Function at 0x14004a360
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rbx, rcx
xor edx, edx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], rax
mov dword [rbp - 0x49], 0x68
mov dword [rbp - 0xd], 1
mov word [rbp - 9], dx
movups xmmword [rbp - 0x69], xmm0
mov qword [rbp - 0x59], rax
mov r13, qword [rcx + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 7
jb 0x14004a68e
mov qword [rbp + 0x6f], rbx
lea r14, [rbx + 0x18]
cmp qword [rbx + 0x18], 0xf
jbe 0x14004a3f5
mov rax, qword [rbx]
mov qword [rbp + 0x6f], rax
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x79], xmm1
lea r12, [r13 + 7]
mov edi, reloc.WS2_32.dll_ntohs
lea rsi, [rsp + 0x50]
cmp r12, rdi
jbe 0x14004a494
mov rdi, r12
or rdi, 0xf
cmp rdi, rcx
jbe 0x14004a451
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400e70bc
test rax, rax
je 0x14004a606
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14004a48b
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x14004a46b
mov rsi, rdx
jmp 0x14004a48b
cmp rcx, 0x1000
jb 0x14004a483
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004a694
jmp 0x14004a432
call fcn.1400e70bc
mov rsi, rax
mov qword [rsp + 0x50], rsi
lea r14, [rbx + 0x18]
mov qword [rbp - 0x79], r12
mov qword [rbp - 0x71], rdi
mov rcx, qword [str.cmd__c]
mov dword [rsi], ecx
movzx eax, word [0x14010ecbc]
mov word [rsi + 4], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_32]
mov byte [rsi + 6], al
lea rcx, [rsi + 7]
mov r8, r13
mov rdx, qword [rbp + 0x6f]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r12], 0
lea rdx, [rsp + 0x50]
cmp qword [rbp - 0x71], 0xf
cmova rdx, qword [rsp + 0x50]
lea rax, [rbp - 0x69]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x40], rax
xor edi, edi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14004a5b0
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x14004a557
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a552
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a606
call fcn.1400e7410
movdqa xmm0, xmmword [0x1401114b0]
movdqu xmmword [rbp - 0x79], xmm0
mov byte [rsp + 0x50], dil
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14004a5a3
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14004a59e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004a687
mov rcx, r8
call fcn.1400e7410
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
jmp 0x14004a665
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp - 0x71]
cmp rdx, 0xf
jbe 0x14004a616
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a60d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a60d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e7410
lea r14, [rbx + 0x18]
movdqa xmm0, xmmword [0x1401114b0]
movdqu xmmword [rbp - 0x79], xmm0
mov byte [rsp + 0x50], dil
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14004a65e
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14004a659
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004a687
mov rcx, r8
call fcn.1400e7410
mov qword [r14], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x150]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140036220
nop
call fcn.140003850
int3