Function at 0x140002810
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rcx, qword [0x14004c110]
call qword [0x14004c120]
mov qword [0x14004c138], rax
xor r13d, r13d
mov r12, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
mov dword [0x14004c160], eax
mov rax, qword [0x14004c138]
mov dword [rax + 0x10], edx
mov rcx, qword [0x14004c138]
mov eax, dword [0x1400490b8]
mov dword [rcx + 0x50], eax
mov rcx, qword [0x14004c110]
call qword [0x14004c120]
xor ecx, ecx
call fcn.140001100
mov dword [0x14004c140], eax
lea rax, str.TextSnap32to64
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x148
xor r9d, r9d
xor edx, edx
lea r8d, [r13 + 4]
or rsi, 0xffffffffffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbp, rax
test rax, rax
je 0x1400029bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, r13d
cmp eax, 0xb7
setne dil
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea edx, [rsi + 3]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r11, rax
mov qword [0x14004c148], rax
test edi, edi
je 0x140002941
cmp dword [0x14004c144], r12d
je 0x14000291b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14004c148], r13
mov dword [0x14004c160], r13d
jmp 0x140002c4b
xor edx, edx
mov r8d, 0x148
mov rcx, rax
call fcn.14001b8f0
mov rdx, qword [0x14004c148]
mov dword [rdx], 0x148
mov r11, qword [0x14004c148]
jmp 0x140002976
cmp dword [rax], 0x148
je 0x140002976
xor r8d, r8d
xor edx, edx
lea rcx, str.Error:_Inconsistent_64_and_32_bit_versions_of_TextSnap._Reinstall_the_product.
call fcn.14000b9a4
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14004c148], r13
mov dword [0x14004c160], r13d
jmp 0x140002c4b
cmp dword [0x14004c140], r12d
je 0x14000298b
mov eax, dword [0x14004c160]
mov dword [r11 + 4], eax
jmp 0x140002995
mov eax, dword [0x14004c160]
mov dword [r11 + 8], eax
mov eax, dword [0x14004c144]
test eax, eax
je 0x1400029d3
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0x3e8
call qword [sym.imp.USER32.dll_SetTimer]
mov r12, rax
mov eax, dword [0x14004c144]
jmp 0x1400029d3
mov eax, dword [0x14004c144]
test eax, eax
je 0x1400029d3
mov dword [0x14004c160], r13d
jmp 0x140002c4b
cmp dword [0x14004c140], r13d
je 0x140002b7f
test eax, eax
jne 0x140002b7f
mov rax, qword [0x14004c148]
cmp dword [rax + 8], r13d
jne 0x140002b7f
call fcn.14000bad4
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x140002a19
mov ecx, 0x80004005
call entry0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xa8], rbx
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x105
or eax, ecx
jge 0x140002a5c
mov edx, 0x105
lea rcx, [rsp + 0xa8]
call fcn.1400018c0
mov rbx, qword [rsp + 0xa8]
mov r8d, 0x104
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test rbx, rbx
jne 0x140002a77
mov ecx, r13d
jmp 0x140002a90
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x140002b74
cmp ecx, dword [rbx - 0xc]
jg 0x140002b74
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov byte [rax + rbx], 0
mov edx, 0x5c
mov rcx, rbx
call fcn.14001bb70
test rax, rax
jne 0x140002ab9
mov eax, esi
jmp 0x140002abb
sub eax, ebx
lea r8d, [rax + 1]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xa8]
call fcn.140002360
nop
lea r8, [0x140038e28]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.1400025b0
nop
mov rdx, rax
lea rcx, [rsp + 0xa8]
call fcn.140002720
nop
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140002b22
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xb8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140002b45
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
mov rdi, qword [rsp + 0xa8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WinExec]
nop
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x140002b7f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140002b7f
mov ecx, 0x80070057
call entry0
nop
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x140002c05
cmp eax, 0xffffffff
je 0x140002c05
mov rax, qword [0x14004c138]
mov ecx, dword [rax + 0x14]
cmp dword [rsp + 0x40], ecx
jne 0x140002bbc
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call fcn.140001e30
jmp 0x140002bee
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [rsp + 0x40], 0x113
jne 0x140002bee
mov rax, qword [0x14004c148]
test rax, rax
je 0x140002c0c
cmp dword [rax + 4], 0
je 0x140002c0c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x140002b96
mov rax, qword [0x14004c148]
test rbp, rbp
je 0x140002c2d
cmp dword [0x14004c140], 0
je 0x140002c20
mov dword [rax + 4], r13d
jmp 0x140002c24
mov dword [rax + 8], r13d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12, r12
je 0x140002c3d
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
mov qword [0x14004c148], r13
mov dword [0x14004c160], r13d
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret