Function at 0x140010c50
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
xor r15d, r15d
mov r14, r8
mov rdi, rdx
mov qword [rbp - 0x61], r15
mov rsi, rcx
mov qword [rbp - 0x59], r15
xor edx, edx
mov qword [rbp + 0x7f], r15
lea r8d, [r15 + 0x68]
mov qword [rbp - 0x69], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x6f], r15
call fcn.1400547d0
mov rdx, qword [rdi + 0x18]
xor eax, eax
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], rax
test rdx, rdx
je 0x140010d70
cmp word [rdx], r15w
je 0x140010d70
xor r9d, r9d
lea r8, [rbp - 0x61]
mov rcx, rsi
call fcn.14000c5ac
mov ebx, eax
test eax, eax
jns 0x140010d03
lea rax, str.Failed_to_format_argument_string.
mov edx, 0x9e
mov qword [rsp + 0x28], rax
lea rcx, str.d:_awixwix_src_burnengine_approvedexe.cpp
mov r9d, 0x100
mov dword [rsp + 0x20], ebx
mov r8d, 5
call fcn.1400012b4
jmp 0x140010f02
mov r9, qword [rbp - 0x61]
lea rdx, str.__ls___s
mov r8, qword [rdi + 0x10]
lea rcx, [rbp + 0x7f]
call fcn.140003224
mov ebx, eax
test eax, eax
jns 0x140010d2f
lea rax, str.Failed_to_create_executable_command.
mov edx, 0xa1
jmp 0x140010cdd
mov rdx, qword [rdi + 0x18]
lea r8, [rbp - 0x59]
xor r9d, r9d
mov rcx, rsi
call fcn.14000c5c8
mov ebx, eax
test eax, eax
jns 0x140010d56
lea rax, str.Failed_to_format_obfuscated_argument_string.
mov edx, 0xa4
jmp 0x140010cdd
mov r9, qword [rbp - 0x59]
lea rdx, str.__ls___s
mov r8, qword [rdi + 0x10]
lea rcx, [rbp - 0x69]
call fcn.1400031dc
jmp 0x140010daf
mov r8, qword [rdi + 0x10]
lea rdx, str.__ls_
lea rcx, [rbp + 0x7f]
call fcn.1400031dc
mov ebx, eax
test eax, eax
jns 0x140010d9b
lea rax, str.Failed_to_create_executable_command.
mov edx, 0xab
jmp 0x140010cdd
mov r8, qword [rdi + 0x10]
lea rdx, str.__ls_
lea rcx, [rbp - 0x69]
call fcn.1400031dc
mov ebx, eax
test eax, eax
jns 0x140010dc6
lea rax, str.Failed_to_create_obfuscated_executable_command.
mov edx, 0xaf
jmp 0x140010cdd
mov rcx, qword [rdi + 0x10]
lea rdx, [rbp + 0x6f]
call fcn.140005634
mov rcx, qword [rbp + 0x6f]
test eax, eax
js 0x140010e10
test rcx, rcx
je 0x140010e07
mov eax, 0x103
mov rdx, rcx
cmp word [rdx], r15w
je 0x140010df8
add rdx, 2
sub rax, 1
jne 0x140010de8
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80070057
jmp 0x140010e0c
mov ebx, 0x80070057
test ebx, ebx
jns 0x140010e21
test rcx, rcx
je 0x140010e1e
call fcn.140004278
mov qword [rbp + 0x6f], r15
mov ebx, r15d
mov r9, qword [rbp - 0x69]
mov edx, 0x2000025a
mov r8, qword [rdi + 0x10]
mov ecx, 2
call fcn.140009b38
mov rdx, qword [rbp + 0x7f]
lea rax, [rbp - 0x51]
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp - 0x39]
mov dword [rbp - 0x39], 0x68
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x6f]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140010eeb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
mov esi, 0xc6
or ebx, 0x80070000
lea rcx, str.d:_awixwix_src_burnengine_approvedexe.cpp
test eax, eax
mov edx, esi
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov r8d, ebx
call fcn.1400012b0
mov rax, qword [rdi + 0x10]
lea r9d, [rsi + 0x3a]
mov qword [rsp + 0x30], rax
lea rcx, str.d:_awixwix_src_burnengine_approvedexe.cpp
lea rax, str.Failed_to_CreateProcess_on_path:__ls
mov r8d, 5
mov qword [rsp + 0x28], rax
mov edx, esi
mov dword [rsp + 0x20], ebx
call fcn.1400012b4
jmp 0x140010f02
mov eax, dword [rbp - 0x41]
mov dword [r14], eax
mov edx, dword [rdi + 0x20]
test edx, edx
je 0x140010f02
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rbp - 0x61]
call fcn.140004578
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x140010f19
call fcn.140004278
mov rcx, qword [rbp + 0x7f]
call fcn.140004578
mov rcx, qword [rbp - 0x69]
test rcx, rcx
je 0x140010f30
call fcn.140004278
mov rcx, qword [rbp + 0x6f]
test rcx, rcx
je 0x140010f3e
call fcn.140004278
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x140010f51
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x49], r15
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x140010f60
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x120]
add rsp, 0xf0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret