Function at 0x1401822f0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rbx, rdx
mov r14, rcx
mov rsi, qword [rcx]
mov rdi, qword [rsi + 0x2f0]
cmp dword [rdx + 0x48], 0xf
je 0x14018236b
mov dword [rdx + 0x48], 0xf
movzx eax, byte [rdx + 0x40]
shr al, 4
test al, 1
jne 0x14018234a
mov rcx, rdx
call fcn.1400daa90
mov dl, 1
mov rcx, rax
call fcn.1400e4c90
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], 4
lea rcx, [rsi + 0x390]
lea r8, [rsp + 0x48]
mov rdx, rsi
call fcn.14011b550
lea r15, [0x14034d1a0]
mov qword [rsp + 0x58], r15
xor ebp, ebp
mov qword [rsp + 0x60], rbp
lea r8, [rsp + 0x58]
mov rdx, rbx
mov rcx, r14
call fcn.1401825a0
mov esi, eax
lea edx, [rax + 2]
cmp edx, 1
jbe 0x1401824cc
test eax, eax
jne 0x140182410
cmp qword [rdi + 8], rbp
je 0x1401823d3
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov rcx, rax
mov dword [rsp + 0x30], 0x13
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 2]
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x1401823da
mov byte [rdi + 0xaf], 0
mov r8, qword [r14]
xor edx, edx
mov rcx, rbx
call fcn.1400db3f0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov r8, qword [rsp + 0x58]
lea rdx, str.OPEN
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x140182569
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], rbp
lea r8, [rsp + 0x48]
mov rdx, rbx
mov rcx, r14
call fcn.140182e20
mov esi, eax
test eax, eax
jne 0x1401824bb
cmp qword [rdi + 8], 0
je 0x140182468
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov rcx, rax
mov dword [rsp + 0x30], 0x13
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
lea rdx, [r9 - 2]
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x14018246f
mov byte [rdi + 0xaf], 0
mov r8, qword [r14]
xor edx, edx
mov rcx, rbx
call fcn.1400db3f0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov r8, qword [rsp + 0x48]
lea rdx, str.OPEN
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
cmp dword [rsp + 0x50], 0
jle 0x140182569
mov rcx, qword [rsp + 0x48]
call fcn.1402bd0e0
jmp 0x140182569
cmp dword [rsp + 0x50], 0
jle 0x1401824cc
mov rcx, qword [rsp + 0x48]
call fcn.1402bd0e0
mov rdi, qword [r14]
cmp dword [rbx + 0x48], 6
je 0x14018251a
mov dword [rbx + 0x48], 6
movzx eax, byte [rbx + 0x40]
shr al, 4
test al, 1
jne 0x1401824f9
mov rcx, rbx
call fcn.1400daa90
mov dl, 1
mov rcx, rax
call fcn.1400e4c90
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], 4
lea rcx, [rdi + 0x390]
lea r8, [rsp + 0x48]
mov rdx, rdi
call fcn.14011b550
cmp esi, 0xffffffff
jne 0x140182537
mov rax, qword [r14]
mov rcx, qword [rax + 0x2f0]
mov rax, qword [rcx]
call qword [rax]
lea rdx, str.API_key_invalid__result__1_
jmp 0x140182552
cmp esi, 0xfffffffe
jne 0x140182569
mov rax, qword [r14]
mov rcx, qword [rax + 0x2f0]
mov rax, qword [rcx]
call qword [rax]
lea rdx, str.Quota_exceeded__result__2__r_n_r_nVirusTotal_allows_20_requests_of_any_nature_in_a_given_5_minutes_time_frame._r_n_r_nTry_again_in_a_few_minutes.
mov r9d, 0x30
lea r8, str.VirusTotal
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
cmp dword [rsp + 0x60], 0
jle 0x14018257a
mov rcx, qword [rsp + 0x58]
call fcn.1402bd0e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret