Function at 0x140019c10
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x14010a010]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rdx
mov qword [rbp - 0x19], rdx
mov edx, 0x5c
lea rbx, str.C:Userspaul1_leeDesktopAsusAppServiceAsusAppServiceAsusAppServiceLogSessionHelper.cpp
mov rcx, rbx
call fcn.14008d088
test rax, rax
je 0x140019c6a
mov edx, 0x5c
mov rcx, rbx
call fcn.14008d088
inc rax
jmp 0x140019c6d
mov rax, rbx
lea r9, str.Start
lea r8, str.LogmanCommand
mov edx, 0x113
mov rcx, rax
call fcn.140015a30
xor sil, sil
mov dword [rbp - 0x11], 0xffffffff
xor r14d, r14d
mov qword [rbp - 9], r14
mov qword [rbp + 7], r14
mov qword [rbp + 0xf], 7
mov word [rbp - 9], r14w
lea r8d, [r14 + 0xc]
lea rdx, str._logman.exe_
lea rcx, [rbp - 9]
call sym.AsusAppService.exe_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov qword [rbp + 0x17], r14
mov qword [rbp + 0x27], r14
mov qword [rbp + 0x2f], r14
mov rdx, rdi
lea rcx, [rbp + 0x17]
call sym.AsusAppService.exe_private:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::_Construct_lv_contents_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64____ptr64
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rbp - 0x79], xmm0
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
mov dword [rsp + 0x30], 0x70
mov qword [rsp + 0x38], r14
mov qword [rbp - 0x79], r14
mov dword [rbp - 0x59], r14d
mov dword [rsp + 0x34], 0x40
lea rax, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rax, qword [rbp - 9]
mov qword [rbp - 0x71], rax
lea rax, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rax, qword [rbp + 0x17]
mov qword [rbp - 0x69], rax
lea edx, [r14 + 0x5c]
mov rcx, rbx
call fcn.14008d088
mov rcx, rbx
test rax, rax
je 0x140019d5a
lea edx, [r14 + 0x5c]
call fcn.14008d088
lea rcx, [rax + 1]
mov rax, qword [rbp - 0x69]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x71]
mov qword [rsp + 0x20], rax
lea r9, str.SHELLEXECUTEINFO____F:__s__P:__s
lea r8, str.LogmanCommand
mov edx, 0x125
call fcn.140015a30
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140019dda
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140019dda
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140019dc7
lea rdx, [rbp - 0x11]
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
movzx esi, sil
mov ecx, 1
test eax, eax
cmovne esi, ecx
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140019dda
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x21], r14
mov edx, 0x5c
mov rcx, rbx
call fcn.14008d088
test rax, rax
je 0x140019dfd
mov edx, 0x5c
mov rcx, rbx
call fcn.14008d088
lea rbx, [rax + 1]
movzx esi, sil
mov eax, dword [rbp - 0x11]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], esi
lea r9, str.End___d__0x_08x_
lea r8, str.LogmanCommand
mov edx, 0x138
mov rcx, rbx
call fcn.140015a30
nop
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x140019e68
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019e63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019f47
call fcn.140061000
mov qword [rbp + 0x27], r14
mov qword [rbp + 0x2f], 7
mov word [rbp + 0x17], r14w
mov rdx, qword [rbp + 0xf]
cmp rdx, 8
jb 0x140019eb9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019eb4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019f3b
call fcn.140061000
mov qword [rbp + 7], r14
mov qword [rbp + 0xf], 7
mov word [rbp - 9], r14w
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140019f05
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140019f00
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140019f41
mov rcx, r8
call fcn.140061000
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 7
mov word [rdi], r14w
mov eax, esi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140060fe0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140091a84
nop
call fcn.140091a84
nop
call fcn.140091a84
int3