Function at 0x140085f40
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xa68]
sub rsp, 0xb40
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rbx, r8
mov r14, rdx
mov r13, rcx
call fcn.140005220
mov rcx, rax
xor r12d, r12d
mov r9d, r12d
test rax, rax
setne r9b
test r9d, r9d
jne 0x140085f9d
mov ecx, 0x80004005
call fcn.1400051c0
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xa88], rax
or r15, 0xffffffffffffffff
test rbx, rbx
je 0x140085ffc
test rbx, 0xffffffffffff0000
jne 0x140085fe5
movzx ebx, bx
xor edx, edx
mov ecx, ebx
call fcn.14000ba00
test rax, rax
je 0x140086012
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp + 0xa88]
call fcn.14000be60
jmp 0x140086012
mov rax, r15
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140085ff0
jmp 0x140085fff
mov eax, r12d
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0xa88]
call fcn.14000c060
nop
lea r8, [0x140133318]
lea rdx, [0x1401302e0]
lea rcx, [rbp + 0xa88]
call fcn.14008f080
lea r8, [0x14013331c]
lea rdx, [0x140133324]
lea rcx, [rbp + 0xa88]
call fcn.14008f080
mov rbx, qword [rbp + 0xa88]
cmp dword [rbx - 0x10], 0
jl 0x140086280
lea rdx, [0x14013331c]
mov rcx, rbx
call fcn.1400e60d4
test rax, rax
je 0x140086280
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jle 0x140086280
mov r14d, r12d
movsxd rdi, eax
add rdi, 2
lea rdi, [rbx + rdi*2]
mov esi, 1
movzx ecx, word [rdi]
call fcn.1400ec024
cmp eax, 0x53
je 0x1400860ab
movzx ecx, word [rdi]
call fcn.1400ec024
cmp eax, 0x52
jne 0x1400860c0
movzx ecx, word [rdi]
call fcn.1400ec024
cmp eax, 0x53
cmove r14d, esi
add rdi, 2
jmp 0x140086091
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], r12w
xor r8d, r8d
lea rdx, [0x1401226e8]
lea rcx, [rsp + 0x30]
call fcn.1400079e0
nop
cmp word [rdi], 0x5b
jne 0x1400861a9
cmp word [rdi + 2], 0
jne 0x1400860ff
mov r8, r12
jmp 0x14008610e
mov r8, r15
inc r8
cmp word [rdi + r8*2 + 2], 0
jne 0x140086102
lea rdx, [rdi + 2]
lea rcx, [rsp + 0x30]
call fcn.1400079e0
mov edx, 0x5d
xor r8d, r8d
lea rcx, [rsp + 0x30]
call fcn.140007d80
xor r8d, r8d
lea rcx, [rsp + 0x30]
cmp rax, 0xffffffffffffffff
je 0x14008619d
mov r9, rax
lea rdx, [rsp + 0x58]
call fcn.140079ff0
mov rdi, rax
lea rax, [rsp + 0x30]
cmp rax, rdi
je 0x140086189
cmp qword [rsp + 0x48], 8
jb 0x140086168
mov rcx, qword [rsp + 0x30]
call fcn.1400e3e78
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], r12w
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14000c2e0
cmp qword [rsp + 0x70], 8
jb 0x1400861a9
mov rcx, qword [rsp + 0x58]
call fcn.1400e3e78
jmp 0x1400861a9
lea rdx, [0x1401226e8]
call fcn.1400079e0
mov rcx, qword [0x14026edf8]
test rcx, rcx
jne 0x1400861bc
lea rcx, [0x14026ee00]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
mov edi, esi
je 0x1400861cb
mov edi, r12d
xor edx, edx
lea rcx, str.SynTPEnhWndClass
call qword [sym.imp.USER32.dll_FindWindowW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8023
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
test edi, edi
je 0x140086207
mov rdx, qword [r13 + 0x1648]
test rdx, rdx
jne 0x14008620a
lea rdx, [r13 + 0x1650]
jmp 0x14008620a
mov rdx, r12
xor r8d, r8d
lea rcx, [rbp - 0x80]
call fcn.1400ca240
nop
mov dword [rbp + 0x3fc], r14d
lea rcx, [rbp - 0x80]
cmp qword [rsp + 0x40], 0
jne 0x140086239
xor r9d, r9d
mov r8d, esi
xor edx, edx
call fcn.1400cb830
jmp 0x14008625b
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
call fcn.1400ca4c0
nop
lea rcx, [rbp - 0x80]
call fcn.1400ca440
nop
cmp qword [rsp + 0x48], 8
jb 0x1400864f6
mov rcx, qword [rsp + 0x30]
call fcn.1400e3e78
jmp 0x1400864f6
movsxd rdi, dword [rbx - 0x10]
test edi, edi
jns 0x140086293
mov ecx, 0x80070057
call fcn.1400051c0
int3
mov esi, 1
mov ecx, esi
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400862bb
mov edx, edi
lea rcx, [rbp + 0xa88]
call fcn.140009530
mov rbx, qword [rbp + 0xa88]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.1400ec884
cmp edi, dword [rbx - 0xc]
jg 0x14008650f
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], r12w
lea rdx, [0x14013332c]
mov rcx, rbx
call fcn.1400e60d4
test rax, rax
je 0x140086314
mov edx, 0x1b1a
mov rcx, r13
call fcn.140086c80
xor r9d, r9d
xor r8d, r8d
mov edx, 0x47c
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400864f4
lea rdx, [0x140133338]
mov rcx, rbx
call fcn.1400e60d4
test rax, rax
je 0x140086357
lea rdx, [rax + 6]
mov rcx, r13
call fcn.140082ca0
cmp eax, 0xffffffff
je 0x1400864f4
lea r8, str.1Multifinger_Gestures
mov edx, eax
lea rcx, [0x14026d7b0]
call fcn.140083300
jmp 0x1400864f4
lea rdx, [0x140133340]
mov rcx, rbx
call fcn.1400e60d4
test rax, rax
je 0x140086384
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800b
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400864f4
lea rdx, [0x140133348]
mov rcx, rbx
call fcn.1400e60d4
test rax, rax
je 0x1400863a4
mov dword [r13 + 0x7ec], r12d
jmp 0x1400864f4
lea rdx, [0x140133350]
mov rcx, rbx
call fcn.1400e60d4
test rax, rax
je 0x1400863d1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x47d
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400864f4
lea rdx, [0x140133358]
mov rcx, rbx
call fcn.1400e60d4
test rax, rax
je 0x1400863fe
xor r9d, r9d
xor r8d, r8d
mov edx, 0x47e
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400864f4
lea rdx, str._REGPLUGIN
mov rcx, rbx
call fcn.1400e60d4
test rax, rax
je 0x14008642b
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800a
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400864f4
lea rdx, str._PROFILES
mov rcx, rbx
call fcn.1400e60d4
test rax, rax
je 0x140086458
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8028
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400864f4
lea rdx, str._INFORMATION
mov rcx, rbx
call fcn.1400e60d4
test rax, rax
je 0x140086482
xor r9d, r9d
xor r8d, r8d
mov edx, 0x802b
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400864f4
lea rdx, str._SHELLEXEC
mov rcx, rbx
call fcn.1400e60d4
test rax, rax
je 0x1400864d3
add rax, 0x14
mov rcx, r15
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1400864a0
test rcx, rcx
je 0x1400864b3
add rax, 2
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1400864f4
lea rdx, str._PROMO
mov rcx, rbx
call fcn.1400e60d4
test rax, rax
je 0x1400864f4
mov edx, 0x8000
mov rcx, r14
call fcn.1400df090
mov edi, esi
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14008650b
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, edi
jmp 0x14008651a
mov ecx, 0x80070057
call fcn.1400051c0
nop
lea r11, [rsp + 0xb40]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret