Function at 0x1400c1ca0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x258]
sub rsp, 0x358
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rbp + 0x240], rax
movzx edi, r9b
mov r15, r8
mov r14, rdx
mov rsi, rcx
call fcn.14004a480
mov rcx, rax
mov rdx, r14
call fcn.14001f050
cmp eax, 0xffffffff
jne 0x1400c1d3b
mov r8, qword [rsi]
lea rcx, [rsi + 0x478]
xor edi, edi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 0x30
lea rdx, str.Save_failed
mov qword [rsp + 0x20], rdx
lea r9, str.Cannot_save:_Buffer_is_invalid.
mov r8, qword [r8 + 0x18]
lea rdx, str.BufferInvalidWarning
call fcn.14007aff0
xor al, al
jmp 0x1400c2211
lea rbx, [rsi + 0x97b18]
test dil, dil
jne 0x1400c1d6d
mov dword [rsp + 0x60], 0x3ef
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], r14
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400f16a0
call fcn.14004a480
mov rcx, rax
movzx r9d, dil
mov r8, r15
mov rdx, r14
call fcn.140020640
mov r14d, eax
test dil, dil
jne 0x1400c1da1
mov dword [rsp + 0x60], 0x3f0
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400f16a0
cmp r14d, 2
jne 0x1400c1de8
mov r8, qword [rsi]
lea rcx, [rsi + 0x478]
xor edi, edi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
lea rdx, str.Save_failed
mov qword [rsp + 0x20], rdx
lea r9, str.Failed_to_save_file._nIt_seems_theres_not_enough_space_on_disk_to_save_file.
mov r8, qword [r8 + 0x18]
lea rdx, str.NotEnoughRoom4Saving
call fcn.14007aff0
jmp 0x1400c220b
cmp r14d, 1
jne 0x1400c21db
cmp byte [rsi + 0x97bd9], 0
jne 0x1400c220b
call fcn.14000c980
cmp byte [rax + 0x835], 0
je 0x1400c1f9b
cmp byte [rax + 0xd6], 0
je 0x1400c1f9b
cmp byte [rax + 0xd7], 0
jne 0x1400c1f9b
mov rax, qword [rsi]
xor edi, edi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 4
lea rdx, str.Save_failed
mov qword [rsp + 0x20], rdx
lea r9, str.This_file_cannot_be_saved_and_it_may_be_protected._rDo_you_want_to_launch_Notepad_in_Administrator_mode_
mov r8, qword [rax + 0x18]
lea rdx, str.OpenInAdminMode
lea rcx, [rsi + 0x478]
call fcn.14007aff0
cmp eax, 6
jne 0x1400c220b
mov r8d, 0x104
lea rdx, [rbp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x1401e3030]
movdqu xmmword [rbp], xmm1
mov word [rbp - 0x10], di
lea r8d, [r14 + 9]
lea rdx, [0x140219ba8]
lea rcx, [rbp - 0x10]
call fcn.140006d60
nop
lea r9, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae r9, qword [rbp - 0x10]
mov rax, qword [rsi]
mov dword [rsp + 0x28], 5
lea rcx, [0x1401e3cd0]
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x30]
lea rdx, str.runas
mov rcx, qword [rax + 0x18]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
mov rax, qword [rsi]
jae 0x1400c1f30
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
lea rdx, str.Open_in_Administrator_mode_failed
mov qword [rsp + 0x20], rdx
lea r9, str.Notepad_cannot_be_opened_in_Administrator_mode.
mov r8, qword [rax + 0x18]
lea rdx, str.OpenInAdminModeFailed
lea rcx, [rsi + 0x478]
call fcn.14007aff0
jmp 0x1400c1f45
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x1400c1f85
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c1f80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c223c
call fcn.14017f5e4
movdqa xmm0, xmmword [0x1401e3030]
movdqu xmmword [rbp], xmm0
mov word [rbp - 0x10], di
jmp 0x1400c220b
mov rax, qword [rsi]
xor edi, edi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 4
lea rdx, str.Save_failed
mov qword [rsp + 0x20], rdx
lea r9, str.The_file_cannot_be_saved_and_it_may_be_protected._rDo_you_want_to_launch_Notepad_in_Administrator_mode_
mov r8, qword [rax + 0x18]
lea rdx, str.OpenInAdminModeWithoutCloseCurrent
lea rcx, [rsi + 0x478]
call fcn.14007aff0
cmp eax, 6
jne 0x1400c220b
mov r8d, 0x104
lea rdx, [rbp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsi + 0x8d0]
mov rbx, qword [rax + 0x38]
call fcn.14004a480
lea rdx, [rbx + 0xb0]
cmp qword [rdx + 0x18], 8
jb 0x1400c2017
mov rdx, qword [rdx]
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x1401e3030]
movdqu xmmword [rbp], xmm1
mov word [rbp - 0x10], di
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], di
jne 0x1400c2040
lea rcx, [rbp - 0x10]
call fcn.140006d60
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x1401e3030]
movdqu xmmword [rbp + 0x20], xmm1
mov word [rbp + 0x10], di
mov r8d, 0x16
lea rdx, str._multiInst__nosession
lea rcx, [rbp + 0x10]
call fcn.140006d60
nop
mov r8d, 1
lea rdx, [0x1401f2c5c]
lea rcx, [rbp + 0x10]
call fcn.140006a90
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rdx, qword [rbp - 0x10]
mov r8, qword [rbp]
lea rcx, [rbp + 0x10]
call fcn.140006a90
mov r8d, 1
lea rdx, [0x1401f2c5c]
lea rcx, [rbp + 0x10]
call fcn.140006a90
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r9, qword [rbp + 0x10]
mov rax, qword [rsi]
mov dword [rsp + 0x28], 5
lea rcx, [0x1401e3cd0]
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x30]
lea rdx, str.runas
mov rcx, qword [rax + 0x18]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
jae 0x1400c2146
mov rax, qword [rsi]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
lea rdx, str.Open_in_Administrator_mode_failed
mov qword [rsp + 0x20], rdx
lea r9, str.Notepad_cannot_be_opened_in_Administrator_mode.
mov r8, qword [rax + 0x18]
lea rdx, str.OpenInAdminModeFailed
lea rcx, [rsi + 0x478]
call fcn.14007aff0
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x1400c2186
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c2181
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c2230
call fcn.14017f5e4
movdqa xmm0, xmmword [0x1401e3030]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], di
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x1400c1f85
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c1f80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c2236
jmp 0x1400c1f80
test r14d, r14d
jne 0x1400c220e
mov rcx, qword [rsi + 0x983e8]
test rcx, rcx
je 0x1400c220b
cmp byte [rcx + 0x80], r14b
jne 0x1400c220b
mov rax, qword [rcx]
call qword [rax + 0x58]
test al, al
je 0x1400c220b
mov rcx, qword [rsi + 0x983e8]
call fcn.14006ad80
test r14d, r14d
sete al
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.14017f700
add rsp, 0x358
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1401a10ac
nop
call fcn.1401a10ac
int3
call fcn.1401a10ac
int3