Function at 0x1400c31c0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x258]
sub rsp, 0x358
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1402a98a8]
xor rax, rsp
mov qword [rbp + 0x240], rax
movzx edi, r9b
mov r15, r8
mov r14, rdx
mov rsi, rcx
call fcn.14004a380
mov rcx, rax
mov rdx, r14
call fcn.14001f0b0
cmp eax, 0xffffffff
jne 0x1400c325b
mov r8, qword [rsi]
lea rcx, [rsi + 0x478]
xor edi, edi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 0x30
lea rdx, str.Save_failed
mov qword [rsp + 0x20], rdx
lea r9, str.Cannot_save:_Buffer_is_invalid.
mov r8, qword [r8 + 0x18]
lea rdx, str.BufferInvalidWarning
call fcn.14007c160
xor al, al
jmp 0x1400c3731
lea rbx, [rsi + 0x97b18]
test dil, dil
jne 0x1400c328d
mov dword [rsp + 0x60], 0x3ef
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], r14
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400f2e40
call fcn.14004a380
mov rcx, rax
movzx r9d, dil
mov r8, r15
mov rdx, r14
call fcn.1400206a0
mov r14d, eax
test dil, dil
jne 0x1400c32c1
mov dword [rsp + 0x60], 0x3f0
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400f2e40
cmp r14d, 2
jne 0x1400c3308
mov r8, qword [rsi]
lea rcx, [rsi + 0x478]
xor edi, edi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
lea rdx, str.Save_failed
mov qword [rsp + 0x20], rdx
lea r9, str.Failed_to_save_file._nIt_seems_theres_not_enough_space_on_disk_to_save_file.
mov r8, qword [r8 + 0x18]
lea rdx, str.NotEnoughRoom4Saving
call fcn.14007c160
jmp 0x1400c372b
cmp r14d, 1
jne 0x1400c36fb
cmp byte [rsi + 0x97bd9], 0
jne 0x1400c372b
call fcn.14000c990
cmp byte [rax + 0x835], 0
je 0x1400c34bb
cmp byte [rax + 0xd6], 0
je 0x1400c34bb
cmp byte [rax + 0xd7], 0
jne 0x1400c34bb
mov rax, qword [rsi]
xor edi, edi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 4
lea rdx, str.Save_failed
mov qword [rsp + 0x20], rdx
lea r9, str.This_file_cannot_be_saved_and_it_may_be_protected._rDo_you_want_to_launch_Notepad_in_Administrator_mode_
mov r8, qword [rax + 0x18]
lea rdx, str.OpenInAdminMode
lea rcx, [rsi + 0x478]
call fcn.14007c160
cmp eax, 6
jne 0x1400c372b
mov r8d, 0x104
lea rdx, [rbp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x1401e5030]
movdqu xmmword [rbp], xmm1
mov word [rbp - 0x10], di
lea r8d, [r14 + 9]
lea rdx, [0x14021c318]
lea rcx, [rbp - 0x10]
call fcn.140006d70
nop
lea r9, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae r9, qword [rbp - 0x10]
mov rax, qword [rsi]
mov dword [rsp + 0x28], 5
lea rcx, [0x1401e5cd0]
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x30]
lea rdx, str.runas
mov rcx, qword [rax + 0x18]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
mov rax, qword [rsi]
jae 0x1400c3450
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
lea rdx, str.Open_in_Administrator_mode_failed
mov qword [rsp + 0x20], rdx
lea r9, str.Notepad_cannot_be_opened_in_Administrator_mode.
mov r8, qword [rax + 0x18]
lea rdx, str.OpenInAdminModeFailed
lea rcx, [rsi + 0x478]
call fcn.14007c160
jmp 0x1400c3465
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x1400c34a5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c34a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c375c
call fcn.1401812c4
movdqa xmm0, xmmword [0x1401e5030]
movdqu xmmword [rbp], xmm0
mov word [rbp - 0x10], di
jmp 0x1400c372b
mov rax, qword [rsi]
xor edi, edi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 4
lea rdx, str.Save_failed
mov qword [rsp + 0x20], rdx
lea r9, str.The_file_cannot_be_saved_and_it_may_be_protected._rDo_you_want_to_launch_Notepad_in_Administrator_mode_
mov r8, qword [rax + 0x18]
lea rdx, str.OpenInAdminModeWithoutCloseCurrent
lea rcx, [rsi + 0x478]
call fcn.14007c160
cmp eax, 6
jne 0x1400c372b
mov r8d, 0x104
lea rdx, [rbp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, qword [rsi + 0x8d0]
mov rbx, qword [rax + 0x38]
call fcn.14004a380
lea rdx, [rbx + 0xb0]
cmp qword [rdx + 0x18], 8
jb 0x1400c3537
mov rdx, qword [rdx]
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x1401e5030]
movdqu xmmword [rbp], xmm1
mov word [rbp - 0x10], di
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], di
jne 0x1400c3560
lea rcx, [rbp - 0x10]
call fcn.140006d70
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x1401e5030]
movdqu xmmword [rbp + 0x20], xmm1
mov word [rbp + 0x10], di
mov r8d, 0x16
lea rdx, str._multiInst__nosession
lea rcx, [rbp + 0x10]
call fcn.140006d70
nop
mov r8d, 1
lea rdx, [0x1401f4c4c]
lea rcx, [rbp + 0x10]
call fcn.140006aa0
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rdx, qword [rbp - 0x10]
mov r8, qword [rbp]
lea rcx, [rbp + 0x10]
call fcn.140006aa0
mov r8d, 1
lea rdx, [0x1401f4c4c]
lea rcx, [rbp + 0x10]
call fcn.140006aa0
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae r9, qword [rbp + 0x10]
mov rax, qword [rsi]
mov dword [rsp + 0x28], 5
lea rcx, [0x1401e5cd0]
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x30]
lea rdx, str.runas
mov rcx, qword [rax + 0x18]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
jae 0x1400c3666
mov rax, qword [rsi]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
lea rdx, str.Open_in_Administrator_mode_failed
mov qword [rsp + 0x20], rdx
lea r9, str.Notepad_cannot_be_opened_in_Administrator_mode.
mov r8, qword [rax + 0x18]
lea rdx, str.OpenInAdminModeFailed
lea rcx, [rsi + 0x478]
call fcn.14007c160
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x1400c36a6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c36a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c3750
call fcn.1401812c4
movdqa xmm0, xmmword [0x1401e5030]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], di
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x1400c34a5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c34a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c3756
jmp 0x1400c34a0
test r14d, r14d
jne 0x1400c372e
mov rcx, qword [rsi + 0x983e8]
test rcx, rcx
je 0x1400c372b
cmp byte [rcx + 0x80], r14b
jne 0x1400c372b
mov rax, qword [rcx]
call qword [rax + 0x58]
test al, al
je 0x1400c372b
mov rcx, qword [rsi + 0x983e8]
call fcn.14006bdb0
test r14d, r14d
sete al
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.1401813e0
add rsp, 0x358
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1401a2d8c
nop
call fcn.1401a2d8c
int3
call fcn.1401a2d8c
int3