Function at 0x1400bcacc
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x390
mov rax, qword [0x1401006f0]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov rdi, rcx
call fcn.14009e1f4
lea rcx, [0x14019cf50]
xor edx, edx
mov r8d, 0x2018
call fcn.1400c7170
xor r9d, r9d
lea rdx, str.WizardLogo.bmp
lea r8d, [r9 + 0xf]
lea rcx, [0x14015a270]
call fcn.140082dc8
lea rcx, [0x14015a270]
mov dl, 1
mov qword [0x14019ef68], rax
lea rax, str.WIZARDCMD
mov dword [rsp + 0x30], SHRestricted
mov qword [rsp + 0xa0], rax
lea rax, [0x1400bbed4]
mov dword [rsp + 0x34], 0x22a
mov qword [rsp + 0xb8], rax
lea rax, str.WIZARDARC
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x100], rax
lea rax, [0x1400bc4d8]
mov qword [rsp + 0x118], rax
lea rax, str.WIZARDEXTR
mov qword [rsp + 0x160], rax
lea rax, [0x1400bbc48]
mov qword [rsp + 0x178], rax
lea rax, str.WIZARDADDOPT
mov qword [rsp + 0x1c0], rax
lea rax, [0x1400bc210]
mov qword [rsp + 0x1d8], rax
mov rax, qword [0x140134b88]
mov qword [rsp + 0x40], rax
call fcn.1400821b8
xor r12d, r12d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
lea ebx, [r12 + 4]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x60], r12d
mov esi, 0x800
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x58], ebx
lea rdi, [0x14019cf54]
lea r14, [0x1401575c0]
lea r13d, [r12 + 2]
cmp byte [0x140148965], r12b
je 0x1400bcc3e
mov r8, rsi
mov rdx, rdi
mov rcx, r14
call fcn.140014e94
mov dword [0x14019cf50], r12d
mov dword [rsp + 0x60], r13d
mov rdx, qword [0x140134b88]
lea rax, [rsp + 0x94]
mov rcx, rbx
mov dword [rax - 4], 0x60
mov dword [rax], 0x20
mov qword [rax + 4], rdx
add rax, 0x60
sub rcx, 1
jne 0x1400bcc50
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x30]
lea rcx, [0x140134bc0]
mov r9, rbx
call fcn.140075e18
lea rcx, [rsp + 0x30]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
lea rdx, [rsp + 0x90]
lea rcx, [0x140134bc0]
cmp rax, r12
mov r8, rbx
setg bpl
call fcn.140074e2c
cmp bpl, r12b
je 0x1400bcf63
mov eax, dword [0x14019cf50]
cmp eax, r12d
je 0x1400bce40
jle 0x1400bcf63
cmp eax, r13d
jg 0x1400bcf63
lea rbx, [0x140166802]
mov r8, rsi
mov rcx, rdi
mov rdx, rbx
call fcn.1400bbe74
mov al, byte [0x14019ef55]
cmp byte [0x14019ef57], r12b
mov byte [0x14016156e], al
mov eax, dword [0x1401614fc]
mov dword [0x140161524], 3
cmovne eax, r13d
mov dword [0x140161520], r13d
mov dword [0x1401614fc], eax
mov rax, qword [0x14019ef58]
mov qword [0x140161528], rax
cmp dword [0x14019cf50], r13d
jne 0x1400bcd6f
mov rcx, rbx
call fcn.14003c3d4
cmp al, r12b
je 0x1400bcd6f
xor r9d, r9d
mov r8b, 1
mov rdx, rbx
mov rcx, r14
call fcn.140018388
cmp eax, 1
jne 0x1400bce27
mov eax, dword [0x1401579d4]
mov dword [0x140163790], eax
jmp 0x1400bce27
mov rcx, rbx
cmp byte [0x14019ef56], r12b
je 0x1400bcdd4
lea rdx, [0x1400e0270]
call fcn.140061828
cmp al, r12b
jne 0x1400bcdb0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
mov rax, qword [0x1400e5318]
sub rdi, r13
mov qword [rdi], rax
movzx eax, word [0x1400e5320]
mov word [rdi + 8], ax
mov rcx, r12
lea rdx, [0x1400e0250]
movzx eax, word [rcx + rdx]
lea rdi, [0x14015c3d8]
mov word [rcx + rdi], ax
add rcx, r13
cmp ax, r12w
jne 0x1400bcdba
jmp 0x1400bce27
cmp dword [0x140163790], r12d
lea rax, str..rar
lea rsi, str..zip
cmove rsi, rax
lea rdx, [rsi + 2]
call fcn.140061828
cmp al, r12b
jne 0x1400bce1f
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
sub rdi, r13
xor r8d, r8d
movzx eax, word [rsi + r8]
mov word [rdi + r8], ax
add r8, r13
test ax, ax
jne 0x1400bce0d
mov word [0x14015c3d8], r12w
mov dl, 1
mov rcx, rbx
call fcn.1400612fc
xor edx, edx
mov rcx, r14
call fcn.140019454
jmp 0x1400bcf63
xor r9d, r9d
mov r8b, 1
mov rdx, rdi
mov rcx, r14
call fcn.140018388
cmp eax, 1
jne 0x1400bcf63
xor ecx, ecx
call fcn.14009e044
lea rdi, [0x14015d3de]
lea rdx, [0x14019df54]
lea rcx, [0x140155380]
mov r8, rdi
mov r9, rsi
call fcn.14004bca8
mov rcx, rdi
call fcn.14003c3d4
cmp al, r12b
jne 0x1400bcec3
xor edx, edx
mov rcx, rdi
call fcn.14003cae4
cmp al, r12b
jne 0x1400bcec3
mov ecx, 0x1f7
call fcn.140076080
mov rdx, rdi
mov rcx, rax
call fcn.1400b189c
lea rcx, [0x140134b90]
call fcn.1400330fc
jmp 0x1400bcf63
lea rdx, [rsp + 0x210]
mov rcx, r14
call fcn.140014eb0
lea rdx, [0x140166802]
mov r8, rsi
mov rcx, r14
call fcn.140014e94
mov edx, dword [rsp + 0x290]
lea rcx, [0x140167808]
mov dword [0x140163790], edx
call fcn.140080b98
lea rdx, [0x1400e0250]
lea rcx, [0x140167808]
call fcn.140080bc0
xor r8d, r8d
xor edx, edx
mov rcx, r14
mov byte [0x1401616b1], r12b
call fcn.140019868
cmp word [0x14019df54], r12w
je 0x1400bcf3a
mov rdx, rsi
mov rcx, rdi
call fcn.14006119c
lea rax, [0x1400e04f4]
lea rdx, str.open
xor r9d, r9d
mov r8, rdi
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, bpl
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.1400c6350
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret