Function at 0x14000ebe0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x68]
sub rsp, 0x150
mov qword [rbp], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140133088]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov rbx, rcx
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9d, dword [rsp + 0x4c]
mov r8d, dword [rsp + 0x48]
mov edx, 0x100
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.USER32.dll_TrackPopupMenu]
mov esi, eax
mov edx, eax
sub edx, 2
je 0x14000f153
sub edx, 4
je 0x14000f132
sub edx, 1
je 0x14000f0f4
cmp edx, 1
je 0x14000f0b8
call fcn.140002e90
lea rdx, [rax + 0xf0]
lea rcx, [rbp - 0x18]
call fcn.14000f300
nop
mov r9, qword [rbp - 0x18]
mov rbx, r9
mov r8, qword [rbp - 0x10]
cmp r9, r8
je 0x14000ecea
nop word [rax + rax]
mov edi, dword [rbx]
lea eax, [rdi + 0x3e8]
lea ecx, [rax + rax*4]
add ecx, ecx
mov edx, esi
sub edx, ecx
je 0x14000ee74
sub edx, 1
je 0x14000edd2
sub edx, 1
je 0x14000ed79
cmp edx, 1
je 0x14000ed5d
add rbx, 0x405
cmp rbx, r8
jne 0x14000ecb0
sub r8, r9
movabs rax, 0x7f60c70736fb45e9
imul r8
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov eax, esi
sub eax, edx
cmp eax, 0x3e8
mov eax, dword [0x140137428]
jne 0x14000efce
test al, 1
jne 0x14000ed4a
or eax, 1
mov dword [0x140137428], eax
call fcn.1400047b0
lea rax, vtable.RC::RCSingleton_class_RC::HaoZipCDBizApplicate_.0
mov qword [0x140137160], rax
lea rcx, [0x1400e24d0]
call fcn.1400a6be4
nop
mov dl, 1
lea rcx, [0x140137160]
call fcn.1400074d0
jmp 0x14000f0aa
test edi, edi
js 0x14000f0aa
call fcn.140002e90
mov rcx, rax
mov edx, edi
call fcn.140007280
jmp 0x14000f0aa
lea rdx, [rbx + 5]
cmp word [rdx], 0
je 0x14000f0aa
movdqa xmm0, xmmword [0x1400fe370]
movdqu xmmword [rbp + 0x38], xmm0
mov word [rbp + 0x28], r14w
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x14000eda0
lea rcx, [rbp + 0x28]
call fcn.1400025d0
nop
call fcn.140002e90
lea rdx, [rbp + 0x28]
call fcn.140004e40
nop
lea rcx, [rbp + 0x28]
call fcn.140002550
jmp 0x14000f0aa
cmp word [rbx + 5], 0
je 0x14000f0aa
call fcn.140002e90
mov rsi, rax
lea rax, [rbp + 8]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x18], r14
mov qword [rbp + 0x20], 7
mov word [rbp + 8], r14w
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2 + 5], 0
jne 0x14000ee10
lea rdx, [rbx + 5]
lea rcx, [rbp + 8]
call fcn.1400025d0
nop
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r14w
xor r8d, r8d
lea rdx, [0x1400f4030]
lea rcx, [rbp + 0x28]
call fcn.1400025d0
call qword [sym.imp.USER32.dll_GetActiveWindow]
nop
mov qword [rsp + 0x20], rax
movzx r9d, byte [rbx + 4]
lea r8, [rbp + 8]
lea rdx, [rbp + 0x28]
mov rcx, rsi
call fcn.140005f50
jmp 0x14000f0aa
cmp word [rbx + 5], 0
je 0x14000f0aa
call fcn.140002e90
mov edi, r14d
movdqa xmm0, xmmword [0x1400fe370]
movdqu xmmword [rbp + 0x18], xmm0
mov word [rbp + 8], r14w
lea rcx, [rbx + 4]
lea r8, [rbp + 8]
call fcn.140021bc0
mov r8d, 1
lea rdx, [0x1400f5740]
lea rcx, [rbp + 8]
call fcn.140009140
lea rbx, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae rbx, qword [rbp + 8]
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x68]
call fcn.1400a8b60
mov dword [rsp + 0x60], 0x70
mov dword [rsp + 0x64], 0x400
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x70], 1
mov qword [rbp - 0x38], r14
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14000ef33
cmp qword [rbp - 0x68], 0x20
seta al
test al, al
jne 0x14000efc0
jmp 0x14000ef42
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x4c7
je 0x14000efc0
lea rbx, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae rbx, qword [rbp + 8]
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x68]
call fcn.1400a8b60
mov dword [rsp + 0x60], 0x70
mov dword [rsp + 0x64], 0x400
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x68], rax
lea rax, str.edit
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x70], 1
mov qword [rbp - 0x38], r14
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14000efb8
cmp qword [rbp - 0x68], 0x20
seta al
jmp 0x14000efc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rcx, [rbp + 8]
call fcn.140002550
jmp 0x14000f0aa
test al, 1
jne 0x14000effb
or eax, 1
mov dword [0x140137428], eax
call fcn.1400047b0
lea rax, vtable.RC::RCSingleton_class_RC::HaoZipCDBizApplicate_.0
mov qword [0x140137160], rax
lea rcx, [0x1400e24d0]
call fcn.1400a6be4
nop
lea rdx, [0x1401372c0]
lea rcx, [rbp - 0x30]
call fcn.14000f420
nop
lea ecx, [rsi - 0x7d0]
test ecx, ecx
js 0x14000f048
mov rax, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x30]
sub rax, rdx
sar rax, 5
cmp ecx, eax
jge 0x14000f048
movsxd rbx, ecx
shl rbx, 5
add rbx, rdx
call fcn.140002e90
mov rcx, rax
xor r8d, r8d
mov rdx, rbx
call fcn.140007190
jmp 0x14000f0a0
cmp esi, 0xa
jne 0x14000f0a0
call fcn.140002e90
mov r14, rax
mov rdi, qword [rax + 0x168]
mov rbx, qword [rax + 0x160]
cmp rbx, rdi
je 0x14000f080
mov rcx, rbx
call fcn.140002550
add rbx, 0x20
cmp rbx, rdi
jne 0x14000f068
mov rbx, qword [r14 + 0x160]
mov qword [r14 + 0x168], rbx
lea rcx, [r14 + 0x118]
call fcn.1400188f0
lea rcx, [r14 + 0x180]
call fcn.1400144d8
nop
lea rcx, [rbp - 0x30]
call fcn.140009090
nop
lea rcx, [rbp - 0x18]
call fcn.140008f30
jmp 0x14000f1d5
mov edx, 3
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.USER32.dll_GetSubMenu]
xor r8d, r8d
lea edx, [r8 + 8]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMenuState]
mov ebx, eax
shr ebx, 3
and bl, 1
call fcn.140002e90
xor bl, 1
movzx edx, bl
call fcn.140008310
jmp 0x14000f1d5
mov edx, 3
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.USER32.dll_GetSubMenu]
xor r8d, r8d
lea edx, [r8 + 7]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMenuState]
mov ebx, eax
shr ebx, 3
not bl
and bl, 1
call fcn.140002e90
mov rcx, rax
movzx edx, bl
call fcn.140008140
jmp 0x14000f1d5
call fcn.140002e90
cmp byte [rax + 0x1a2], r14b
jne 0x14000f1d5
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x14000f1d5
lea rax, [rbp + 0x28]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r14w
xor r8d, r8d
lea rdx, [0x1400f4030]
lea rcx, [rbp + 0x28]
call fcn.1400025d0
nop
mov qword [rbp + 0x18], r14
mov qword [rbp + 0x20], 7
mov word [rbp + 8], r14w
xor r8d, r8d
lea rdx, [0x1400f4030]
lea rcx, [rbp + 8]
call fcn.1400025d0
nop
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
call fcn.140002e90
mov rcx, rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rbp + 0x28]
lea rdx, [rbp + 8]
call fcn.140005f50
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.1400a6810
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret