Function at 0x140002b70
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov esi, r8d
mov r14, rdx
mov rdi, rcx
xor r15d, r15d
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea rcx, [rbp + 7]
xor r9d, r9d
mov ebx, 1
call qword [sym.imp.USER32.dll_PeekMessageA]
lea edx, [rbx + 5]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rax, str.runas
mov dword [rbp - 0x69], 0x70
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxMain_src_helper_appsVBoxExtPackHelperApp.cpp
mov qword [rbp - 0x59], rax
lea rdx, [rbp - 0x51]
mov dword [rbp - 0x65], 0x40
mov rcx, rdi
mov qword [rbp - 0x61], r15
call qword [sym.imp.VBoxRT.dll_RTStrToUtf16Tag]
test eax, eax
js 0x140002e26
lea eax, [rsi + 1]
xor r8d, r8d
movsxd rcx, eax
lea rdx, [r14 + rcx*8]
lea rcx, [rbp - 0x71]
call qword [sym.imp.VBoxRT.dll_RTGetOptArgvToString]
test eax, eax
js 0x140002e1a
mov rcx, qword [rbp - 0x71]
lea r8, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxMain_src_helper_appsVBoxExtPackHelperApp.cpp
lea rdx, [rbp - 0x49]
call qword [sym.imp.VBoxRT.dll_RTStrToUtf16Tag]
test eax, eax
js 0x140002e10
mov rcx, qword [rbp + 0x7f]
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm0, xmmword [0x140008b60]
movdqa xmmword [rbp - 9], xmm0
mov qword [rbp - 0x41], r15
mov dword [rbp - 0x39], 3
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x19], r15
mov dword [rbp - 0x11], r15d
test rcx, rcx
je 0x140002cb4
lea rdx, str.hwnd
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x140002cab
lea rcx, [rax + 5]
xor r8d, r8d
lea r9, [rbp - 0x79]
xor edx, edx
call qword [sym.imp.VBoxRT.dll_RTStrToUInt64Ex]
test eax, eax
js 0x140002cab
mov rcx, qword [rbp - 0x79]
mov edx, ebx
mov qword [rbp - 0x61], rcx
call qword [sym.imp.USER32.dll_MonitorFromWindow]
mov qword [rbp - 9], rax
jmp 0x140002caf
mov rax, qword [rbp - 9]
test rax, rax
jne 0x140002ccc
mov edx, ebx
mov qword [rbp - 0x79], r15
mov rcx, r15
call qword [sym.imp.USER32.dll_MonitorFromPoint]
mov qword [rbp - 9], rax
test rax, rax
je 0x140002cd3
or dword [rbp - 0x65], 0x200000
lea rcx, [rbp - 0x69]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140002de6
cmp qword [rbp - 1], 0xffffffffffffffff
je 0x140002dd7
mov r9d, 0x1388
mov dword [rsp + 0x20], 0x4bf
xor r8d, r8d
lea rdx, [rbp - 1]
mov ecx, ebx
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov edi, eax
test eax, eax
je 0x140002dae
cmp edi, 0x102
je 0x140002d23
cmp edi, ebx
jne 0x140002d93
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea rcx, [rbp + 7]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140002d6e
nop dword [rax]
lea rcx, [rbp + 7]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 7]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea rcx, [rbp + 7]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140002d40
mov r9d, 0x1388
mov dword [rsp + 0x20], 0x4bf
xor r8d, r8d
lea rdx, [rbp - 1]
mov ecx, ebx
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov edi, eax
test eax, eax
jne 0x140002d17
jmp 0x140002dae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, edi
lea rcx, str.MsgWaitForMultipleObjects_returned:__x___d___err_u
mov r9d, eax
mov edx, edi
call qword [sym.imp.VBoxRT.dll_RTMsgError]
mov rcx, qword [rbp - 1]
lea rdx, [rbp - 0x79]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140002dcb
cmp dword [rbp - 0x79], 0x80
cmovb ebx, dword [rbp - 0x79]
mov rcx, qword [rbp - 1]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002e06
lea rcx, str.ShellExecuteExW_return_INVALID_HANDLE_VALUE_as_Info.hProcess
call qword [sym.imp.VBoxRT.dll_RTMsgError]
jmp 0x140002e06
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, edi
lea rcx, str.ShellExecuteExW_failed:__u___x_
mov edx, eax
call qword [sym.imp.VBoxRT.dll_RTMsgError]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.VBoxRT.dll_RTUtf16Free]
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.VBoxRT.dll_RTStrFree]
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.VBoxRT.dll_RTUtf16Free]
jmp 0x140002e35
mov edx, eax
lea rcx, str.RTStrToUtf16_failed:__Rc
call qword [sym.imp.VBoxRT.dll_RTMsgError]
lea r11, [rsp + 0xe0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret