Function at 0x140052a00
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rsi, rcx
xor r12d, r12d
lea rcx, [rsp + 0x40]
call fcn.14005d1b0
nop
cmp dword [0x14021c658], 0xb23a8c33
je 0x140052a75
mov ecx, 0x6c0
call fcn.140111d34
mov qword [rbp + 0x128], rax
test rax, rax
je 0x140052a69
mov rcx, rax
call fcn.140036570
mov rcx, rax
jmp 0x140052a6c
mov rcx, r12
mov qword [0x140229e08], rcx
jmp 0x140052a7c
mov rcx, qword [0x140229e08]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rbx, rax
mov qword [rbp + 0x128], rax
xor dil, dil
mov rax, qword [rsi]
mov r14, 0xffffffffffffffff
cmp dword [rax - 0x10], 0
je 0x140052dc2
mov dword [rsp + 0x30], r12d
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x70], xmm0
mov dword [rsp + 0x30], r12d
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x60], xmm1
mov dword [rsp + 0x70], 2
mov qword [rsp + 0x78], rbx
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp + 0x50], xmm0
mov dword [rbp - 0x80], 2
mov qword [rbp - 0x78], rax
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp + 0x40], xmm0
mov rcx, qword [0x14022a428]
test rcx, rcx
je 0x140052b50
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x50]
test rax, rax
je 0x140052b50
lea rcx, [rbp + 0x40]
mov qword [rbp - 0x70], rcx
lea rcx, [rbp + 0x50]
mov qword [rbp - 0x68], rcx
lea rcx, [rbp + 0x60]
mov qword [rbp - 0x60], rcx
lea rcx, [rbp + 0x70]
mov qword [rbp - 0x58], rcx
mov r10, qword [rax]
mov dword [rsp + 0x28], 4
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x20], rcx
lea r9, str.Filename:__s___Parameters:__s
mov r8, qword [rsp + 0x48]
mov edx, dword [rsp + 0x40]
mov rcx, rax
call qword [r10 + 0x10]
mov rax, qword [rsi]
mov ecx, dword [rax - 0x10]
inc ecx
movsxd rdx, ecx
mov eax, 2
mul rdx
cmovo rax, r14
mov rcx, rax
call fcn.140017d70
mov r13, rax
mov dword [rbp + 0x88], 3
mov qword [rbp + 0x80], rax
mov rdx, qword [rsi]
mov r8, rax
nop dword [rax]
movzx ecx, word [rdx]
mov word [r8], cx
lea rdx, [rdx + 2]
lea r8, [r8 + 2]
test cx, cx
jne 0x140052b90
movsxd rcx, dword [rbx - 0x10]
inc rcx
mov eax, 2
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.140017d70
mov r15, rax
mov dword [rbp + 0x98], 3
mov qword [rbp + 0x90], rax
mov rdx, rbx
mov r8, rax
sub r8, rbx
nop dword [rax]
movzx ecx, word [rdx]
mov word [r8 + rdx], cx
lea rdx, [rdx + 2]
test cx, cx
jne 0x140052be0
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
mov dword [rbp - 0x30], 0x70
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], r15
mov dword [rbp - 0x2c], 0x800140
mov dword [rbp], 1
mov rcx, qword [0x14022a428]
test rcx, rcx
je 0x140052c6a
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x50]
test rax, rax
je 0x140052c6a
mov r10, qword [rax]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9, str.Performing_ShellExecute...
mov r8, qword [rsp + 0x48]
mov edx, dword [rsp + 0x40]
mov rcx, rax
call qword [r10 + 0x10]
lea rcx, [rbp - 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
movsxd r12, dword [rbp + 8]
mov rsi, qword [rbp + 0x38]
test r15, r15
je 0x140052c8a
mov rcx, r15
call fcn.140017d60
nop
test r13, r13
je 0x140052c97
mov rcx, r13
call fcn.140017d60
cmp r12d, 0x20
jle 0x140052d02
test rsi, rsi
je 0x140052ce9
mov rcx, qword [0x14022a428]
test rcx, rcx
je 0x140052ce0
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x50]
test rax, rax
je 0x140052cf1
mov r10, qword [rax]
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
lea r9, str.Running_process...
mov r8, qword [rsp + 0x48]
mov edx, dword [rsp + 0x40]
mov rcx, rax
call qword [r10 + 0x10]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dil, 1
jmp 0x140052dc2
mov dil, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140052dc2
xor ecx, ecx
mov dword [rsp + 0x30], ecx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0xd0], xmm0
mov dword [rsp + 0x30], ecx
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0xc0], xmm1
mov dword [rsp + 0x30], ecx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0xb0], xmm0
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x38], r12
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0xa0], xmm0
mov rcx, qword [0x14022a428]
test rcx, rcx
je 0x140052dc2
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x50]
test rax, rax
je 0x140052dc2
lea rcx, [rbp + 0xa0]
mov qword [rbp - 0x50], rcx
lea rcx, [rbp + 0xb0]
mov qword [rbp - 0x48], rcx
lea rcx, [rbp + 0xc0]
mov qword [rbp - 0x40], rcx
lea rcx, [rbp + 0xd0]
mov qword [rbp - 0x38], rcx
mov r10, qword [rax]
mov dword [rsp + 0x28], 4
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x20], rcx
lea r9, str.Failed_to_start__error__d_
mov r8, qword [rsp + 0x48]
mov edx, dword [rsp + 0x40]
mov rcx, rax
call qword [r10 + 0x10]
nop
lea rdx, [rbx - 0x18]
mov eax, dword [rdx + 0x10]
cmp eax, 0x7ffffc17
je 0x140052def
mov eax, dword [rdx + 0x10]
cmp eax, 0xffffffff
je 0x140052de4
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140052def
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
lea rcx, [rsp + 0x40]
call fcn.14005d290
movzx eax, dil
mov rbx, qword [rsp + 0x220]
add rsp, 0x1e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret