Function at 0x100001f00
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0xf0]
mov qword [rbp - 8], rcx
mov qword [rbp - 0xb8], 0
mov qword [rbp - 0xb0], 0
mov qword [rbp - 0xa8], 0
mov qword [rbp - 0xa0], 0
mov qword [rbp - 0x98], 0
mov qword [rbp - 0x90], 0
mov qword [rbp - 0x88], 0
mov qword [rbp - 0x80], 0
mov qword [rbp - 0x78], 0
mov qword [rbp - 0x70], 0
mov qword [rbp - 0x68], 0
mov qword [rbp - 0x28], 0
nop
lea rcx, [rbp - 0x28]
call fcn.1000084a0
mov eax, 0x78
lea rcx, [rbp - 0x68]
mov edx, eax
call dbg.ENFORCERETREAT
mov rax, qword [rbp - 0x68]
mov qword [rbp - 0x60], rax
mov edx, 0x82
lea rcx, [rbp - 0x70]
call dbg.ENFORCERETREAT
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x58], rax
mov edx, 0x79
lea rcx, [rbp - 0x78]
call dbg.ENFORCERETREAT
mov rax, qword [rbp - 0x78]
mov qword [rbp - 0x50], rax
mov edx, 0x9c
lea rcx, [rbp - 0x80]
call dbg.ENFORCERETREAT
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x48], rax
mov edx, 0x7a
lea rcx, [rbp - 0x88]
call dbg.ENFORCERETREAT
mov rax, qword [rbp - 0x88]
mov qword [rbp - 0x40], rax
mov edx, 0x8d
lea rcx, [rbp - 0x90]
call dbg.ENFORCERETREAT
mov rax, qword [rbp - 0x90]
mov qword [rbp - 0x38], rax
mov edx, 0x7a
lea rcx, [rbp - 0x98]
call dbg.ENFORCERETREAT
mov rax, qword [rbp - 0x98]
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x60]
xor r9d, r9d
mov r8d, 6
lea rcx, [rbp - 0x28]
call fcn.100008910
mov rax, qword [rbp - 0x28]
test rax, rax
jne 0x100002063
lea rax, [0x10002a550]
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0xa0]
call fcn.1000084a0
mov edx, 0x84
lea rcx, [rbp - 0x98]
call dbg.ENFORCERETREAT
mov rax, qword [rbp - 0x98]
mov qword [rbp - 0x60], rax
mov edx, 0x85
lea rcx, [rbp - 0x90]
call dbg.ENFORCERETREAT
mov rax, qword [rbp - 0x90]
mov qword [rbp - 0x58], rax
mov edx, 0x7a
lea rcx, [rbp - 0x88]
call dbg.ENFORCERETREAT
mov rax, qword [rbp - 0x88]
mov qword [rbp - 0x50], rax
mov edx, 0x83
lea rcx, [rbp - 0x80]
call dbg.ENFORCERETREAT
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x60]
xor r9d, r9d
mov r8d, 3
lea rcx, [rbp - 0xa0]
call fcn.100008910
mov rax, qword [rbp - 0xa0]
test rax, rax
jne 0x100002109
lea rax, [0x10002a550]
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0xa8]
call fcn.1000084a0
mov edx, 0x9b
lea rcx, [rbp - 0x98]
call dbg.ENFORCERETREAT
mov rax, qword [rbp - 0x98]
mov qword [rbp - 0x40], rax
mov edx, 0x5e
lea rcx, [rbp - 0x90]
call dbg.ENFORCERETREAT
mov rax, qword [rbp - 0x90]
mov qword [rbp - 0x38], rax
mov edx, 0xa2
lea rcx, [rbp - 0x88]
call dbg.ENFORCERETREAT
mov rax, qword [rbp - 0x88]
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x40]
xor r9d, r9d
mov r8d, 2
lea rcx, [rbp - 0xa8]
call fcn.100008910
mov rax, qword [rbp - 0xa8]
test rax, rax
jne 0x100002199
lea rax, [0x10002a550]
mov qword [rbp - 0x20], rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea rcx, [rbp - 0xb0]
call fcn.1000084a0
mov rdx, qword [rbp - 0x20]
xor r8d, r8d
lea rcx, [rbp - 0xb8]
call fcn.100008f90
mov rdx, qword [rbp - 0xb8]
mov r8, qword [rbp - 8]
xor r9d, r9d
lea rcx, [rbp - 0xb0]
call fcn.100008640
mov r9, qword [rbp - 0xb0]
test r9, r9
jne 0x1000021fa
lea r9, [0x10002a550]
mov r8, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
xor ecx, ecx
call sub.shell32.dll_ShellExecuteA
nop
mov rcx, rbp
call dbg.fin$00000070
nop
lea rsp, [rbp]
pop rbp
ret