Function at 0x1400a0401
Capabilities:
Create process on windows

Disassembly:
jmp 0x1400bd560
mov byte [rsp + 8], cl
push rbp
push rsi
push rdi
mov eax, 0x14f0
call fcn.14009be9c
sub rsp, rax
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x3a8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
movzx ecx, byte [rsp + 0x1518]
mov rax, qword [0x14023ac40]
xor rax, rbp
mov qword [rbp + 0x1490], rax
xor edx, edx
lea rcx, [rbp + 8]
call fcn.14009c081
nop
mov r9d, 0x20106
lea r8, str.SoftwareOpenShellOpenShell
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 8]
call fcn.14009dc5b
mov dword [rbp + 0x34], eax
cmp dword [rbp + 0x34], 0
jne 0x1400bd5e5
lea rax, str._r_n_r_n
mov qword [rbp + 0x1468], rax
jmp 0x1400bd5f3
lea rax, [0x1401ebcc4]
mov qword [rbp + 0x1468], rax
mov rax, qword [rbp + 0x1468]
mov qword [rbp + 0x58], rax
cmp dword [rbp + 0x34], 0
jne 0x1400bd770
mov r8d, dword [0x14023ec18]
lea rdx, str.WinVersion
lea rcx, [rbp + 8]
call fcn.14009c6a8
lea rax, [rbp + 0x80]
lea rcx, str.regsvr32__s___windir_System32StartMenuHelper64.dll_
mov rdi, rax
mov rsi, rcx
mov ecx, 0x6c
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0xec]
mov rdi, rax
xor eax, eax
mov ecx, 0x19c
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rbp + 0x80]
call qword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
lea rax, [rbp + 0x2b0]
lea rcx, str._windir_System32_regsvr32.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x3e
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x2ee]
mov rdi, rax
xor eax, eax
mov ecx, 0x1ca
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
mov dword [rbp + 0x4e0], 0x68
lea rax, [rbp + 0x4e8]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x568]
call fcn.14009ecbe
lea rax, [rbp + 0x568]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x4e0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400bd767
mov rcx, qword [rbp + 0x570]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x568]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x34]
mov rcx, qword [rbp + 0x568]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 0x568]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400bd770
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x34], eax
movzx eax, byte [rbp + 0x14c0]
test eax, eax
jne 0x1400bd91d
cmp dword [rbp + 0x34], 0
je 0x1400bd882
mov edx, 0xdf8
lea rcx, [rbp + 0x13d8]
call qword [sym.imp.StartMenuDLL.dll_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______cdecl_DllLoadStringEx_int_]
mov qword [rbp + 0x1468], rax
mov rax, qword [rbp + 0x1468]
mov qword [rbp + 0x1470], rax
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x1470]
mov r9, qword [rax]
lea r8, str._s_s
mov edx, 0x400
lea rcx, [rbp + 0x5a0]
call fcn.14009f673
mov dword [rbp + 0xdb4], eax
lea rcx, [rbp + 0x13d8]
call fcn.14009c69e
movsxd rax, dword [rbp + 0xdb4]
mov ecx, 0x400
sub rcx, rax
mov rax, rcx
movsxd rcx, dword [rbp + 0xdb4]
lea rcx, [rbp + rcx*2 + 0x5a0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, dword [rbp + 0x34]
xor edx, edx
mov ecx, 0x1200
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov edx, 0xbb9
lea rcx, [rbp + 0x13f8]
call qword [sym.imp.StartMenuDLL.dll_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______cdecl_DllLoadStringEx_int_]
mov qword [rbp + 0x1468], rax
mov rcx, qword [rbp + 0x1468]
call fcn.14009bbd1
mov r9d, ILClone
mov r8, rax
lea rdx, [rbp + 0x5a0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rbp + 0x13f8]
call fcn.14009c69e
jmp 0x1400bd91d
mov edx, 0xbb9
lea rcx, [rbp + 0x1418]
call qword [sym.imp.StartMenuDLL.dll_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______cdecl_DllLoadStringEx_int_]
mov qword [rbp + 0x1468], rax
mov rax, qword [rbp + 0x1468]
mov qword [rbp + 0x1470], rax
mov rcx, qword [rbp + 0x1470]
call fcn.14009bbd1
mov qword [rbp + 0x1478], rax
mov edx, 0xdf9
lea rcx, [rbp + 0x1438]
call qword [sym.imp.StartMenuDLL.dll_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______cdecl_DllLoadStringEx_int_]
mov qword [rbp + 0x1480], rax
mov rcx, qword [rbp + 0x1480]
call fcn.14009bbd1
mov qword [rbp + 0x1488], rax
mov r9d, 0x40
mov r8, qword [rbp + 0x1478]
mov rdx, qword [rbp + 0x1488]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rbp + 0x1438]
call fcn.14009c69e
nop
lea rcx, [rbp + 0x1418]
call fcn.14009c69e
mov eax, dword [rbp + 0x34]
mov dword [rbp + 0x1454], eax
lea rcx, [rbp + 8]
call fcn.14009c1e4
mov eax, dword [rbp + 0x1454]
mov edi, eax
lea rcx, [rbp - 0x50]
lea rdx, [0x1401ea4c0]
call fcn.14009f330
mov eax, edi
mov rcx, qword [rbp + 0x1490]
xor rcx, rbp
call fcn.14009d7b0
lea rsp, [rbp + 0x14a0]
pop rdi
pop rsi
pop rbp
ret