Function at 0x14004a9e0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x2e8]
sub rsp, 0x3c0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
movzx r12d, dl
mov r15, rcx
xor edx, edx
mov r8d, 0x88
lea rcx, [rbp - 0x80]
call fcn.1401afc90
mov rcx, qword [r15 + 0x6c0]
mov rax, qword [rcx]
lea rdx, [rbp - 0x80]
call qword [rax + 0x58]
nop
xor edx, edx
mov r8d, 0x88
lea rcx, [rbp + 0x10]
call fcn.1401afc90
mov r8d, 4
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x80]
call fcn.1400e02f0
nop
lea rcx, [rbp + 0x10]
call fcn.1400592e0
mov rcx, rax
lea rdx, str.http
call qword [sym.imp.SHLWAPI.dll_StrCmpICW]
test eax, eax
jne 0x14004aabc
lea rcx, [rbp - 0x80]
call fcn.1400592e0
mov r8, rax
mov dword [rsp + 0x28], 1
xor r14d, r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, [0x1401f56e0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov bl, 1
jmp 0x14004b24e
lea rcx, [rbp + 0x10]
call fcn.1400592e0
mov rcx, rax
lea rdx, str.ftp:
call qword [sym.imp.SHLWAPI.dll_StrCmpICW]
test eax, eax
jne 0x14004ae35
lea rcx, [rbp - 0x80]
call fcn.1400592e0
movdqa xmm0, xmmword [0x1401f5800]
movdqu xmmword [rsp + 0x70], xmm0
xor r14d, r14d
mov word [rsp + 0x60], r14w
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], r14w
jne 0x14004ab10
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14000d810
nop
lea r8, [0x1401fdee4]
lea rdx, [0x1401f991c]
lea rcx, [rbp - 0x80]
call fcn.1400e0660
xor r8d, r8d
lea rdx, [0x1401fdee8]
lea rcx, [rbp - 0x80]
call fcn.1400dfb10
cmp eax, 3
je 0x14004ab6e
lea r8, [0x1401fdee8]
lea rdx, [0x1401fdef0]
lea rcx, [rbp - 0x80]
call fcn.1400e0660
xor r8d, r8d
lea rdx, [0x1401fdef8]
lea rcx, [rbp - 0x80]
call fcn.1400dfb10
cmp eax, 0xffffffff
je 0x14004ad14
movdqa xmm0, xmmword [0x1401f5800]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov r8d, SafeArrayDestroy
lea rdx, str.Windows
lea rcx, [rsp + 0x40]
call fcn.14000d810
nop
lea r9, [rsp + 0x60]
mov rsi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x78]
cmp r15, 8
cmovae r9, rsi
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rax, r8
sub rax, rcx
mov rdx, qword [rsp + 0x70]
cmp rdx, rax
ja 0x14004ac16
lea rdi, [rcx + rdx]
mov qword [rsp + 0x50], rdi
lea rbx, [rsp + 0x40]
cmp r8, 8
cmovae rbx, qword [rsp + 0x40]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.1401b00b0
mov word [rbx + rdi*2], r14w
jmp 0x14004ac32
mov qword [rsp + 0x20], rdx
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.14002c1a0
mov r15, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 0xc
jb 0x14004ac7d
lea rdi, [rcx + 0xc]
mov qword [rsp + 0x50], rdi
lea rbx, [rsp + 0x40]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x40]
lea rcx, [rbx + rcx*2]
mov r8d, ILCombine
lea rdx, [0x1401fdf20]
call fcn.1401b00b0
mov word [rbx + rdi*2], r14w
jmp 0x14004ac9e
mov qword [rsp + 0x20], SafeArrayDestroy
lea r9, [0x1401fdf20]
xor r8d, r8d
lea edx, [r8 + 0xc]
lea rcx, [rsp + 0x40]
call fcn.14002c1a0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov word [rsp + 0x20], r14w
mov r9d, ILIsEqual
lea r8, [0x1401f5368]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxExW]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004ad0d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ad08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004b295
call fcn.1401606e8
xor bl, bl
jmp 0x14004adf1
test r12b, r12b
je 0x14004adb1
call fcn.14000cd00
mov rbx, rax
lea rcx, [rbp - 0x80]
call fcn.1400592e0
movdqa xmm0, xmmword [0x1401f5800]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x14004ad45
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000d810
nop
mov r8, rsi
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140079370
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004adb1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004adac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004b29b
call fcn.1401606e8
lea rcx, [rbp - 0x80]
call fcn.1400592e0
mov qword [rsp + 0x40], rax
nop
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14004adc0
mov qword [rsp + 0x48], rsi
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140034d50
movzx ebx, al
mov r15, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x60]
cmp r15, 8
jb 0x14004b24e
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14004ae28
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004b2a1
mov rcx, rsi
call fcn.1401606e8
jmp 0x14004b24e
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xa0]
call fcn.1401afc90
lea rcx, [rbp - 0x80]
call fcn.1400592e0
mov rdx, rax
mov r9d, 0x104
lea r8, [rbp + 0xa0]
mov rcx, r15
call fcn.140049780
mov rdi, qword [r15 + 0x6e0]
add rdi, 0x638
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov rsi, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x14004ae8f
mov rdi, qword [rdi]
cmp rsi, 8
jae 0x14004aea4
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x40], xmm0
mov ebx, 7
jmp 0x14004aee2
mov rbx, rsi
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x40]
call fcn.14000d5b0
mov qword [rsp + 0x40], rax
lea r8, [rsi*2 + 2]
mov rdx, rdi
mov rcx, rax
call fcn.1401b00b0
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rsi
lea r8, [rsp + 0x40]
cmp rbx, 8
cmovae r8, qword [rsp + 0x40]
lea rdx, [rbp + 0xa0]
mov rcx, r15
call fcn.14004a5f0
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004af4f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004af4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004b2a7
call fcn.1401606e8
test bl, bl
jne 0x14004aab5
xor r14d, r14d
movzx eax, word [rbp + 0xa0]
test ax, ax
je 0x14004af94
mov edx, r14d
lea rcx, [rbp + 0xa0]
lea r8d, [r14 + 0x5c]
cmp ax, 0x2f
jne 0x14004af7e
mov word [rcx], r8w
inc rdx
lea rcx, [rbp + 0xa0]
lea rcx, [rcx + rdx*2]
movzx eax, word [rcx]
test ax, ax
jne 0x14004af74
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0xa0]
mov rsi, 0xffffffffffffffff
mov rax, rsi
inc rax
cmp word [rcx + rax*2], r14w
jne 0x14004afb1
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140033b00
test rax, rax
je 0x14004b0da
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x40], rax
lea rcx, [rbp + 0xa0]
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x14004b000
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
mov rcx, qword [r15 + 0x6e0]
call fcn.140095f90
test r12b, r12b
je 0x14004aab5
call fcn.14000cd00
mov rbx, rax
movdqa xmm0, xmmword [0x1401f5800]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r14w
lea rax, [rbp + 0xa0]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], r14w
jne 0x14004b060
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x60]
call fcn.14000d810
nop
mov r8, rsi
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140079370
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14004aab5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b0ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004b2ad
call fcn.1401606e8
mov bl, 1
jmp 0x14004b24e
movdqa xmm0, xmmword [0x1401f5800]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov r8d, SafeArrayDestroy
lea rdx, str.Windows
lea rcx, [rsp + 0x40]
call fcn.14000d810
nop
lea rcx, [rbp - 0x80]
call fcn.1400592e0
mov r9, rax
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14004b112
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x14004b160
lea rdi, [rcx + rsi]
mov qword [rsp + 0x50], rdi
lea rbx, [rsp + 0x40]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x40]
lea r8, [rsi + rsi]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.1401b00b0
mov word [rbx + rdi*2], r14w
jmp 0x14004b175
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.14002c1a0
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 0xc
jb 0x14004b1c0
lea rdi, [rcx + 0xc]
mov qword [rsp + 0x50], rdi
lea rbx, [rsp + 0x40]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x40]
lea rcx, [rbx + rcx*2]
mov r8d, ILCombine
lea rdx, [0x1401fdf20]
call fcn.1401b00b0
mov word [rbx + rdi*2], r14w
jmp 0x14004b1e1
mov qword [rsp + 0x20], SafeArrayDestroy
lea r9, [0x1401fdf20]
xor r8d, r8d
lea edx, [r8 + 0xc]
lea rcx, [rsp + 0x40]
call fcn.14002c1a0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov word [rsp + 0x20], r14w
mov r9d, ILIsEqual
lea r8, [0x1401f5368]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxExW]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14004b24c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b247
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004b28f
call fcn.1401606e8
xor bl, bl
lea rcx, [rbp + 0x10]
call fcn.140028e30
nop
lea rcx, [rbp - 0x80]
call fcn.140028e30
movzx eax, bl
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.140160a40
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1401b3260
nop
call fcn.1401b3260
int3
call fcn.1401b3260
nop
call fcn.1401b3260
int3
call fcn.1401b3260
int3
call fcn.1401b3260
int3