Function at 0x1400318a0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov eax, dword [rcx + 0x10]
mov r15, rcx
mov rcx, qword [0x14018e060]
mov r12, rdx
cmp qword [r15], rcx
jne 0x140031912
cmp eax, 0xfffffdd8
jne 0x1400318fe
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x14018df50], eax
xor al, al
add rsp, 0x110
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp eax, 0xfffffdd9
jne 0x1400318ea
mov ecx, dword [0x14018df50]
call fcn.140035550
jmp 0x1400318ea
cmp eax, 0xfffffe02
jne 0x1400318ea
mov eax, dword [0x14018de18]
cmp eax, 1
jne 0x140031b42
cmp byte [0x14018dbaa], al
mov rsi, 0xffffffffffffffff
mov r8, qword [r15 + 0x18]
mov qword [rsp + 0x158], r13
jb 0x1400319b8
mov rdx, r8
mov ecx, r8d
and rdx, 0xfffffffffffffff1
xorps xmm1, xmm1
and ecx, 0xf
je 0x140031975
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
sar eax, cl
bsf ecx, eax
mov dword [rbp + 0x50], ecx
je 0x140031971
mov edx, ecx
shr rdx, 1
jmp 0x1400319cb
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x50], ecx
jne 0x1400319a8
nop dword [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x50], ecx
je 0x140031990
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
jmp 0x1400319cb
mov rdx, rsi
nop dword [rax + rax]
inc rdx
cmp word [r8 + rdx*2], 0
jne 0x1400319c0
lea rax, [rdx + rdx]
mov qword [rbp - 8], r8
lea r8, [rsp + 0x60]
mov qword [rbp - 0x10], rax
lea rdx, [rbp]
lea r9, [rbp + 0x50]
lea rcx, [rbp - 0x10]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhParseCommandLineFuzzy
mov rdi, qword [rbp + 0x50]
xor ebx, ebx
test rdi, rdi
jne 0x140031a38
mov r14, qword [rbp]
mov rdx, qword [0x140191180]
lea rcx, [r14 + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov rdx, qword [rbp + 8]
mov rdi, rax
mov qword [rax], r14
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + r14], bx
test rdx, rdx
je 0x140031a34
mov rcx, qword [rax + 8]
mov r8, r14
call fcn.1401317c0
mov qword [rbp + 0x50], rdi
mov r13, qword [rsp + 0x60]
mov rdx, qword [0x140191180]
lea rcx, [r13 + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov rdx, qword [rsp + 0x68]
mov r14, rax
mov qword [rax], r13
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + r13], bx
test rdx, rdx
je 0x140031a76
mov rcx, qword [rax + 8]
mov r8, r13
call fcn.1401317c0
mov rax, qword [rdi + 8]
xorps xmm0, xmm0
mov rcx, qword [r14 + 8]
xor r8d, r8d
cmp dword [sym.4yUlCM3HuVsHzW5CaCX.exe_WindowsVersion], 0x3c
mov edx, dword [r15 + 0x28]
movups xmmword [rbp - 0x6c], xmm0
mov qword [rbp - 0x68], rax
mov rax, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
movups xmmword [rbp - 0x7c], xmm0
mov qword [rbp - 0x78], rax
lea rax, str.runas
cmovb rax, qword [rbp - 0x70]
movups xmmword [rbp - 0x5c], xmm0
mov qword [rbp - 0x60], rcx
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x80], 0x70
movups xmmword [rbp - 0x4c], xmm0
mov qword [rbp - 0x1c], r8
movups xmmword [rbp - 0x3c], xmm0
mov dword [rbp - 0x14], r8d
movups xmmword [rbp - 0x2c], xmm0
mov dword [rbp - 0x7c], 0x40
mov dword [rbp - 0x50], edx
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov r13, qword [rsp + 0x158]
test eax, eax
je 0x140031b0a
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, 1
jmp 0x140031b0f
mov eax, 2
mov qword [r12], rax
lea rcx, [rdi - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140031b28
call fcn.1400d9400
lea rcx, [r14 - 0x10]
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x140031b3b
call fcn.1400d9400
mov al, 1
jmp 0x1400318ec
cmp eax, 2
jne 0x1400318ea
mov rsi, 0xffffffffffffffff
lea r8, [rbp + 0x68]
mov rcx, rsi
mov edx, 0x600cb
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
mov ebx, eax
cmp eax, 0xc0000022
jne 0x140031b89
cmp byte [0x1401910b4], 0
je 0x140031b89
lea r8, [rbp + 0x68]
mov edx, 0x600cb
mov rcx, rsi
call fcn.1400ecde0
mov ebx, eax
test ebx, ebx
js 0x140031d2c
mov rcx, qword [rbp + 0x68]
lea rdx, [rbp + 0x60]
call fcn.1400d4ef0
mov ebx, eax
test eax, eax
js 0x140031d10
mov r15, qword [r15 + 0x18]
xor ebx, ebx
mov r14d, ebx
test r15, r15
je 0x140031bfe
mov rdi, rsi
nop dword [rax]
inc rdi
cmp word [r15 + rdi*2], bx
jne 0x140031bc0
mov rdx, qword [0x140191180]
add rdi, rdi
lea rcx, [rdi + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov r8, rdi
mov rdx, r15
mov r14, rax
lea rcx, [rax + 0x10]
mov qword [rax], rdi
mov qword [rax + 8], rcx
mov word [rcx + rdi], bx
mov rcx, qword [rax + 8]
call fcn.1401317c0
mov rdi, qword [rbp + 0x60]
xorps xmm0, xmm0
xor eax, eax
mov dword [rbp - 0x80], 0x68
mov dword [rbp - 0x1c], eax
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
test rdi, rdi
jne 0x140031c71
test r14, r14
je 0x140031c39
mov rdx, qword [r14 + 8]
jmp 0x140031c3c
mov rdx, rbx
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp - 0x80]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x140031cb7
test r14, r14
je 0x140031c7c
mov r8, qword [r14 + 8]
jmp 0x140031c7f
mov r8, rbx
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x50], rax
xor edx, edx
lea rax, [rbp - 0x80]
mov rcx, rdi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x140031ccf
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140031ccd
movzx eax, ax
or eax, 0xc0070000
mov ebx, eax
test r14, r14
je 0x140031ced
lea rcx, [r14 - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140031ce9
call fcn.1400d9400
mov rdi, qword [rbp + 0x60]
test ebx, ebx
js 0x140031d07
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140031d2c
mov eax, 1
mov qword [r12], rax
jmp 0x1400318ec
mov rdi, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhMainWndHandle]
cmp ebx, 0xc0000022
je 0x140031d56
cmp ebx, 0xc0000005
je 0x140031d56
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x140031d62
movzx eax, bx
jmp 0x140031d5e
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x140031d6b
mov ecx, ebx
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetNtMessage
jmp 0x140031d72
mov ecx, eax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetWin32Message
lea r9, str.Unable_to_execute_the_program
mov rbx, rax
mov edx, 0x10
mov rcx, rdi
test rax, rax
jne 0x140031d97
lea r8, [0x140166310]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
jmp 0x140031dbf
mov rax, qword [rbx + 8]
lea r8, str._s:__s
mov qword [rsp + 0x20], rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x140031dbf
call fcn.1400d9400
mov eax, 2
mov qword [r12], rax
mov al, 1
jmp 0x1400318ec