Function at 0x140026900
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rdi, rdx
mov rsi, rcx
mov edx, dword [rcx]
vmovaps xmmword [rsp + 0x40], xmm6
vmovaps xmmword [rsp + 0x30], xmm7
sub edx, 1
je 0x140026af9
sub edx, 1
je 0x140026a96
sub edx, 1
je 0x140026a2c
sub edx, 1
je 0x1400269c2
cmp edx, 1
jne 0x140026b73
mov r15, qword [0x141443c60]
lea rcx, [0x1413a5c88]
xor edx, edx
mov rbx, qword [r15 + 0x4150]
movsxd rax, dword [rbx + 0x130]
mov r8, qword [rbx + 0x138]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.1401e1830
mov rcx, qword [rbx]
mov r14d, eax
cmp dword [rcx + 0x419c], eax
jne 0x1400269a8
lea r8, [0x1413a5c88]
mov edx, 0xb
mov ecx, eax
call fcn.14020a960
test byte [r15 + 0x627c], 4
je 0x140026b69
lea rdx, [0x1413a5c88]
jmp 0x140026b5a
mov r15, qword [0x141443c60]
lea rcx, [0x1413a5c70]
xor edx, edx
mov rbx, qword [r15 + 0x4150]
movsxd rax, dword [rbx + 0x130]
mov r8, qword [rbx + 0x138]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.1401e1830
mov rcx, qword [rbx]
mov r14d, eax
cmp dword [rcx + 0x419c], eax
jne 0x140026a12
lea r8, [0x1413a5c70]
mov edx, 0xb
mov ecx, eax
call fcn.14020a960
test byte [r15 + 0x627c], 4
je 0x140026b69
lea rdx, [0x1413a5c70]
jmp 0x140026b5a
mov r15, qword [0x141443c60]
lea rcx, [0x1413a5c50]
xor edx, edx
mov rbx, qword [r15 + 0x4150]
movsxd rax, dword [rbx + 0x130]
mov r8, qword [rbx + 0x138]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.1401e1830
mov rcx, qword [rbx]
mov r14d, eax
cmp dword [rcx + 0x419c], eax
jne 0x140026a7c
lea r8, [0x1413a5c50]
mov edx, 0xb
mov ecx, eax
call fcn.14020a960
test byte [r15 + 0x627c], 4
je 0x140026b69
lea rdx, [0x1413a5c50]
jmp 0x140026b5a
mov r15, qword [0x141443c60]
lea rcx, [0x1413a5c40]
xor edx, edx
mov rbx, qword [r15 + 0x4150]
movsxd rax, dword [rbx + 0x130]
mov r8, qword [rbx + 0x138]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.1401e1830
mov rcx, qword [rbx]
mov r14d, eax
cmp dword [rcx + 0x419c], eax
jne 0x140026ae6
lea r8, [0x1413a5c40]
mov edx, 0xb
mov ecx, eax
call fcn.14020a960
test byte [r15 + 0x627c], 4
je 0x140026b69
lea rdx, [0x1413a5c40]
jmp 0x140026b5a
mov r15, qword [0x141443c60]
lea rcx, [0x1413a5c30]
xor edx, edx
mov rbx, qword [r15 + 0x4150]
movsxd rax, dword [rbx + 0x130]
mov r8, qword [rbx + 0x138]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.1401e1830
mov rcx, qword [rbx]
mov r14d, eax
cmp dword [rcx + 0x419c], eax
jne 0x140026b49
lea r8, [0x1413a5c30]
mov edx, 0xb
mov ecx, eax
call fcn.14020a960
test byte [r15 + 0x627c], 4
je 0x140026b69
lea rdx, [0x1413a5c30]
mov r8d, r14d
lea rcx, [0x1413cf570]
call fcn.14020a550
xor edx, edx
mov ecx, r14d
call fcn.1401f8130
xor edx, edx
lea rcx, [0x1413a5c30]
call fcn.1401f8810
vmovss xmm7, dword [0x14140e870]
xor r15d, r15d
vxorps xmm6, xmm6, xmm6
test al, al
je 0x140026c84
mov rbx, qword [0x141443c60]
mov rcx, rdi
mov qword [rbp + 0x20], rcx
mov r14, rdi
test rdi, rdi
jne 0x140026bc9
mov rcx, qword [rbx + 0x48]
test rcx, rcx
jne 0x140026bc2
mov rax, qword [rbx + 0x38]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx]
mov qword [rbp + 0x20], rcx
mov r14, rcx
call fcn.1401f2850
lea rdx, [rbp + 0x20]
lea rcx, [rbx + 0x4c20]
call fcn.1401de7f0
mov rdx, qword [r14 + 0x40]
mov rcx, qword [rbx + 0x4150]
mov rdx, qword [rdx + 8]
mov rcx, qword [rcx + 0x2e0]
call fcn.1401d6670
lea rcx, [0x1413a2c9c]
call fcn.140011460
call fcn.1401f2900
lea rcx, [0x1413a5ca0]
call fcn.1402165c0
mov rax, qword [0x141443c60]
mov r8, qword [rax + 0x4150]
cmp byte [r8 + 0xf8], r15b
jne 0x140026c56
mov edx, dword [r8 + 0x1f4]
mov eax, edx
neg eax
sbb ecx, ecx
add ecx, 2
cmp qword [r8 + 0x1e8], r15
je 0x140026c4d
neg edx
sbb ecx, ecx
add ecx, 6
vmovaps xmm1, xmm7
call fcn.14021a1b0
xor r8d, r8d
lea rdx, [rbp + 0x20]
lea rcx, [0x1413a5cd8]
vmovss dword [rbp + 0x20], xmm6
vmovss dword [rbp + 0x24], xmm6
call fcn.140217480
test al, al
je 0x140026c7f
call fcn.1401f85c0
mov dword [rsi], r15d
call fcn.1401f8990
xor edx, edx
lea rcx, [0x1413a5c40]
call fcn.1401f8810
test al, al
je 0x140026d86
mov rbx, qword [0x141443c60]
mov rcx, rdi
mov qword [rbp + 0x20], rcx
mov r14, rdi
test rdi, rdi
jne 0x140026ccb
mov rcx, qword [rbx + 0x48]
test rcx, rcx
jne 0x140026cc4
mov rax, qword [rbx + 0x38]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx]
mov qword [rbp + 0x20], rcx
mov r14, rcx
call fcn.1401f2850
lea rdx, [rbp + 0x20]
lea rcx, [rbx + 0x4c20]
call fcn.1401de7f0
mov rdx, qword [r14 + 0x40]
mov rcx, qword [rbx + 0x4150]
mov rdx, qword [rdx + 8]
mov rcx, qword [rcx + 0x2e0]
call fcn.1401d6670
lea rcx, [0x1413a2c9c]
call fcn.140011460
call fcn.1401f2900
lea rcx, [0x1413a5ce0]
call fcn.1402165c0
mov rax, qword [0x141443c60]
mov r8, qword [rax + 0x4150]
cmp byte [r8 + 0xf8], r15b
jne 0x140026d58
mov edx, dword [r8 + 0x1f4]
mov eax, edx
neg eax
sbb ecx, ecx
add ecx, 2
cmp qword [r8 + 0x1e8], r15
je 0x140026d4f
neg edx
sbb ecx, ecx
add ecx, 6
vmovaps xmm1, xmm7
call fcn.14021a1b0
xor r8d, r8d
lea rdx, [rbp + 0x20]
lea rcx, [0x1413a5d1c]
vmovss dword [rbp + 0x20], xmm6
vmovss dword [rbp + 0x24], xmm6
call fcn.140217480
test al, al
je 0x140026d81
call fcn.1401f85c0
mov dword [rsi], r15d
call fcn.1401f8990
xor edx, edx
lea rcx, [0x1413a5c50]
call fcn.1401f8810
test al, al
je 0x140026ef3
mov rbx, qword [0x141443c60]
mov rcx, rdi
mov qword [rbp + 0x20], rcx
mov r14, rdi
test rdi, rdi
jne 0x140026dcd
mov rcx, qword [rbx + 0x48]
test rcx, rcx
jne 0x140026dc6
mov rax, qword [rbx + 0x38]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx]
mov qword [rbp + 0x20], rcx
mov r14, rcx
call fcn.1401f2850
lea rdx, [rbp + 0x20]
lea rcx, [rbx + 0x4c20]
call fcn.1401de7f0
mov rdx, qword [r14 + 0x40]
mov rcx, qword [rbx + 0x4150]
mov rdx, qword [rdx + 8]
mov rcx, qword [rcx + 0x2e0]
call fcn.1401d6670
lea rcx, [0x1413a5d20]
call fcn.140011460
call fcn.1401f2900
mov edx, dword [rsi + 4]
lea rcx, [0x1413a5d30]
mov eax, edx
movzx r9d, dl
sar eax, 8
movzx r8d, al
sar edx, 0x10
call fcn.1402165c0
mov rax, qword [0x141443c60]
mov r8, qword [rax + 0x4150]
cmp byte [r8 + 0xf8], r15b
jne 0x140026e6d
mov edx, dword [r8 + 0x1f4]
mov eax, edx
neg eax
sbb ecx, ecx
add ecx, 2
cmp qword [r8 + 0x1e8], r15
je 0x140026e64
neg edx
sbb ecx, ecx
add ecx, 6
vmovaps xmm1, xmm7
call fcn.14021a1b0
xor r8d, r8d
lea rdx, [rbp + 0x20]
lea rcx, [0x1413a5da0]
vmovss dword [rbp + 0x20], xmm6
vmovss dword [rbp + 0x24], xmm6
call fcn.140217480
test al, al
je 0x140026eb4
mov dword [rsp + 0x28], r15d
lea r8, [0x1413a26d0]
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.1401f85c0
mov dword [rsi], r15d
vmovss xmm1, dword [0x14140ebbc]
vxorps xmm0, xmm0, xmm0
call fcn.1401f6d00
lea rcx, [0x1413a5db8]
xor r8d, r8d
lea rdx, [rbp + 0x20]
vmovss dword [rbp + 0x20], xmm6
vmovss dword [rbp + 0x24], xmm6
call fcn.140217480
test al, al
je 0x140026eee
call fcn.1401f85c0
mov dword [rsi], r15d
call fcn.1401f8990
xor edx, edx
lea rcx, [0x1413a5c70]
call fcn.1401f8810
test al, al
je 0x140027008
mov rbx, qword [0x141443c60]
mov rcx, rdi
mov qword [rbp + 0x20], rcx
mov r14, rdi
test rdi, rdi
jne 0x140026f3a
mov rcx, qword [rbx + 0x48]
test rcx, rcx
jne 0x140026f33
mov rax, qword [rbx + 0x38]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx]
mov qword [rbp + 0x20], rcx
mov r14, rcx
call fcn.1401f2850
lea rdx, [rbp + 0x20]
lea rcx, [rbx + 0x4c20]
call fcn.1401de7f0
mov rdx, qword [r14 + 0x40]
mov rcx, qword [rbx + 0x4150]
mov rdx, qword [rdx + 8]
mov rcx, qword [rcx + 0x2e0]
call fcn.1401d6670
lea rcx, [0x1413a5dc4]
call fcn.140011460
call fcn.1401f2900
mov edx, dword [rsi + 4]
lea rcx, [0x1413a5dd0]
mov eax, edx
movzx r9d, dl
sar eax, 8
movzx r8d, al
sar edx, 0x10
call fcn.1402165c0
mov rax, qword [0x141443c60]
mov r8, qword [rax + 0x4150]
cmp byte [r8 + 0xf8], r15b
jne 0x140026fda
mov edx, dword [r8 + 0x1f4]
mov eax, edx
neg eax
sbb ecx, ecx
add ecx, 2
cmp qword [r8 + 0x1e8], r15
je 0x140026fd1
neg edx
sbb ecx, ecx
add ecx, 6
vmovaps xmm1, xmm7
call fcn.14021a1b0
xor r8d, r8d
lea rdx, [rbp + 0x20]
lea rcx, [0x1413a5e88]
vmovss dword [rbp + 0x20], xmm6
vmovss dword [rbp + 0x24], xmm6
call fcn.140217480
test al, al
je 0x140027003
call fcn.1401f85c0
mov dword [rsi], r15d
call fcn.1401f8990
xor edx, edx
lea rcx, [0x1413a5c88]
call fcn.1401f8810
test al, al
je 0x14002716d
mov rbx, qword [0x141443c60]
mov r14, rdi
mov qword [rbp + 0x20], rdi
test rdi, rdi
jne 0x14002704c
mov rdi, qword [rbx + 0x48]
test rdi, rdi
jne 0x140027045
mov rax, qword [rbx + 0x38]
mov rcx, qword [rax + 0x60]
mov rdi, qword [rcx]
mov qword [rbp + 0x20], rdi
mov r14, rdi
mov rcx, rdi
call fcn.1401f2850
lea rdx, [rbp + 0x20]
lea rcx, [rbx + 0x4c20]
call fcn.1401de7f0
mov rdx, qword [r14 + 0x40]
mov rcx, qword [rbx + 0x4150]
mov rdx, qword [rdx + 8]
mov rcx, qword [rcx + 0x2e0]
call fcn.1401d6670
lea rcx, [0x1413a5ea0]
call fcn.140011460
call fcn.1401f2900
xor edx, edx
lea rcx, [0x1413a5ea8]
mov r8d, 1
call fcn.140215e20
mov rcx, qword [0x141443c60]
mov rax, qword [rcx + 0x4150]
mov byte [rax + 0xf5], 1
mov rax, qword [rcx + 0x4150]
cmp byte [rax + 0xf8], r15b
jne 0x1400270e4
vmovss xmm1, dword [0x14140ebbc]
lea rcx, [rbp + 0x20]
vmovss dword [rbp + 0x20], xmm6
vmovss dword [rbp + 0x24], xmm6
call fcn.1401f6b70
cmp qword [rsi + 0x20], 0xf
lea rcx, [rsi + 8]
jbe 0x1400270f2
mov rcx, qword [rcx]
xor edx, edx
mov r8d, 1
call fcn.140215e20
mov rax, qword [0x141443c60]
mov r8, qword [rax + 0x4150]
cmp byte [r8 + 0xf8], r15b
jne 0x14002713f
mov edx, dword [r8 + 0x1f4]
mov eax, edx
neg eax
sbb ecx, ecx
add ecx, 2
cmp qword [r8 + 0x1e8], r15
je 0x140027136
neg edx
sbb ecx, ecx
add ecx, 6
vmovaps xmm1, xmm7
call fcn.14021a1b0
xor r8d, r8d
lea rdx, [rbp + 0x20]
lea rcx, [0x1413a5d1c]
vmovss dword [rbp + 0x20], xmm6
vmovss dword [rbp + 0x24], xmm6
call fcn.140217480
test al, al
je 0x140027168
call fcn.1401f85c0
mov dword [rsi], r15d
call fcn.1401f8990
vmovaps xmm6, xmmword [rsp + 0x40]
vmovaps xmm7, xmmword [rsp + 0x30]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret