Function at 0x140104430
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 8], 0xfffffffffffffffe
movzx edi, r8b
mov r15, rdx
mov r14, rcx
xor r12d, r12d
mov dword [rbp + 0x58], r12d
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov r8, rax
lea rdx, [0x140157e6c]
lea rcx, [rbp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
nop
lea rcx, [rbp + 0x58]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
mov ebx, eax
lea rcx, [rbp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test ebx, ebx
jne 0x1401044e5
lea rax, [rbp + 0x58]
mov qword [rbp - 0x10], rax
lea rdx, [0x1401497d8]
lea rcx, [rbp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea rdx, [0x14018475c]
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
mov r8, rbx
mov dl, 1
mov rcx, rax
call fcn.140104150
jmp 0x140104722
test dil, dil
jne 0x14010452a
lea rax, [rbp + 0x58]
mov qword [rbp - 0x10], rax
lea rdx, [0x1401497d8]
lea rcx, [rbp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
mov rbx, rax
lea rdx, [0x140184760]
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.140104150
jmp 0x140104722
xor r8d, r8d
lea rdx, str..ps1
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x14010464d
lea rcx, [rbp - 0x18]
call fcn.1400f97c0
nop
mov r8, r15
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140006190
nop
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.powershell__ExecutionPolicy_ByPass__File
lea rcx, [rbp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x10]
call fcn.140006190
nop
lea rcx, [rbp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rsi, rax
mov dword [rbp + 0x58], 2
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov edi, eax
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, [0x1401659b8]
call qword [sym.imp.mfc140u.dll_CCheckListBox::SetSelectionCheck]
mov r8d, eax
mov dword [rsp + 0x20], edi
mov r9, rbx
lea rdx, [0x1401659b8]
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r8, str.cmd.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rbp - 0x10]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
jmp 0x140104717
lea rcx, [rbp + 0x58]
call fcn.1400f97c0
nop
mov r8, r15
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140006190
nop
lea rcx, [rbp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rsi, rax
mov dword [rbp + 0x58], 4
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov edi, eax
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, [0x1401659b8]
call qword [sym.imp.mfc140u.dll_CCheckListBox::SetSelectionCheck]
mov r8d, eax
mov dword [rsp + 0x20], edi
mov r9, rbx
lea rdx, [0x1401659b8]
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r9, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r8, str.cmd.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
mov rcx, r15
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov al, 1
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret