Function at 0x140106acc
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2fa0]
mov eax, 0x30a0
call fcn.14011a0f0
sub rsp, rax
mov rax, qword [0x140183c48]
xor rax, rsp
mov qword [rbp + 0x2f90], rax
cmp word [rdx], 0x22
mov r13, r9
mov r14, qword [rbp + 0x3008]
mov r12, r8
mov rdi, qword [rbp + 0x3010]
mov rbx, rdx
jne 0x140106b3b
mov r8d, 0x800
lea rcx, [rbp - 0x70]
call fcn.1400ac908
lea rcx, [rbp - 0x70]
call fcn.1400c6ba4
lea rbx, [rbp - 0x70]
mov esi, 0x70
lea rcx, [rsp + 0x20]
mov r8d, esi
xor edx, edx
call fcn.14011cde0
mov eax, 0x500
mov dword [rsp + 0x20], esi
xor esi, esi
mov qword [rsp + 0x38], rbx
cmp byte [rbp + 0x3000], sil
mov qword [rsp + 0x30], rdi
lea ecx, [rax + 0x40]
cmove eax, ecx
mov rcx, rbx
mov dword [rsp + 0x24], eax
call fcn.14009702c
cmp rax, rbx
mov rcx, rbx
sete r15b
call fcn.140096200
mov rdi, rax
test rax, rax
je 0x140106d7c
cmp word [rax], 0x2e
jne 0x140106baa
xor eax, eax
cmp word [rdi + 2], ax
je 0x140106d7c
test r15b, r15b
jne 0x140106bcc
lea rdx, [0x140158a20]
mov rcx, rbx
call fcn.140095424
test al, al
jne 0x140106bcc
or dword [rsp + 0x24], 1
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x48], r12
xor r12d, r12d
mov qword [rsp + 0x40], r13
test r15b, r15b
je 0x140106c18
lea rdx, [0x140141148]
mov rcx, rbx
call fcn.140095424
test al, al
jne 0x140106c18
mov r9, rbx
lea r8, str.._s
mov edx, 0x1000
lea rcx, [rbp + 0xf90]
call fcn.140004dcc
lea rax, [rbp + 0xf90]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x50], 1
mov byte [0x14018b805], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp word [rdi], 0x2e
mov ebx, eax
jne 0x140106c41
cmp word [rdi + 2], r12w
je 0x140106c52
mov rcx, rdi
call fcn.140097008
mov dil, r12b
cmp word [rax], 0x20
jne 0x140106c55
mov dil, 1
mov esi, 0x483
test ebx, ebx
jne 0x140106cb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jne 0x140106c83
test dil, dil
jne 0x140106c83
and dword [rsp + 0x24], 0xfffffffe
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebx, eax
test eax, eax
jne 0x140106cb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
jne 0x140106c9f
test r14, r14
je 0x140106c98
mov qword [r14], r12
mov al, 1
jmp 0x140106d7e
cmp qword [rsp + 0x30], r12
je 0x140106cb8
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], r12
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebx, eax
mov byte [0x14018b805], r12b
test ebx, ebx
je 0x140106d7c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
je 0x140106d7c
cmp byte [rbp + 0x3000], r12b
jne 0x140106c98
mov r8, qword [rbp - 0x78]
lea rdi, [0x140000000]
test r8, r8
je 0x140106d23
movsxd rdx, dword [0x1401fcf90]
mov rax, qword [rsp + 0x58]
mov qword [rdi + rdx*8 + 0x1fce90], r8
mov qword [rdi + rdx*8 + 0x1fcf10], rax
inc edx
and edx, 0x8000000f
jge 0x140106d1b
dec edx
or edx, 0xfffffff0
inc edx
mov dword [0x1401fcf90], edx
jmp 0x140106d6b
mov rbx, r12
mov rax, qword [rsp + 0x58]
cmp qword [rbx + rdi + 0x1fcf10], rax
jne 0x140106d5e
mov rcx, qword [rbx + rdi + 0x1fce90]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140106d5a
mov r8, qword [rbx + rdi + 0x1fce90]
mov qword [rbp - 0x78], r8
jmp 0x140106d5e
mov r8, qword [rbp - 0x78]
add rbx, 8
cmp rbx, 0x80
jl 0x140106d26
test r14, r14
je 0x140106c98
mov qword [r14], r8
jmp 0x140106c98
xor al, al
mov rcx, qword [rbp + 0x2f90]
xor rcx, rsp
call fcn.14011a150
mov rbx, qword [rsp + 0x30e0]
add rsp, 0x30a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret