Function at 0x1400a31f0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xb50
mov rax, qword [0x1400e0920]
xor rax, rsp
mov qword [rsp + 0xb40], rax
mov rdi, rcx
call fcn.140082b54
lea rcx, [0x140131710]
xor edx, edx
mov r8d, 0x1018
call fcn.1400a9314
xor r9d, r9d
lea rdx, str.WizardLogo.bmp
lea r8d, [r9 + 0xf]
lea rcx, [0x140107990]
call fcn.14006d9d4
lea rcx, [0x140107990]
mov dl, 1
mov qword [0x140132728], rax
lea rax, str.WIZARDCMD
mov dword [rsp + 0x30], 0x60
mov qword [rsp + 0xa0], rax
lea rax, [0x1400a25dc]
mov dword [rsp + 0x34], 0x22a
mov qword [rsp + 0xb8], rax
lea rax, str.WIZARDARC
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0xf8], rax
lea rax, [0x1400a2be8]
mov qword [rsp + 0x110], rax
lea rax, str.WIZARDEXTR
mov qword [rsp + 0x150], rax
lea rax, [0x1400a2350]
mov qword [rsp + 0x168], rax
lea rax, str.WIZARDADDOPT
mov qword [rsp + 0x1a8], rax
lea rax, [0x1400a295c]
mov qword [rsp + 0x1c0], rax
mov rax, qword [0x1400ec660]
mov qword [rsp + 0x40], rax
call fcn.14006ce3c
xor r12d, r12d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
lea ebx, [r12 + 4]
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x60], r12d
mov esi, 0x400
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x58], ebx
lea rdi, [0x140131714]
lea r14, [0x140105fe0]
lea r13d, [r12 + 2]
cmp byte [0x1400fec05], r12b
je 0x1400a3362
mov r8, rsi
mov rdx, rdi
mov rcx, r14
call fcn.140012a08
mov dword [0x140131710], r12d
mov dword [rsp + 0x60], r13d
mov rdx, qword [0x1400ec660]
lea rax, [rsp + 0x94]
mov rcx, rbx
mov dword [rax - 4], 0x58
mov dword [rax], 0x20
mov qword [rax + 4], rdx
add rax, 0x58
sub rcx, 1
jne 0x1400a3374
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x30]
lea rcx, [0x1400ec678]
mov r9, rbx
call fcn.140061a30
lea rcx, [rsp + 0x30]
call qword [sym.imp.COMCTL32.dll_PropertySheetW]
lea rdx, [rsp + 0x90]
lea rcx, [0x1400ec678]
cmp rax, r12
mov r8, rbx
setg bpl
call fcn.140060ad4
cmp bpl, r12b
je 0x1400a364c
mov eax, dword [0x140131710]
cmp eax, r12d
je 0x1400a3562
jle 0x1400a364c
cmp eax, r13d
jg 0x1400a364c
lea rbx, [0x14010e71c]
mov rcx, rdi
mov rdx, rbx
call fcn.1400a2574
mov al, byte [0x140132715]
cmp byte [0x140132717], r12b
mov byte [0x14010bcee], al
mov eax, dword [0x14010bc88]
mov dword [0x14010bcac], 3
cmovne eax, r13d
mov dword [0x14010bca8], r13d
mov dword [0x14010bc88], eax
mov rax, qword [0x140132718]
mov qword [0x14010bcb0], rax
cmp dword [0x140131710], r13d
jne 0x1400a3490
mov rcx, rbx
call fcn.140031164
cmp al, r12b
je 0x1400a3490
xor r9d, r9d
mov r8b, 1
mov rdx, rbx
mov rcx, r14
call fcn.140015b20
cmp eax, 1
jne 0x1400a3549
mov eax, dword [0x1401063f4]
mov dword [0x14010c6b4], eax
jmp 0x1400a3549
mov rcx, rbx
cmp byte [0x140132716], r12b
je 0x1400a34f6
lea rdx, [0x1400c4068]
call fcn.140052f1c
cmp al, r12b
jne 0x1400a34d1
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
mov rax, qword [0x1400c4100]
sub rdi, r13
mov qword [rdi], rax
movzx eax, word [0x1400c4108]
mov word [rdi + 8], ax
mov rcx, r12
lea rdx, [0x140000000]
movzx eax, word [rcx + rdx + 0xc42d4]
mov word [rcx + rdx + 0x108b70], ax
add rcx, r13
cmp ax, r12w
jne 0x1400a34db
jmp 0x1400a3549
cmp dword [0x14010c6b4], r12d
lea rax, [0x1400c62a8]
lea rsi, [0x1400c3830]
cmove rsi, rax
lea rdx, [rsi + 2]
call fcn.140052f1c
cmp al, r12b
jne 0x1400a3541
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
sub rdi, r13
xor r8d, r8d
movzx eax, word [rsi + r8]
mov word [rdi + r8], ax
add r8, r13
test ax, ax
jne 0x1400a352f
mov word [0x140108b70], r12w
mov dl, 1
mov rcx, rbx
call fcn.1400525c8
xor edx, edx
mov rcx, r14
call fcn.140016b98
jmp 0x1400a364c
xor r9d, r9d
mov r8b, 1
mov rdx, rdi
mov rcx, r14
call fcn.140015b20
cmp eax, 1
jne 0x1400a364c
lea rcx, [rsp + 0x340]
mov edx, esi
call fcn.140087598
lea rdi, [0x140131f14]
xor edx, edx
mov rcx, rdi
call fcn.140031c00
mov rcx, rdi
call fcn.140087580
lea rdx, [rsp + 0x1f0]
mov rcx, r14
call fcn.140012a24
call fcn.1400829f8
lea rdx, [0x14010e71c]
mov r8, rsi
mov rcx, r14
call fcn.140012a08
mov edx, dword [rsp + 0x270]
mov rcx, qword [0x14010ef20]
mov dword [0x14010c6b4], edx
call fcn.14006b85c
mov rcx, qword [0x14010ef20]
lea rdx, [0x1400c3120]
call fcn.14006bb20
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.140017374
lea rcx, [rsp + 0x340]
call fcn.140087580
cmp word [0x140131f14], r12w
je 0x1400a3623
mov rcx, rdi
call fcn.140052588
lea rax, [0x1400c3f4c]
lea rdx, str.open
xor r9d, r9d
mov r8, rdi
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov al, bpl
mov rcx, qword [rsp + 0xb40]
xor rcx, rsp
call fcn.1400a86e0
lea r11, [rsp + 0xb50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret