Function at 0x140019f30
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x14010b010]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rdx
mov qword [rbp - 0x19], rdx
mov edx, 0x5c
lea rbx, str.C:Userspaul1_leeDesktopAsusAppServiceAsusAppServiceAsusAppServiceLogSessionHelper.cpp
mov rcx, rbx
call fcn.14008d398
test rax, rax
je 0x140019f8a
mov edx, 0x5c
mov rcx, rbx
call fcn.14008d398
inc rax
jmp 0x140019f8d
mov rax, rbx
lea r9, str.Start
lea r8, str.LogmanCommand
mov edx, 0x123
mov rcx, rax
call fcn.140015b90
xor sil, sil
mov dword [rbp - 0x11], 0xffffffff
xor r14d, r14d
mov qword [rbp - 9], r14
mov qword [rbp + 7], r14
mov qword [rbp + 0xf], 7
mov word [rbp - 9], r14w
lea r8d, [r14 + 0xc]
lea rdx, str._logman.exe_
lea rcx, [rbp - 9]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov qword [rbp + 0x17], r14
mov qword [rbp + 0x27], r14
mov qword [rbp + 0x2f], r14
mov rdx, rdi
lea rcx, [rbp + 0x17]
call sym.AsusAppService.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Construct_lv_contents_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rbp - 0x79], xmm0
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
mov dword [rsp + 0x30], 0x70
mov qword [rsp + 0x38], r14
mov qword [rbp - 0x79], r14
mov dword [rbp - 0x59], r14d
mov dword [rsp + 0x34], 0x40
lea rax, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rax, qword [rbp - 9]
mov qword [rbp - 0x71], rax
lea rax, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rax, qword [rbp + 0x17]
mov qword [rbp - 0x69], rax
lea edx, [r14 + 0x5c]
mov rcx, rbx
call fcn.14008d398
mov rcx, rbx
test rax, rax
je 0x14001a07a
lea edx, [r14 + 0x5c]
call fcn.14008d398
lea rcx, [rax + 1]
mov rax, qword [rbp - 0x69]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x71]
mov qword [rsp + 0x20], rax
lea r9, str.SHELLEXECUTEINFO____F:__s__P:__s
lea r8, str.LogmanCommand
mov edx, 0x135
call fcn.140015b90
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14001a0fa
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x14001a0fa
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14001a0e7
lea rdx, [rbp - 0x11]
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
movzx esi, sil
mov ecx, 1
test eax, eax
cmovne esi, ecx
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x14001a0fa
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x21], r14
mov edx, 0x5c
mov rcx, rbx
call fcn.14008d398
test rax, rax
je 0x14001a11d
mov edx, 0x5c
mov rcx, rbx
call fcn.14008d398
lea rbx, [rax + 1]
movzx esi, sil
mov eax, dword [rbp - 0x11]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], esi
lea r9, str.End___d__0x_08x_
lea r8, str.LogmanCommand
mov edx, 0x148
mov rcx, rbx
call fcn.140015b90
nop
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x14001a188
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a183
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a267
call fcn.140061310
mov qword [rbp + 0x27], r14
mov qword [rbp + 0x2f], 7
mov word [rbp + 0x17], r14w
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x14001a1d9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a1d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a25b
call fcn.140061310
mov qword [rbp + 7], r14
mov qword [rbp + 0xf], 7
mov word [rbp - 9], r14w
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14001a225
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14001a220
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001a261
mov rcx, r8
call fcn.140061310
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 7
mov word [rdi], r14w
mov eax, esi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400612f0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140091d94
nop
call fcn.140091d94
nop
call fcn.140091d94
int3