Function at 0x1400a3038
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xb50
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0xb40], rax
mov rdi, rcx
call fcn.1400829dc
lea rcx, [0x140133a90]
xor edx, edx
mov r8d, 0x1018
call fcn.1400a9164
xor r9d, r9d
lea rdx, str.WizardLogo.bmp
lea r8d, [r9 + 0xf]
lea rcx, [0x140107960]
call fcn.14006d848
lea rcx, [0x140107960]
mov dl, 1
mov qword [0x140134aa8], rax
lea rax, str.WIZARDCMD
mov dword [rsp + 0x30], 0x60
mov qword [rsp + 0xa0], rax
lea rax, [0x1400a2460]
mov dword [rsp + 0x34], 0x22a
mov qword [rsp + 0xb8], rax
lea rax, str.WIZARDARC
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0xf8], rax
lea rax, [0x1400a2a30]
mov qword [rsp + 0x110], rax
lea rax, str.WIZARDEXTR
mov qword [rsp + 0x150], rax
lea rax, [0x1400a21d4]
mov qword [rsp + 0x168], rax
lea rax, str.WIZARDADDOPT
mov qword [rsp + 0x1a8], rax
lea rax, [0x1400a27e0]
mov qword [rsp + 0x1c0], rax
mov rax, qword [0x1400ec660]
mov qword [rsp + 0x40], rax
call fcn.14006cce4
xor r12d, r12d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
lea ebx, [r12 + 4]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x60], r12d
mov esi, 0x400
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x58], ebx
lea rdi, [0x140133a94]
lea r14, [0x140105fb0]
lea r13d, [r12 + 2]
cmp byte [0x1400fec05], r12b
je 0x1400a31aa
mov r8, rsi
mov rdx, rdi
mov rcx, r14
call fcn.1400129d4
mov dword [0x140133a90], r12d
mov dword [rsp + 0x60], r13d
mov rdx, qword [0x1400ec660]
lea rax, [rsp + 0x94]
mov rcx, rbx
mov dword [rax - 4], 0x58
mov dword [rax], 0x20
mov qword [rax + 4], rdx
add rax, 0x58
sub rcx, 1
jne 0x1400a31bc
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x30]
lea rcx, [0x1400ec678]
mov r9, rbx
call fcn.1400619c0
lea rcx, [rsp + 0x30]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
lea rdx, [rsp + 0x90]
lea rcx, [0x1400ec678]
cmp rax, r12
mov r8, rbx
setg bpl
call fcn.140060a64
cmp bpl, r12b
je 0x1400a3494
mov eax, dword [0x140133a90]
cmp eax, r12d
je 0x1400a33aa
jle 0x1400a3494
cmp eax, r13d
jg 0x1400a3494
lea rbx, [0x14010e6bc]
mov rcx, rdi
mov rdx, rbx
call fcn.1400a23f8
mov al, byte [0x140134a95]
cmp byte [0x140134a97], r12b
mov byte [0x14010bcbe], al
mov eax, dword [0x14010bc58]
mov dword [0x14010bc7c], 3
cmovne eax, r13d
mov dword [0x14010bc78], r13d
mov dword [0x14010bc58], eax
mov rax, qword [0x140134a98]
mov qword [0x14010bc80], rax
cmp dword [0x140133a90], r13d
jne 0x1400a32d8
mov rcx, rbx
call fcn.140031110
cmp al, r12b
je 0x1400a32d8
xor r9d, r9d
mov r8b, 1
mov rdx, rbx
mov rcx, r14
call fcn.140015af0
cmp eax, 1
jne 0x1400a3391
mov eax, dword [0x1401063c4]
mov dword [0x14010c654], eax
jmp 0x1400a3391
mov rcx, rbx
cmp byte [0x140134a96], r12b
je 0x1400a333e
lea rdx, [0x1400c4068]
call fcn.140052ee0
cmp al, r12b
jne 0x1400a3319
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
mov rax, qword [0x1400c4100]
sub rdi, r13
mov qword [rdi], rax
movzx eax, word [0x1400c4108]
mov word [rdi + 8], ax
mov rcx, r12
lea rdx, [0x140000000]
movzx eax, word [rcx + rdx + 0xc42d4]
mov word [rcx + rdx + 0x108b40], ax
add rcx, r13
cmp ax, r12w
jne 0x1400a3323
jmp 0x1400a3391
cmp dword [0x14010c654], r12d
lea rax, [0x1400c62a8]
lea rsi, [0x1400c3830]
cmove rsi, rax
lea rdx, [rsi + 2]
call fcn.140052ee0
cmp al, r12b
jne 0x1400a3389
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
sub rdi, r13
xor r8d, r8d
movzx eax, word [rsi + r8]
mov word [rdi + r8], ax
add r8, r13
test ax, ax
jne 0x1400a3377
mov word [0x140108b40], r12w
mov dl, 1
mov rcx, rbx
call fcn.14005258c
xor edx, edx
mov rcx, r14
call fcn.140016b48
jmp 0x1400a3494
xor r9d, r9d
mov r8b, 1
mov rdx, rdi
mov rcx, r14
call fcn.140015af0
cmp eax, 1
jne 0x1400a3494
lea rcx, [rsp + 0x340]
mov edx, esi
call fcn.140087408
lea rdi, [0x140134294]
xor edx, edx
mov rcx, rdi
call fcn.140031ba4
mov rcx, rdi
call fcn.1400873f0
lea rdx, [rsp + 0x1f0]
mov rcx, r14
call fcn.1400129f0
call fcn.140082880
lea rdx, [0x14010e6bc]
mov r8, rsi
mov rcx, r14
call fcn.1400129d4
mov edx, dword [rsp + 0x270]
mov rcx, qword [0x14010eec0]
mov dword [0x14010c654], edx
call fcn.14006b784
mov rcx, qword [0x14010eec0]
lea rdx, [0x1400c3120]
call fcn.14006ba48
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.14001731c
lea rcx, [rsp + 0x340]
call fcn.1400873f0
cmp word [0x140134294], r12w
je 0x1400a346b
mov rcx, rdi
call fcn.14005254c
lea rax, [0x1400c3f4c]
lea rdx, str.open
xor r9d, r9d
mov r8, rdi
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, bpl
mov rcx, qword [rsp + 0xb40]
xor rcx, rsp
call fcn.1400a8530
lea r11, [rsp + 0xb50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret