword [rax + 8]
test eax, eax
jne 0x14006c52b
mov ecx, 5
call fcn.140041d20
jmp 0x14006caf1
call fcn.140068f8f
test eax, eax
setne al
test al, al
je 0x14006c9af
mov rax, qword [0x14074d808]
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call fcn.14004398c
lea rax, [0x140187bce]
mov rcx, rax
call fcn.1400434d7
mov rdx, rax
mov rax, qword [0x14074d810]
mov rcx, rax
call fcn.14004398c
mov rax, qword [0x14074d808]
mov rcx, rax
call fcn.1400690ab
test eax, eax
sete al
test al, al
je 0x14006c639
mov edx, 1
lea rax, [0x1401a1c64]
mov rcx, rax
call fcn.140043595
mov rdx, rax
mov rax, qword [0x14074d808]
mov rcx, rax
call fcn.1400442e7
mov rdx, rax
mov rax, qword [0x14074d818]
mov rcx, rax
call fcn.14004398c
mov r8d, 0x70
mov edx, 0
lea rax, [0x14074d8e0]
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [0x14074d8e0], 0x70
mov rax, qword [0x14074d818]
mov rax, qword [rax]
mov qword [0x14074d8f8], rax
mov qword [0x14074d900], 0
mov dword [0x14074d8e4], 0x400
mov dword [0x14074d910], 0
lea rax, [0x14074d8e0]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
setne al
test al, al
jne 0x14006cae7
mov dword [0x14074d950], 0
mov dword [0x14074d954], 0
jmp 0x14006c722
mov rax, qword [0x14074d808]
mov rdx, qword [rax]
mov eax, dword [0x14074d950]
cdqe
add rax, rdx
movzx eax, byte [rax]
cmp al, 0x22
jne 0x14006c68e
mov eax, dword [0x14074d954]
test eax, eax
jne 0x14006c684
mov dword [0x14074d954], 1
jmp 0x14006c68e
mov dword [0x14074d954], 0
mov rax, qword [0x14074d808]
mov rdx, qword [rax]
mov eax, dword [0x14074d950]
cdqe
add rax, rdx
movzx eax, byte [rax]
cmp al, 0x20
jne 0x14006c713
mov eax, dword [0x14074d954]
test eax, eax
jne 0x14006c713
mov rax, qword [0x14074d808]
mov edx, dword [rax + 8]
mov eax, dword [0x14074d950]
sub edx, eax
sub edx, 1
mov rax, qword [0x14074d808]
mov rcx, rax
call fcn.1400447a1
mov rdx, rax
mov rax, qword [0x14074d810]
mov rcx, rax
call fcn.14004398c
mov edx, dword [0x14074d950]
mov rax, qword [0x14074d808]
mov rcx, rax
call fcn.1400446c0
mov rdx, rax
mov rax, qword [0x14074d808]
mov rcx, rax
call fcn.14004398c
jmp 0x14006c73b
mov eax, dword [0x14074d950]
add eax, 1
mov dword [0x14074d950], eax
mov rax, qword [0x14074d808]
mov edx, dword [rax + 8]
mov eax, dword [0x14074d950]
cmp edx, eax
jg 0x14006c652
nop
mov rax, qword [0x14074d808]
mov eax, dword [rax + 8]
test eax, eax
je 0x14006caea
mov rax, qword [0x14074d810]
mov eax, dword [rax + 8]
test eax, eax
je 0x14006c865
mov rax, qword [0x14074d808]
mov rcx, rax
call fcn.1400690ab
test eax, eax
sete al
test al, al
je 0x14006c865
mov edx, 1
lea rax, [0x1401a1c64]
mov rcx, rax
call fcn.140043595
mov rdx, rax
mov rax, qword [0x14074d808]
mov rcx, rax
call fcn.1400442e7
mov rdx, rax
mov rax, qword [0x14074d818]
mov rcx, rax
call fcn.14004398c
mov edx, 1
lea rax, [0x1401a1c64]
mov rcx, rax
call fcn.140043595
mov rdx, rax
mov rax, qword [0x14074d810]
mov rcx, rax
call fcn.1400442e7
mov rdx, rax
mov rax, qword [0x14074d820]
mov rcx, rax
call fcn.14004398c
mov r8d, 0x70
mov edx, 0
lea rax, [0x14074d8e0]
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [0x14074d8e0], 0x70
mov rax, qword [0x14074d818]
mov rax, qword [rax]
mov qword [0x14074d8f8], rax
mov rax, qword [0x14074d820]
mov rax, qword [rax]
mov qword [0x14074d900], rax
mov dword [0x14074d8e4], 0x400
mov dword [0x14074d910], 0
lea rax, [0x14074d8e0]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
setne al
test al, al
jne 0x14006caed
mov rax, qword [0x14074d810]
mov eax, dword [rax + 8]
test eax, eax
je 0x14006c8a6
mov rbx, qword [0x14074d810]
lea rax, [0x1401a1f66]
mov rcx, rax
call fcn.1400434d7
mov rdx, rbx
mov rcx, rax
call fcn.1400442e7
mov rdx, rax
mov rax, qword [0x14074d810]
mov rcx, rax
call fcn.14004398c
mov rdx, qword [0x14074d810]
mov rax, qword [0x14074d808]
mov rcx, rax
call fcn.1400442e7
mov rdx, rax
mov rax, qword [0x14074d7f8]
mov rcx, rax
call fcn.14004398c
mov rbx, qword [0x14074d7f8]
lea rax, [0x1401a2319]
mov rcx, rax
call fcn.1400434d7
mov rdx, rbx
mov rcx, rax
call fcn.1400442e7
mov rdx, rax
mov rax, qword [0x14074d7f8]
mov rcx, rax
call fcn.14004398c
mov edx, 1
lea rax, [0x1401a1c64]
mov rcx, rax
call fcn.140043595
mov rdx, rax
mov rax, qword [0x14074d7f8]
mov rcx, rax
call fcn.1400442e7
mov rdx, rax
mov rax, qword [0x14074d7f8]
mov rcx, rax
call fcn.14004398c
mov r8d, 0x70
mov edx, 0
lea rax, [0x14074d8e0]
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [0x14074d8e0], 0x70
lea rax, [0x1401747f0]
mov qword [0x14074d8f8], rax
mov rax, qword [0x14074d7f8]
mov rax, qword [rax]
mov qword [0x14074d900], rax
mov dword [0x14074d8e4], 0x400
mov dword [0x14074d910], 0
lea rax, [0x14074d8e0]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
setne al
test al, al
jmp 0x14006caf1
lea rax, str.command.com__c
mov rcx, rax
call fcn.1400434d7
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov rdx, rax
call fcn.1400442e7
mov rdx, rax
mov rax, qword [0x14074d7f8]
mov rcx, rax
call fcn.14004398c
mov edx, 1
lea rax, [0x1401a1c64]
mov rcx, rax
call fcn.140043595
mov rdx, rax
mov rax, qword [0x14074d7f8]
mov rcx, rax
call fcn.1400442e7
mov rdx, rax
mov rax, qword [0x14074d7f8]
mov rcx, rax
call fcn.14004398c
mov r8d, 0x68
mov edx, 0
lea rax, [0x14074d840]
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [0x14074d840], 0x68
mov r8d, 0x18
mov edx, 0
lea rax, [0x14074d8b0]
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [0x14074d7f8]
mov rax, qword [rax]
lea rdx, [0x14074d8b0]
mov qword [rsp + 0x48], rdx
lea rdx, [0x14074d840]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
setne al
test al, al
je 0x14006caf0
mov rax, qword [0x14074d8b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [0x14074d8b8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x14006caf1
nop
jmp 0x14006caf1
nop
jmp 0x14006caf1
nop
jmp 0x14006caf1
nop
add rsp, 0x58
pop rbx
pop rbp
ret