Function at 0x100004190
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0xf0]
mov qword [rbp - 8], rcx
mov qword [rbp - 0xb8], 0
mov qword [rbp - 0xb0], 0
mov qword [rbp - 0xa8], 0
mov qword [rbp - 0xa0], 0
mov qword [rbp - 0x98], 0
mov qword [rbp - 0x90], 0
mov qword [rbp - 0x88], 0
mov qword [rbp - 0x80], 0
mov qword [rbp - 0x78], 0
mov qword [rbp - 0x70], 0
mov qword [rbp - 0x68], 0
mov qword [rbp - 0x28], 0
nop
lea rcx, [rbp - 0x28]
call fcn.1000084a0
mov eax, 0x53
lea rcx, [rbp - 0x68]
mov edx, eax
call dbg.FOLLOWWINGBONUSBALCONY
mov rax, qword [rbp - 0x68]
mov qword [rbp - 0x60], rax
mov edx, 0x5d
lea rcx, [rbp - 0x70]
call dbg.FOLLOWWINGBONUSBALCONY
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x58], rax
mov edx, 0x54
lea rcx, [rbp - 0x78]
call dbg.FOLLOWWINGBONUSBALCONY
mov rax, qword [rbp - 0x78]
mov qword [rbp - 0x50], rax
mov edx, 0x77
lea rcx, [rbp - 0x80]
call dbg.FOLLOWWINGBONUSBALCONY
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x48], rax
mov edx, 0x55
lea rcx, [rbp - 0x88]
call dbg.FOLLOWWINGBONUSBALCONY
mov rax, qword [rbp - 0x88]
mov qword [rbp - 0x40], rax
mov edx, 0x68
lea rcx, [rbp - 0x90]
call dbg.FOLLOWWINGBONUSBALCONY
mov rax, qword [rbp - 0x90]
mov qword [rbp - 0x38], rax
mov edx, 0x55
lea rcx, [rbp - 0x98]
call dbg.FOLLOWWINGBONUSBALCONY
mov rax, qword [rbp - 0x98]
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x60]
xor r9d, r9d
mov r8d, 6
lea rcx, [rbp - 0x28]
call fcn.100008910
mov rax, qword [rbp - 0x28]
test rax, rax
jne 0x1000042f3
lea rax, [0x100029550]
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0xa0]
call fcn.1000084a0
mov edx, 0x5f
lea rcx, [rbp - 0x98]
call dbg.FOLLOWWINGBONUSBALCONY
mov rax, qword [rbp - 0x98]
mov qword [rbp - 0x60], rax
mov edx, 0x60
lea rcx, [rbp - 0x90]
call dbg.FOLLOWWINGBONUSBALCONY
mov rax, qword [rbp - 0x90]
mov qword [rbp - 0x58], rax
mov edx, 0x55
lea rcx, [rbp - 0x88]
call dbg.FOLLOWWINGBONUSBALCONY
mov rax, qword [rbp - 0x88]
mov qword [rbp - 0x50], rax
mov edx, 0x5e
lea rcx, [rbp - 0x80]
call dbg.FOLLOWWINGBONUSBALCONY
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x60]
xor r9d, r9d
mov r8d, 3
lea rcx, [rbp - 0xa0]
call fcn.100008910
mov rax, qword [rbp - 0xa0]
test rax, rax
jne 0x100004399
lea rax, [0x100029550]
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0xa8]
call fcn.1000084a0
mov edx, 0x76
lea rcx, [rbp - 0x98]
call dbg.FOLLOWWINGBONUSBALCONY
mov rax, qword [rbp - 0x98]
mov qword [rbp - 0x40], rax
mov edx, 0x39
lea rcx, [rbp - 0x90]
call dbg.FOLLOWWINGBONUSBALCONY
mov rax, qword [rbp - 0x90]
mov qword [rbp - 0x38], rax
mov edx, 0x7d
lea rcx, [rbp - 0x88]
call dbg.FOLLOWWINGBONUSBALCONY
mov rax, qword [rbp - 0x88]
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x40]
xor r9d, r9d
mov r8d, 2
lea rcx, [rbp - 0xa8]
call fcn.100008910
mov rax, qword [rbp - 0xa8]
test rax, rax
jne 0x100004429
lea rax, [0x100029550]
mov qword [rbp - 0x20], rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea rcx, [rbp - 0xb0]
call fcn.1000084a0
mov rdx, qword [rbp - 0x20]
xor r8d, r8d
lea rcx, [rbp - 0xb8]
call fcn.100008f90
mov rdx, qword [rbp - 0xb8]
mov r8, qword [rbp - 8]
xor r9d, r9d
lea rcx, [rbp - 0xb0]
call fcn.100008640
mov r9, qword [rbp - 0xb0]
test r9, r9
jne 0x10000448a
lea r9, [0x100029550]
mov r8, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
xor ecx, ecx
call sub.shell32.dll_ShellExecuteA
nop
mov rcx, rbp
call dbg.fin$000001E8
nop
lea rsp, [rbp]
pop rbp
ret