Function at 0x14005b620
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x80
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
mov ecx, Ordinal_50
call fcn.140131724
mov r8, rax
mov qword [rbp - 0x40], rax
movdqa xmm0, xmmword [reloc.WLDAP32.dll_Ordinal_45]
movdqu xmmword [rbp - 0x30], xmm0
movups xmm0, xmmword [str.C:Program_FilesMSI_App_PlayerHD_Player.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140173230]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x140173240]
movsd qword [rax + 0x20], xmm0
mov eax, dword [0x140173248]
mov dword [r8 + 0x28], eax
movzx eax, byte [0x14017324c]
mov byte [r8 + 0x2c], al
mov byte [r8 + 0x2d], bl
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x14005b6d3
lea rdx, str.MSI_App_Player_se_est_abriendo.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jmp 0x14005b6e1
lea rdx, str.Error_al_intentar_abrir_MSI_App_Player.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140064e00
lea rdx, [0x140064fe0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x14005b735
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b730
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b730
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140131a70
lea rcx, [rbp + 0x10]
call fcn.14004cb40
movabs rcx, 0x7ffffffdabf41bff
mov rax, qword [rbp + 0x10]
cmp rax, rcx
jge 0x14005b764
movabs rcx, 0x2540be400
add rcx, rax
mov qword [rbp + 0x10], rcx
jmp 0x14005b772
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 0x10]
call fcn.140065dc0
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov ecx, 0x50
call fcn.140131724
mov rcx, rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x30], Ordinal_79
mov qword [rbp - 0x28], reloc.WLDAP32.dll_Ordinal_79
movaps xmm0, xmmword [str.adb_shell_monkey__p_com.dts.freefireth__c_android.intent.category.LAUNCHER_1]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1401732b0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1401732c0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1401732d0]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x1401732e0]
movsd qword [rax + 0x40], xmm0
mov eax, dword [0x1401732e8]
mov dword [rcx + 0x48], eax
mov byte [rcx + 0x4c], 0
mov qword [rsp + 0x30], Ordinal_79
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 3
lea r9, [0x1401732f0]
lea r8, [rbp - 0x40]
movzx edx, byte [rbp + 0x10]
lea rcx, [rbp - 0x20]
call fcn.140065a10
lea r9, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova r9, qword [rbp - 0x20]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14005b885
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b880
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b880
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140131a70
cmp ebx, 0x20
jle 0x14005b89a
lea rdx, str.Free_Fire_se_est_abriendo_en_el_emulador.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jmp 0x14005b8a8
lea rdx, str.Error_al_intentar_abrir_Free_Fire_con_ADB.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140064e00
lea rdx, [0x140064fe0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x14005b8fc
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b8f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b8f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140131a70
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rbp
ret