Function at 0x1400b05e0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x278]
sub rsp, 0x378
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x14028e6b0]
xor rax, rsp
mov qword [rbp + 0x260], rax
movzx edi, r9b
mov r15, r8
mov r14, rdx
mov rsi, rcx
call fcn.1400417e0
mov rcx, rax
mov rdx, r14
call fcn.14001f170
cmp eax, 0xffffffff
jne 0x1400b067b
mov r8, qword [rsi]
lea rcx, [rsi + 0x478]
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 0x30
lea r10, str.Save_failed
mov qword [rsp + 0x20], r10
lea r9, str.Cannot_save:_Buffer_is_invalid.
mov r8, qword [r8 + 0x18]
lea rdx, str.BufferInvalidWarning
call fcn.140070e40
xor al, al
jmp 0x1400b0b4a
test dil, dil
jne 0x1400b06aa
mov dword [rsp + 0x60], 0x3ef
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], r14
lea rcx, [rsi + 0x97a20]
lea rdx, [rsp + 0x50]
call fcn.1400dfd00
xor ebx, ebx
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rbx
mov qword [rbp + 0x28], 7
mov qword [rbp + 0x20], rbx
mov word [rbp + 0x10], bx
call fcn.1400417e0
mov rcx, rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
movzx r9d, dil
mov r8, r15
mov rdx, r14
call fcn.140020a10
movzx r15d, al
test dil, dil
jne 0x1400b0706
mov dword [rsp + 0x60], 0x3f0
lea rcx, [rsi + 0x97a20]
lea rdx, [rsp + 0x50]
call fcn.1400dfd00
test r15b, r15b
jne 0x1400b0af0
cmp byte [rsi + 0x97ae1], r15b
jne 0x1400b0a89
call fcn.14000cdd0
cmp byte [rax + 0x815], r15b
je 0x1400b0890
cmp byte [rax + 0xde], r15b
je 0x1400b0890
cmp byte [rax + 0xdf], r15b
jne 0x1400b0890
mov rax, qword [rsi]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 4
lea r10, str.Save_failed
mov qword [rsp + 0x20], r10
lea r9, str.The_file_cannot_be_saved_and_it_may_be_protected._rDo_you_want_to_launch_Notepad_in_Administrator_mode_
mov r8, qword [rax + 0x18]
lea rdx, str.OpenInAdminMode
lea rcx, [rsi + 0x478]
call fcn.140070e40
cmp eax, 6
jne 0x1400b0b1c
mov r8d, 0x104
lea rdx, [rbp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rbp], rbx
mov qword [rbp + 8], rbx
mov qword [rbp + 8], 7
mov qword [rbp], rbx
mov word [rbp - 0x10], bx
mov r8d, 0xa
lea rdx, [0x1402084d8]
lea rcx, [rbp - 0x10]
call fcn.140006f10
nop
lea r9, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae r9, qword [rbp - 0x10]
mov rax, qword [rsi]
mov dword [rsp + 0x28], 5
lea rcx, [0x1401d30a0]
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x50]
lea rdx, str.runas
mov rcx, qword [rax + 0x18]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
mov rax, qword [rsi]
jae 0x1400b084c
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
lea rdx, str.Open_in_Administrator_mode_failed
mov qword [rsp + 0x20], rdx
lea r9, str.Notepad_cannot_be_opened_in_Administrator_mode.
mov r8, qword [rax + 0x18]
lea rdx, str.OpenInAdminModeFailed
lea rcx, [rsi + 0x478]
call fcn.140070e40
jmp 0x1400b0861
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
mov r8, qword [rbp + 8]
cmp r8, 8
jb 0x1400b087b
inc r8
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp - 0x10]
call fcn.140007680
mov qword [rbp + 8], 7
mov qword [rbp], rbx
mov word [rbp - 0x10], bx
jmp 0x1400b0b1c
mov rax, qword [rsi]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 4
lea r10, str.Save_failed
mov qword [rsp + 0x20], r10
lea r9, str.The_file_cannot_be_saved_and_it_may_be_protected._rDo_you_want_to_launch_Notepad_in_Administrator_mode_
mov r8, qword [rax + 0x18]
lea rdx, str.OpenInAdminModeWithoutCloseCurrent
lea rcx, [rsi + 0x478]
call fcn.140070e40
cmp eax, 6
jne 0x1400b0b1c
mov r8d, 0x104
lea rdx, [rbp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsi + 0x890]
mov rdi, qword [rax + 0x38]
call fcn.1400417e0
lea rdx, [rdi + 0xb0]
cmp qword [rdx + 0x18], 8
jb 0x1400b090a
mov rdx, qword [rdx]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rbx
mov qword [rbp + 0x48], 7
mov qword [rbp + 0x40], rbx
mov word [rbp + 0x30], bx
cmp word [rdx], 0
jne 0x1400b092d
mov r8, rbx
jmp 0x1400b093c
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400b0931
lea rcx, [rbp + 0x30]
call fcn.140006f10
nop
mov qword [rbp], rbx
mov qword [rbp + 8], rbx
mov qword [rbp + 8], 7
mov qword [rbp], rbx
mov word [rbp - 0x10], bx
mov r8d, 0x16
lea rdx, str._multiInst__nosession
lea rcx, [rbp - 0x10]
call fcn.140006f10
nop
mov r8d, 1
lea rdx, [0x1401e1d0c]
lea rcx, [rbp - 0x10]
call fcn.140006a00
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x10]
call fcn.1400068d0
mov r8d, 1
lea rdx, [0x1401e1d0c]
lea rcx, [rbp - 0x10]
call fcn.140006a00
lea r9, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae r9, qword [rbp - 0x10]
mov rax, qword [rsi]
mov dword [rsp + 0x28], 5
lea rcx, [0x1401d30a0]
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x50]
lea rdx, str.runas
mov rcx, qword [rax + 0x18]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
jae 0x1400b0a30
mov rax, qword [rsi]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
lea rdx, str.Open_in_Administrator_mode_failed
mov qword [rsp + 0x20], rdx
lea r9, str.Notepad_cannot_be_opened_in_Administrator_mode.
mov r8, qword [rax + 0x18]
lea rdx, str.OpenInAdminModeFailed
lea rcx, [rsi + 0x478]
call fcn.140070e40
nop
mov r8, qword [rbp + 8]
cmp r8, 8
jb 0x1400b0a4a
inc r8
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp - 0x10]
call fcn.140007680
mov qword [rbp + 8], 7
mov qword [rbp], rbx
mov word [rbp - 0x10], bx
mov r8, qword [rbp + 0x48]
cmp r8, 8
jb 0x1400b0a74
inc r8
mov rdx, qword [rbp + 0x30]
lea rcx, [rbp + 0x30]
call fcn.140007680
mov qword [rbp + 0x48], 7
mov qword [rbp + 0x40], rbx
mov word [rbp + 0x30], bx
jmp 0x1400b0b1c
mov rax, qword [rsi]
cmp qword [rbp + 0x20], 0
jne 0x1400b0acc
lea rcx, [rsi + 0x478]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
lea r10, str.Save_failed
mov qword [rsp + 0x20], r10
lea r9, str.Please_check_if_this_file_is_opened_in_another_program.
mov r8, qword [rax + 0x18]
lea rdx, str.FileLockedWarning
call fcn.140070e40
jmp 0x1400b0b1c
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rdx, qword [rbp + 0x10]
xor r9d, r9d
lea r8, str.Save_failed
mov rcx, qword [rax + 0x18]
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400b0b1c
mov rcx, qword [rsi + 0x982f0]
test rcx, rcx
je 0x1400b0b1c
cmp byte [rcx + 0x88], 0
jne 0x1400b0b1c
mov rax, qword [rcx]
call qword [rax + 0x58]
test al, al
je 0x1400b0b1c
mov rcx, qword [rsi + 0x982f0]
call fcn.140060620
nop
mov r8, qword [rbp + 0x28]
cmp r8, 8
jb 0x1400b0b36
inc r8
mov rdx, qword [rbp + 0x10]
lea rcx, [rbp + 0x10]
call fcn.140007680
mov qword [rbp + 0x28], 7
mov qword [rbp + 0x20], rbx
mov word [rbp + 0x10], bx
movzx eax, r15b
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.140168660
add rsp, 0x378
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret