Function at 0x1000c7200
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0xb0]
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], rsi
mov qword [rbp - 8], rcx
mov byte [rbp - 0x10], dl
mov rcx, qword [rbp - 8]
call fcn.100008e60
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x68], 0
mov qword [rbp - 0x60], 0
mov qword [rbp - 0x58], 0
nop
mov byte [rbp - 0x14], 0
cmp qword [rbp - 8], 0
je 0x1000c7262
jmp 0x1000c7268
jmp 0x1000c752b
lea rax, [rbp - 0x20]
mov rbx, rax
mov rcx, rbx
call fcn.10000a950
lea rsi, [rbp - 0x28]
mov rcx, rsi
call fcn.10000a950
mov rdx, rsi
mov rcx, rbx
call fcn.1000c6ca0
test al, al
jne 0x1000c7297
jmp 0x1000c74b0
mov rdx, qword [rbp - 0x28]
mov r8, 1
lea rcx, [0x1001f83c0]
call fcn.10000b3d0
cmp rax, 0
jg 0x1000c72b9
jmp 0x1000c73d0
mov rdx, qword [rbp - 0x28]
mov r8, 1
lea rcx, [0x1001f81f8]
call fcn.10000b3d0
test rax, rax
je 0x1000c72d7
jmp 0x1000c7328
cmp byte [rbp - 0x10], 0
jne 0x1000c72df
jmp 0x1000c7328
mov rcx, qword [rbp - 0x20]
call fcn.1000c67c0
test al, al
je 0x1000c72ee
jmp 0x1000c7328
lea rax, [0x1001f8178]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x48], rax
lea rax, [0x1001f8178]
mov qword [rbp - 0x40], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 8]
mov r9d, 0
mov r8, 2
call fcn.100009280
nop
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x58]
call fcn.10000bab0
mov rax, qword [rbp - 0x58]
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x38]
mov r8, qword [rbp - 0x40]
test r8, r8
je 0x1000c734e
mov r8, qword [r8 - 8]
mov rdx, qword [rbp - 0x40]
test rdx, rdx
jne 0x1000c735e
lea rdx, [0x100294460]
call fcn.100032ce0
mov rax, qword [rbp - 8]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0xb
lea r8, [rbp - 0x50]
mov rdx, qword [rbp - 0x38]
mov r9, 0
lea rcx, [rbp - 0x60]
call fcn.100052c10
mov rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x38]
call fcn.100008e90
mov r8, qword [rbp - 0x38]
test r8, r8
je 0x1000c73a5
mov r8, qword [r8 - 8]
mov rdx, qword [rbp - 0x38]
test rdx, rdx
jne 0x1000c73b5
lea rdx, [0x100294460]
lea rcx, [rbp - 0x68]
call fcn.100032bf0
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x28]
call fcn.10000ba60
jmp 0x1000c7463
cmp byte [rbp - 0x10], 0
jne 0x1000c73d8
jmp 0x1000c7430
mov rdx, qword [rbp - 8]
mov r8, 1
mov ecx, 0x20
call fcn.10000a030
cmp rax, 0
jg 0x1000c73f5
jmp 0x1000c7430
lea rax, [0x1001f8178]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x48], rax
lea rax, [0x1001f8178]
mov qword [rbp - 0x40], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 8]
mov r9d, 0
mov r8, 2
call fcn.100009280
nop dword [rax]
mov r8, qword [rbp - 8]
test r8, r8
je 0x1000c743d
mov r8, qword [r8 - 8]
mov rdx, qword [rbp - 8]
test rdx, rdx
jne 0x1000c744d
lea rdx, [0x100294460]
lea rcx, [rbp - 0x68]
call fcn.100032bf0
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x28]
call fcn.10000ba60
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9, qword [rbp - 0x28]
test r9, r9
jne 0x1000c7484
lea r9, [0x100294460]
mov r8, qword [rbp - 0x20]
test r8, r8
jne 0x1000c7494
lea r8, [0x100294460]
lea rdx, str.open
mov rcx, 0
call sub.shell32.dll_ShellExecuteW
mov qword [rbp - 0x30], rax
jmp 0x1000c7522
mov r8, qword [rbp - 8]
test r8, r8
je 0x1000c74bd
mov r8, qword [r8 - 8]
mov rdx, qword [rbp - 8]
test rdx, rdx
jne 0x1000c74cd
lea rdx, [0x100294460]
lea rcx, [rbp - 0x68]
call fcn.100032bf0
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x28]
call fcn.10000ba60
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r8, qword [rbp - 0x28]
test r8, r8
jne 0x1000c7504
lea r8, [0x100294460]
mov r9, 0
mov rdx, 0
mov rcx, 0
call sub.shell32.dll_ShellExecuteW
mov qword [rbp - 0x30], rax
cmp qword [rbp - 0x30], 0x20
seta byte [rbp - 0x14]
nop
mov rcx, rbp
call fcn.1000c71a0
mov al, byte [rbp - 0x14]
mov rbx, qword [rbp - 0x78]
mov rsi, qword [rbp - 0x70]
lea rsp, [rbp]
pop rbp
ret