Function at 0x1401370c0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x188]
sub rsp, 0x260
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov r12, r8
mov r15, rdx
xor edx, edx
mov r8d, VarUI4FromDisp
lea rcx, [rbp + 0x44]
call fcn.1402dd440
mov dword [rbp + 0x40], VarUI4FromDisp
lea rcx, [rbp + 0x40]
call fcn.140135c30
test al, al
je 0x140137158
cmp dword [rbp + 0x44], 5
jne 0x140137158
cmp dword [rbp + 0x48], 1
jb 0x140137158
mov dword [rsp + 0x28], 5
lea rsi, [0x1403ff228]
mov qword [rsp + 0x20], rsi
mov r9, r12
mov r8, r15
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
setg al
jmp 0x1401374da
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x1401374d8
xor ebx, ebx
mov qword [rsp + 0x40], rbx
lea rdx, [rsp + 0x40]
call fcn.140136ed0
test eax, eax
js 0x1401374c1
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1401374c1
mov qword [rbp + 0x1a8], rbx
mov qword [rsp + 0x30], rbx
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
lea r8, [0x14040b150]
xor edx, edx
call qword [rax + 0x78]
mov edi, eax
test eax, eax
js 0x14013724f
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140137254
mov qword [rsp + 0x38], rbx
mov rax, qword [rcx]
lea r8, [rsp + 0x38]
lea rdx, [0x14040b2b8]
call qword [rax]
mov edi, eax
test eax, eax
js 0x14013723f
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140137244
mov qword [rbp + 0x190], rbx
mov rax, qword [rcx]
lea rdx, [rbp + 0x190]
call qword [rax + gethostname]
mov edi, eax
mov rcx, qword [rbp + 0x190]
test eax, eax
js 0x140137234
test rcx, rcx
je 0x140137234
mov rax, qword [rcx]
lea r8, [rbp + 0x1a8]
lea rdx, [0x14040b0f0]
call qword [rax]
mov edi, eax
mov rcx, qword [rbp + 0x190]
test rcx, rcx
je 0x14013723f
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14013724f
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14013725f
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x1a8]
test edi, edi
js 0x1401374b6
test rcx, rcx
je 0x1401374b6
lea rsi, [0x1403ff228]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r14, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140137517
test r15, r15
jne 0x140137449
mov rdi, rbx
mov qword [rbp + 0x190], rbx
test r12, r12
jne 0x14013746a
mov qword [rsp + 0x30], rbx
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1401374f6
test rdi, rdi
je 0x140137489
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov r15d, 8
mov word [rsp + 0x60], r15w
mov qword [rsp + 0x68], r14
lea rcx, [rbp - 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov word [rbp - 0x70], r15w
mov qword [rbp - 0x68], rbx
lea rcx, [rsp + 0x78]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov word [rsp + 0x78], r15w
mov qword [rbp - 0x80], rsi
lea rcx, [rsp + 0x48]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, 3
mov word [rsp + 0x48], ax
mov dword [rsp + 0x50], 5
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rbp - 0x40], xmm0
movsd xmm1, qword [rsp + 0x58]
movsd qword [rbp - 0x30], xmm1
movups xmm0, xmmword [rsp + 0x60]
movaps xmmword [rbp - 0x20], xmm0
movsd xmm1, qword [rsp + 0x70]
movsd qword [rbp - 0x10], xmm1
movups xmm0, xmmword [rsp + 0x78]
movaps xmmword [rbp], xmm0
movsd xmm1, qword [rbp - 0x78]
movsd qword [rbp + 0x10], xmm1
movups xmm0, xmmword [rbp - 0x70]
movaps xmmword [rbp + 0x20], xmm0
movsd xmm1, qword [rbp - 0x60]
movsd qword [rbp + 0x30], xmm1
mov rcx, qword [rbp + 0x1a8]
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], rdx
lea r9, [rbp]
lea r8, [rbp + 0x20]
mov rdx, rdi
call qword [rax + 0xf8]
test eax, eax
setns r15b
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rbp + 0x1a8]
test rcx, rcx
je 0x140137430
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140137440
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
movzx eax, r15b
jmp 0x1401374da
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rbp + 0x190], rax
test rax, rax
je 0x140137501
jmp 0x1401372ab
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14013750c
jmp 0x1401372b9
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x1a8]
test rcx, rcx
je 0x1401374c1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1401374d8
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
xor al, al
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140080080
nop
mov ecx, 0x8007000e
call fcn.140080080
nop
mov ecx, 0x8007000e
call fcn.140080080
nop
mov ecx, 0x8007000e
call fcn.140080080
int3