Function at 0x140059700
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0x248
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov qword [r11 + 0x10], rbx
mov rbx, rcx
mov qword [r11 - 8], rdi
call fcn.140053680
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x24c]
mov byte [rcx + 0x4b3], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x24d]
mov byte [rcx + 0x4b4], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x24e]
mov byte [rcx + 0x4b5], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x24f]
mov byte [rcx + 0x4b6], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x250]
mov byte [rcx + 0x4b7], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x251]
mov byte [rcx + 0x4b8], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x252]
mov byte [rcx + 0x4b9], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x253]
mov byte [rcx + 0x4ba], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x254]
mov byte [rcx + 0x4bb], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x255]
mov byte [rcx + 0x4bc], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x256]
mov byte [rcx + 0x4bd], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x257]
mov byte [rcx + 0x4be], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x258]
mov byte [rcx + 0x4bf], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x259]
mov byte [rcx + 0x4c0], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x25a]
mov byte [rcx + 0x4c1], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x25b]
mov byte [rcx + 0x4c2], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x25c]
mov byte [rcx + 0x4c3], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x25d]
mov byte [rcx + 0x4c4], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x25e]
mov byte [rcx + 0x4c5], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x25f]
mov byte [rcx + 0x4c6], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x260]
mov byte [rcx + 0x4c7], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x261]
mov byte [rcx + 0x4c8], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x262]
mov byte [rcx + 0x4c9], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x263]
mov byte [rcx + 0x4ca], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x264]
mov byte [rcx + 0x4cb], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x265]
mov byte [rcx + 0x4cc], al
xor edi, edi
movzx eax, byte [rbx + 0x266]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x4cd], al
movzx eax, byte [rbx + 0x267]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x4ce], al
movzx eax, byte [rbx + 0x268]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x4cf], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x269]
mov byte [rcx + 0x4d0], al
mov rcx, qword [rbx + 0x5b0]
mov rax, qword [rcx + 0x330]
mov qword [rcx + 0x338], rax
mov rdx, qword [rbx + 0x270]
mov rax, qword [rbx + 0x278]
sub rax, rdx
sar rax, 2
test rax, rax
je 0x140059a18
mov qword [rsp + 0x260], rsi
mov esi, edi
nop
mov rcx, qword [rbx + 0x5b0]
lea r8, [rsi + rdx]
add rcx, 0x330
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x1400599e8
mov eax, dword [r8]
mov dword [rdx], eax
add qword [rcx + 8], 4
jmp 0x1400599ed
call fcn.14002e690
mov rdx, qword [rbx + 0x270]
inc edi
mov rcx, qword [rbx + 0x278]
add rsi, 4
sub rcx, rdx
movsxd rax, edi
sar rcx, 2
cmp rax, rcx
jb 0x1400599c0
mov rsi, qword [rsp + 0x260]
movzx eax, byte [rbx + 0x288]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x327], al
movzx eax, byte [rbx + 0x23c]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x7f5], al
movzx eax, byte [rbx + 0x10]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x6d0], al
movzx eax, byte [rbx + 0x23d]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x6d1], al
movzx eax, byte [rbx + 0x23e]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x6d2], al
movzx eax, byte [rbx + 0x23f]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x6d3], al
movzx eax, byte [rbx + 0x240]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x6d4], al
movzx eax, byte [rbx + 0x241]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x6d5], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x242]
mov byte [rcx + 0x6d6], al
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x244]
mov dword [rcx + 0x6d8], eax
mov eax, dword [rbx + 0x248]
mov rcx, qword [rbx + 0x5b0]
mov dword [rcx + 0x6dc], eax
movzx eax, byte [rbx + 0x289]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x348], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x28a]
mov byte [rcx + 0x357], al
mov eax, dword [rbx + 0x28c]
mov rcx, qword [rbx + 0x5b0]
mov dword [rcx + 0x328], eax
movzx eax, byte [rbx + 0x290]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x354], al
movzx eax, byte [rbx + 0x291]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x97d], al
movzx eax, byte [rbx + 0x238]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x31e], al
movzx eax, byte [rbx + 0x292]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x325], al
movzx eax, byte [rbx + 0x239]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x361], al
movzx eax, byte [rbx + 0x23a]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x362], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x23b]
mov byte [rcx + 0x363], al
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x298]
mov dword [rcx + 0x364], eax
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x29c]
mov dword [rcx + 0x368], eax
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x294]
mov dword [rcx + 0x380], eax
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x2a0]
mov dword [rcx + 0x384], eax
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x2a4]
mov dword [rcx + 0x7f0], eax
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x2a8]
mov dword [rcx + 0x7f8], eax
mov eax, dword [rbx + 0x2ac]
lea r8, [rbx + 0x2d7]
mov rcx, qword [rbx + 0x5b0]
mov edx, 0x104
mov dword [rcx + 0xc], eax
movzx eax, byte [rbx + 0x2b0]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x398], al
movzx eax, byte [rbx + 0x2b1]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x399], al
movzx eax, byte [rbx + 0x2b2]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x36c], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x2b8]
mov byte [rcx + 0x374], al
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x2b4]
mov dword [rcx + 0x370], eax
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x2bc]
mov dword [rcx + 0x378], eax
mov eax, dword [rbx + 0x2c0]
mov rcx, qword [rbx + 0x5b0]
mov dword [rcx + 0x35c], eax
movzx eax, byte [rbx + 0x2c5]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x37c], al
movzx eax, byte [rbx + 0x2cc]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x37d], al
movzx eax, byte [rbx + 0x2cd]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x349], al
movzx eax, byte [rbx + 0x2ce]
mov rcx, qword [rbx + 0x5b0]
mov byte [rcx + 0x34a], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x2cf]
mov byte [rcx + 0x34b], al
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x2c8]
mov dword [rcx + 0x214], eax
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x2d0]
mov byte [rcx + 0x807], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x2d1]
mov byte [rcx + 0x321], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x2d5]
mov byte [rcx + 0x324], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x2d2]
mov byte [rcx + 0x322], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x2d3]
mov byte [rcx + 0x323], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x2d4]
mov byte [rcx + 0x326], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x2d6]
mov byte [rcx + 0x39a], al
mov rcx, qword [rbx + 0x5b0]
add rcx, 0x39b
call fcn.14012524c
mov rcx, qword [rbx + 0x5b0]
lea r8, [rbx + 0x3dd]
movzx eax, byte [rbx + 0x3dc]
mov edx, 0x104
mov byte [rcx + 8], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x3db]
mov byte [rcx + 0x49f], al
mov rcx, qword [rbx + 0x5b0]
add rcx, 0x809
call fcn.14012524c
mov rcx, qword [rbx + 0x5b0]
lea r8, [rbx + 0x4e1]
add rcx, 0x90d
mov edx, 0x38
call fcn.14012524c
mov rcx, qword [rbx + 0x5b0]
lea r8, [rbx + 0x519]
add rcx, 0x945
mov edx, 0x38
call fcn.14012524c
cmp byte [0x1401ba761], 0
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x551]
mov rdi, qword [rsp + 0x240]
mov byte [rcx + 0x360], al
mov rcx, qword [rbx + 0x5b0]
mov eax, dword [rbx + 0x554]
mov dword [rcx + 0x7fc], eax
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x558]
mov byte [rcx + 0x804], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x559]
mov byte [rcx + 0x805], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x55a]
mov byte [rcx + 0x806], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x55b]
mov byte [rcx + 0x31c], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x55c]
mov byte [rcx + 0x31d], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x55d]
mov byte [rcx + 0x31f], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x55e]
mov byte [rcx + 0x320], al
mov rcx, qword [rbx + 0x5b0]
movzx eax, byte [rbx + 0x2c4]
mov byte [rcx + 0x808], al
mov rbx, qword [rbx + 0x208]
jne 0x140059f6f
lea r8, str.Saving_connection_info_n
mov edx, 2
lea rcx, vtable.Log.0
call fcn.1400155a0
mov rcx, qword [rbx + 0xd748]
lea rdx, [rcx + 0x97e]
call fcn.140063c10
mov r8d, 0xff
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rbx, qword [rsp + 0x258]
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140059f96
test rax, rax
je 0x140059fbe
cmp byte [rsp + rax + 0x30], 0x5c
je 0x140059fbe
cmp rax, 0xff
jae 0x14005a00f
mov byte [rsp + rax + 0x30], 0
sub rax, 1
jne 0x140059fa4
mov r8d, 0xff
lea rdx, [rsp + 0x130]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 5
lea r9, str._listen
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x130]
xor ecx, ecx
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 1
call fcn.140131c94
int3
call fcn.14011c4dc
int3