Function at 0x1000e7d70
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0xb0]
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], rsi
mov qword [rbp - 8], rcx
mov byte [rbp - 0x10], dl
mov rcx, qword [rbp - 8]
call fcn.100009310
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x68], 0
mov qword [rbp - 0x60], 0
mov qword [rbp - 0x58], 0
nop
mov byte [rbp - 0x14], 0
cmp qword [rbp - 8], 0
je 0x1000e805d
lea rbx, [rbp - 0x20]
mov rcx, rbx
call fcn.10000ae20
lea rsi, [rbp - 0x28]
mov rcx, rsi
call fcn.10000ae20
mov rdx, rsi
mov rcx, rbx
call fcn.1000e7860
test al, al
je 0x1000e7ff0
mov rdx, qword [rbp - 0x28]
mov r8d, 1
lea rcx, [0x1003302f0]
call fcn.10000b8a0
test rax, rax
jle 0x1000e7f24
mov rdx, qword [rbp - 0x28]
mov r8d, 1
lea rcx, [0x100330128]
call fcn.10000b8a0
test rax, rax
jne 0x1000e7e80
cmp byte [rbp - 0x10], 0
je 0x1000e7e80
mov rcx, qword [rbp - 0x20]
call fcn.1000e73c0
test al, al
jne 0x1000e7e80
lea rax, [0x1003300a8]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x48], rax
lea rax, [0x1003300a8]
mov qword [rbp - 0x40], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 8]
xor r9d, r9d
mov r8d, 2
call fcn.100009730
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x58]
call fcn.10000bf80
mov rax, qword [rbp - 0x58]
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x38]
mov r8, qword [rbp - 0x40]
test r8, r8
je 0x1000e7ea6
mov r8, qword [r8 - 8]
mov rdx, qword [rbp - 0x40]
test rdx, rdx
jne 0x1000e7eb6
lea rdx, [0x10044c460]
call fcn.10014f8f0
mov rax, qword [rbp - 8]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0xb
lea r8, [rbp - 0x50]
mov rdx, qword [rbp - 0x38]
xor r9, r9
lea rcx, [rbp - 0x60]
call fcn.1000d0e90
mov rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x38]
call fcn.100009340
mov r8, qword [rbp - 0x38]
test r8, r8
je 0x1000e7ef9
mov r8, qword [r8 - 8]
mov rdx, qword [rbp - 0x38]
test rdx, rdx
jne 0x1000e7f09
lea rdx, [0x10044c460]
lea rcx, [rbp - 0x68]
call fcn.10014f800
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x28]
call fcn.10000bf30
jmp 0x1000e7fab
cmp byte [rbp - 0x10], 0
je 0x1000e7f78
mov rdx, qword [rbp - 8]
mov r8d, 1
mov ecx, 0x20
call fcn.10000a4e0
test rax, rax
jle 0x1000e7f78
lea rax, [0x1003300a8]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x48], rax
lea rax, [0x1003300a8]
mov qword [rbp - 0x40], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 8]
xor r9d, r9d
mov r8d, 2
call fcn.100009730
nop
mov r8, qword [rbp - 8]
test r8, r8
je 0x1000e7f85
mov r8, qword [r8 - 8]
mov rdx, qword [rbp - 8]
test rdx, rdx
jne 0x1000e7f95
lea rdx, [0x10044c460]
lea rcx, [rbp - 0x68]
call fcn.10014f800
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x28]
call fcn.10000bf30
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9, qword [rbp - 0x28]
test r9, r9
jne 0x1000e7fcc
lea r9, [0x10044c460]
mov r8, qword [rbp - 0x20]
test r8, r8
jne 0x1000e7fdc
lea r8, [0x10044c460]
lea rdx, str.open
xor ecx, ecx
call sub.shell32.dll_ShellExecuteW
mov qword [rbp - 0x30], rax
jmp 0x1000e8054
mov r8, qword [rbp - 8]
test r8, r8
je 0x1000e7ffd
mov r8, qword [r8 - 8]
mov rdx, qword [rbp - 8]
test rdx, rdx
jne 0x1000e800d
lea rdx, [0x10044c460]
lea rcx, [rbp - 0x68]
call fcn.10014f800
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x28]
call fcn.10000bf30
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r8, qword [rbp - 0x28]
test r8, r8
jne 0x1000e8044
lea r8, [0x10044c460]
xor r9, r9
xor edx, edx
xor ecx, ecx
call sub.shell32.dll_ShellExecuteW
mov qword [rbp - 0x30], rax
cmp qword [rbp - 0x30], 0x20
seta byte [rbp - 0x14]
nop
mov rcx, rbp
call fcn.1000e7d20
mov al, byte [rbp - 0x14]
mov rbx, qword [rbp - 0x78]
mov rsi, qword [rbp - 0x70]
lea rsp, [rbp]
pop rbp
ret