Function at 0x14000b710
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x2d0
mov rax, qword [0x140055008]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov rax, qword [0x140055248]
xorps xmm0, xmm0
mov ebp, ecx
xor edi, edi
lea rcx, [0x140055248]
mov r14, rdx
mov esi, edi
mov rax, qword [rax + 0x18]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [0x1400185c0]
mov r8d, 0x104
lea rdx, [rsp + 0xb0]
xor ecx, ecx
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000b86c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test eax, eax
jle 0x14000b7c3
movzx esi, ax
or esi, 0x80070000
mov edx, 0x114f
mov r10d, esi
mov r11, rdi
lea r9, [0x14003c070]
nop word [rax + rax]
mov eax, edi
mov r8, r10
add rax, rax
mov ecx, edi
mov eax, dword [r9 + rax*8]
sub r8, rax
je 0x14000b810
mov ecx, edx
sub ecx, edi
shr ecx, 1
add ecx, edi
test r8, r8
mov eax, ecx
cmovns eax, edx
cmovns edi, ecx
inc edi
mov edx, eax
cmp eax, edi
jae 0x14000b7e0
jmp 0x14000b818
add rcx, rcx
mov r11, qword [r9 + rcx*8 + 8]
cmp dword [0x140055944], 0
je 0x14000b99a
lea rax, str.::GetModuleFileNameW__0__szPathExe__260__
mov edi, 7
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
movzx edx, di
mov r9d, esi
mov ecx, 0xfffffff4
mov qword [rsp + 0x20], r11
call fcn.1400085c0
cmp dword [0x140055944], 0
je 0x14000b99a
mov dword [rsp + 0x20], 0x6b
jmp 0x14000b97f
lea rdx, [r14 + 8]
lea ecx, [rbp - 1]
lea r8, [rsp + 0x30]
call fcn.14000b9f0
mov rbx, qword [rsp + 0x30]
lea rax, str.runas
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], 0x70
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x70], 1
call qword [sym.imp.ext_ms_win_shell_shell32_l1_2_0.dll_ShellExecuteExW]
test eax, eax
jne 0x14000b99a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test eax, eax
jle 0x14000b8e3
movzx esi, ax
or esi, 0x80070000
mov edx, 0x114f
mov r10d, esi
mov r11, rdi
lea r9, [0x14003c070]
nop word [rax + rax]
mov eax, edi
mov r8, r10
add rax, rax
mov ecx, edi
mov eax, dword [r9 + rax*8]
sub r8, rax
je 0x14000b930
mov ecx, edx
sub ecx, edi
shr ecx, 1
add ecx, edi
test r8, r8
mov eax, ecx
cmovns eax, edx
cmovns edi, ecx
inc edi
mov edx, eax
cmp eax, edi
jae 0x14000b900
jmp 0x14000b938
add rcx, rcx
mov r11, qword [r9 + rcx*8 + 8]
cmp dword [0x140055944], 0
je 0x14000b99a
lea rax, str.::ShellExecuteExW__shex__
mov edi, 7
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
movzx edx, di
mov r9d, esi
mov ecx, 0xfffffff4
mov qword [rsp + 0x20], r11
call fcn.1400085c0
cmp dword [0x140055944], 0
je 0x14000b99a
mov dword [rsp + 0x20], 0x78
lea r9, str.avcoremf_samplesmf360mftracemftracelibmftracehelpers.cpp
movzx edx, di
lea r8, str.___at__s:_i_n
mov ecx, 0xfffffff4
call fcn.1400085c0
lea rdx, [rbx - 0x18]
mov ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14000b9bd
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [0x1400185c0]
mov eax, esi
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.140016790
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret