Function at 0x1400252a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14012a210]
xor rax, rsp
mov qword [rbp + 0x170], rax
movzx edi, r8b
mov rbx, rdx
mov qword [rsp + 0x30], rdx
lea rdx, str.CCApplicationsManager::OpenObject___inside
mov rcx, qword [0x140132990]
call fcn.140011f10
xor sil, sil
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.1400a83f0
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r15d, r15d
test eax, eax
je 0x1400254f7
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], r15w
lea rax, [rsp + 0x60]
mov r14, 0xffffffffffffffff
mov r8, r14
nop
inc r8
cmp word [rax + r8*2], r15w
jne 0x140025350
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140011160
nop
mov r8d, 1
lea rdx, [0x1401001bc]
lea rcx, [rsp + 0x38]
call fcn.140012440
test dil, dil
je 0x1400253fe
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400253f6
lea rsi, [rax + 1]
mov eax, 2
mul rsi
cmovo rax, r14
mov rcx, rax
call fcn.1400a5c74
mov r14, rax
test rsi, rsi
je 0x1400253bc
movzx eax, r15w
mov rdi, r14
mov rcx, rsi
rep stosw word [rdi], ax
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400253c9
mov r8, qword [rbx]
mov r9, qword [rbx + 0x10]
mov rdx, rsi
mov rcx, r14
call fcn.1400b4870
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
mov r9, r14
lea r8, [0x1400258d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov sil, 1
jmp 0x1400254a1
mov r8d, 3
lea rdx, [0x140101c68]
lea rcx, [rsp + 0x38]
call fcn.140012440
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140025422
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x38]
call fcn.140012440
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r8, qword [rsp + 0x38]
lea rdx, str.CCApplicationsManager::OpenObject___wstrExeWithCmdLine______s
mov rcx, qword [0x140132990]
call fcn.140011f10
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x14002548d
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r8, qword [rsp + 0x38]
xor r9d, r9d
mov ecx, dword [rsp + 0x58]
call fcn.140017460
movzx esi, al
jmp 0x1400254a1
lea rdx, str.CCApplicationsManager::OpenObject___ProcessIdToSessionId_Failed
mov rcx, qword [0x140132990]
call fcn.140011f10
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x1400254e3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400254de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025586
call fcn.1400a59a4
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], r15w
lea rdx, str.CCApplicationsManager::OpenObject___Out
mov rcx, qword [0x140132990]
call fcn.140011f10
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140025546
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140025541
add rdx, 0x27
mov rdi, qword [rcx - 8]
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002558c
mov rcx, rdi
call fcn.1400a59a4
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
movzx eax, sil
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400a5460
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400b4704
nop
call fcn.1400b4704
int3