Function at 0x14001a030
Capabilities:
Create process on windows
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x14002b028]
xor rax, rsp
mov qword [rbp + 0x10], rax
xor r12d, r12d
mov rcx, qword [0x14002b178]
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
sub rax, rcx
cmp rax, 9
jb 0x14001a4b2
lea rax, [0x14002b168]
cmp qword [0x14002b180], 0x10
cmovae rax, qword [0x14002b168]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rsp + 0x70]
call fcn.14000e880
nop
lea r8d, [r12 + 0x35]
lea rdx, [0x140023cc8]
lea rcx, [rsp + 0x70]
call fcn.14000cea0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x14001a136
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a131
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a131
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
lea r14, [rbp - 0x10]
mov rsi, qword [rbp - 0x10]
mov r15, qword [rbp + 8]
cmp r15, 0x10
cmovae r14, rsi
mov rdi, qword [rbp]
cmp rdi, rbx
ja 0x14001a4b8
mov qword [rsp + 0x60], 0xf
cmp rdi, 0x10
jae 0x14001a1a7
mov qword [rsp + 0x58], rdi
mov r8d, 0x10
mov rdx, r14
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memmove
jmp 0x14001a23c
mov rax, rdi
or rax, 0xf
cmp rax, rbx
ja 0x14001a1c2
mov rbx, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rbx, rcx
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x14001a20f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001a4ac
mov rcx, rax
call fcn.14001e2a0
mov rcx, rax
test rax, rax
je 0x14001a208
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001a21e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14001a21b
call fcn.14001e2a0
jmp 0x14001a21e
mov rax, r12
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x48]
call fcn.140001ee0
mov rdi, rax
lea rdx, [0x140024430]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
lea rdx, [0x14002b108]
cmp qword [0x14002b120], 0x10
cmovae rdx, qword [0x14002b108]
mov r8, qword [0x14002b118]
mov rcx, rax
call fcn.14000e9c0
lea rdx, [0x140024430]
mov rcx, rax
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rdx, str.Shell
lea rcx, [rbp - 0x70]
call fcn.140001310
mov rbx, rax
lea rdx, str.HKCUSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
lea rcx, [rbp - 0x50]
call fcn.140001310
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.1400080b0
nop
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rcx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
cmp r8, 3
jne 0x14001a3bb
lea rdx, [0x14002284c]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001a3bb
lea rcx, [0x14002b0a8]
cmp qword [0x14002b0c0], 0x10
cmovae rcx, qword [0x14002b0a8]
mov r8, qword [0x14002b0b8]
cmp r8, 2
jne 0x14001a3bb
lea rdx, [0x140022a44]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001a3bb
lea rcx, [0x14002b128]
cmp qword [0x14002b140], 0x10
cmovae rcx, qword [0x14002b128]
mov r8, qword [0x14002b138]
cmp r8, 6
jne 0x14001a3bb
lea rdx, str.NORMAL
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001a3bb
lea rcx, [0x14002b088]
cmp qword [0x14002b0a0], 0x10
cmovae rcx, qword [0x14002b088]
mov r8, qword [0x14002b098]
cmp r8, 0x1e
jne 0x14001a3ae
lea rdx, [0x140023e48]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001a3bb
lea rcx, str.shutdown__r__t_0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rdi
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [0x14002b0c8]
lea rcx, [rsp + 0x70]
call fcn.14000c820
mov rcx, rax
call fcn.140003a00
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14001a435
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a430
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a430
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
cmp r15, 0x10
jb 0x14001a47f
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14001a477
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a477
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14001e2dc
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.14001e280
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400011e0
nop
call fcn.140001280
nop
call fcn.140001280
int3