Function at 0x1000c7cf0
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0xb0]
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], rsi
mov qword [rbp - 8], rcx
mov byte [rbp - 0x10], dl
mov rcx, qword [rbp - 8]
call fcn.100008e80
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x68], 0
mov qword [rbp - 0x60], 0
mov qword [rbp - 0x58], 0
nop
mov byte [rbp - 0x14], 0
cmp qword [rbp - 8], 0
je 0x1000c7d52
jmp 0x1000c7d58
jmp 0x1000c801b
lea rax, [rbp - 0x20]
mov rbx, rax
mov rcx, rbx
call fcn.10000a970
lea rsi, [rbp - 0x28]
mov rcx, rsi
call fcn.10000a970
mov rdx, rsi
mov rcx, rbx
call fcn.1000c7790
test al, al
jne 0x1000c7d87
jmp 0x1000c7fa0
mov rdx, qword [rbp - 0x28]
mov r8, 1
lea rcx, [0x1001fcf70]
call fcn.10000b3f0
cmp rax, 0
jg 0x1000c7da9
jmp 0x1000c7ec0
mov rdx, qword [rbp - 0x28]
mov r8, 1
lea rcx, [0x1001fcda8]
call fcn.10000b3f0
test rax, rax
je 0x1000c7dc7
jmp 0x1000c7e18
cmp byte [rbp - 0x10], 0
jne 0x1000c7dcf
jmp 0x1000c7e18
mov rcx, qword [rbp - 0x20]
call fcn.1000c72b0
test al, al
je 0x1000c7dde
jmp 0x1000c7e18
lea rax, [0x1001fcd28]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x48], rax
lea rax, [0x1001fcd28]
mov qword [rbp - 0x40], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 8]
mov r9d, 0
mov r8, 2
call fcn.1000092a0
nop
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x58]
call fcn.10000bad0
mov rax, qword [rbp - 0x58]
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x38]
mov r8, qword [rbp - 0x40]
test r8, r8
je 0x1000c7e3e
mov r8, qword [r8 - 8]
mov rdx, qword [rbp - 0x40]
test rdx, rdx
jne 0x1000c7e4e
lea rdx, [0x100292460]
call fcn.100033340
mov rax, qword [rbp - 8]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0xb
lea r8, [rbp - 0x50]
mov rdx, qword [rbp - 0x38]
mov r9, 0
lea rcx, [rbp - 0x60]
call fcn.100053780
mov rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x38]
call fcn.100008eb0
mov r8, qword [rbp - 0x38]
test r8, r8
je 0x1000c7e95
mov r8, qword [r8 - 8]
mov rdx, qword [rbp - 0x38]
test rdx, rdx
jne 0x1000c7ea5
lea rdx, [0x100292460]
lea rcx, [rbp - 0x68]
call fcn.100033250
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x28]
call fcn.10000ba80
jmp 0x1000c7f53
cmp byte [rbp - 0x10], 0
jne 0x1000c7ec8
jmp 0x1000c7f20
mov rdx, qword [rbp - 8]
mov r8, 1
mov ecx, 0x20
call fcn.10000a050
cmp rax, 0
jg 0x1000c7ee5
jmp 0x1000c7f20
lea rax, [0x1001fcd28]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x48], rax
lea rax, [0x1001fcd28]
mov qword [rbp - 0x40], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 8]
mov r9d, 0
mov r8, 2
call fcn.1000092a0
nop dword [rax]
mov r8, qword [rbp - 8]
test r8, r8
je 0x1000c7f2d
mov r8, qword [r8 - 8]
mov rdx, qword [rbp - 8]
test rdx, rdx
jne 0x1000c7f3d
lea rdx, [0x100292460]
lea rcx, [rbp - 0x68]
call fcn.100033250
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x28]
call fcn.10000ba80
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9, qword [rbp - 0x28]
test r9, r9
jne 0x1000c7f74
lea r9, [0x100292460]
mov r8, qword [rbp - 0x20]
test r8, r8
jne 0x1000c7f84
lea r8, [0x100292460]
lea rdx, str.open
mov rcx, 0
call sub.shell32.dll_ShellExecuteW
mov qword [rbp - 0x30], rax
jmp 0x1000c8012
mov r8, qword [rbp - 8]
test r8, r8
je 0x1000c7fad
mov r8, qword [r8 - 8]
mov rdx, qword [rbp - 8]
test rdx, rdx
jne 0x1000c7fbd
lea rdx, [0x100292460]
lea rcx, [rbp - 0x68]
call fcn.100033250
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x28]
call fcn.10000ba80
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r8, qword [rbp - 0x28]
test r8, r8
jne 0x1000c7ff4
lea r8, [0x100292460]
mov r9, 0
mov rdx, 0
mov rcx, 0
call sub.shell32.dll_ShellExecuteW
mov qword [rbp - 0x30], rax
cmp qword [rbp - 0x30], 0x20
seta byte [rbp - 0x14]
nop
mov rcx, rbp
call fcn.1000c7c90
mov al, byte [rbp - 0x14]
mov rbx, qword [rbp - 0x78]
mov rsi, qword [rbp - 0x70]
lea rsp, [rbp]
pop rbp
ret