Function at 0x14011fc20
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor edi, edi
mov dword [rsp + 0x40], edi
mov qword [rbp - 0x70], rdi
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x14011fbcb
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rbp - 0x70], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rax
lea rcx, [rsp + 0x68]
call fcn.140022bf0
mov r13, rax
mov qword [rsp + 0x50], rdi
mov rcx, qword [rax]
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x14011f41a
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x20]
call qword [case.0x140038716.0]
mov rcx, rax
test rax, rax
jne 0x14011f43e
call fcn.1400195b0
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140038716.0]
mov rcx, rax
test rax, rax
je 0x14011fbd6
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov r12d, 1
mov dword [rsp + 0x40], r12d
lea rcx, str.VersionNo.ini
mov r14, 0xffffffffffffffff
mov rdi, r14
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x14011f470
mov r13, qword [r13]
movsxd r15, dword [r13 - 0x10]
lea esi, [r15 + rdi]
test esi, esi
js 0x14011fbc0
mov ecx, r12d
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, esi
or eax, ecx
jge 0x14011f4ae
mov edx, esi
lea rcx, [rsp + 0x50]
call fcn.140018ec0
mov rbx, qword [rsp + 0x50]
add r15, r15
je 0x14011f4e4
test rbx, rbx
je 0x14011f4d4
mov r8, r15
mov rcx, rbx
test r13, r13
je 0x14011f4cd
mov rdx, r13
call fcn.1401f61a0
jmp 0x14011f4e4
xor edx, edx
call fcn.1401f6840
call fcn.1401fae4c
mov dword [rax], 0x16
call fcn.1401facac
movsxd r8, edi
add r8, r8
lea rcx, [r15 + rbx]
je 0x14011f513
test rcx, rcx
jne 0x14011f507
call fcn.1401fae4c
mov dword [rax], 0x16
call fcn.1401facac
jmp 0x14011f513
lea rdx, str.VersionNo.ini
call fcn.1401f61a0
cmp esi, dword [rbx - 0xc]
jg 0x14011fbc0
mov dword [rbx - 0x10], esi
movsxd rax, esi
xor r15d, r15d
mov word [rbx + rax*2], r15w
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], r15
mov dword [rbp - 0x38], 0xa
mov qword [rbp - 8], r15
mov qword [rbp], r15
mov dword [rbp + 8], 0xfde9
mov qword [rbp - 0x30], 1
mov dword [rbp - 0x28], r15d
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r15
mov qword [rbp + 0x10], r15
mov rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.140041530
nop
mov eax, r12d
and eax, 0xfffffffe
mov dword [rsp + 0x40], eax
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14011f5a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14011f5cc
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
xor r9d, r9d
lea r8, str.BuildNo
lea rdx, str.Version
lea rcx, [rbp - 0x60]
call fcn.140042f30
mov esi, eax
call fcn.1401285c0
mov rcx, rax
lea rdx, [rsp + 0x70]
call fcn.140129500
mov rdi, rax
call fcn.140163500
mov rbx, qword [rax + 0x508]
mov rdi, qword [rdi]
call fcn.140163500
mov ecx, dword [rax + 0xb8]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, str.https:__ana.bandi.so_bandizip_store.html
lea rdx, str._hidden__s_v_sb_dl_sf_d
lea rcx, [rbp - 0x70]
call fcn.14001c3d0
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14011f665
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
lea rcx, [rsp + 0x78]
call fcn.140022bf0
mov r12, rax
mov qword [rsp + 0x58], r15
mov rcx, qword [rax]
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x14011f698
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x20]
call qword [case.0x140038716.0]
mov rcx, rax
test rax, rax
jne 0x14011f6bc
call fcn.1400195b0
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140038716.0]
mov rcx, rax
test rax, rax
je 0x14011fbe1
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov r13d, dword [rsp + 0x40]
or r13d, 2
mov dword [rsp + 0x40], r13d
lea rcx, str.data_
mov rdi, r14
nop word [rax + rax]
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x14011f6f0
mov r12, qword [r12]
movsxd r15, dword [r12 - 0x10]
lea esi, [r15 + rdi]
test esi, esi
js 0x14011fbb5
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, esi
or eax, ecx
jge 0x14011f731
mov edx, esi
lea rcx, [rsp + 0x58]
call fcn.140018ec0
mov rbx, qword [rsp + 0x58]
add r15, r15
je 0x14011f767
test rbx, rbx
je 0x14011f757
mov r8, r15
mov rcx, rbx
test r12, r12
je 0x14011f750
mov rdx, r12
call fcn.1401f61a0
jmp 0x14011f767
xor edx, edx
call fcn.1401f6840
call fcn.1401fae4c
mov dword [rax], 0x16
call fcn.1401facac
movsxd r8, edi
add r8, r8
lea rcx, [r15 + rbx]
je 0x14011f796
test rcx, rcx
jne 0x14011f78a
call fcn.1401fae4c
mov dword [rax], 0x16
call fcn.1401facac
jmp 0x14011f796
lea rdx, str.data_
call fcn.1401f61a0
cmp esi, dword [rbx - 0xc]
jg 0x14011fbb5
mov dword [rbx - 0x10], esi
movsxd rax, esi
xor edi, edi
mov word [rbx + rax*2], di
mov qword [rsp + 0x60], rdi
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x14011f7ce
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140038716.0]
mov rcx, rax
test rax, rax
jne 0x14011f7f2
call fcn.1400195b0
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140038716.0]
mov rcx, rax
test rax, rax
je 0x14011fbec
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
mov rdx, rax
lea rdi, [rax + 0x18]
mov qword [rsp + 0x60], rdi
or r13d, 4
mov dword [rsp + 0x40], r13d
lea rax, str.web32.exe
mov rsi, r14
nop
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14011f820
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x48], eax
lea r15d, [rax + rsi]
test r15d, r15d
js 0x14011fc0d
mov ecx, 1
sub ecx, dword [rdx + 0x10]
mov eax, dword [rdx + 0xc]
sub eax, r15d
or eax, ecx
jge 0x14011f862
mov edx, r15d
lea rcx, [rsp + 0x60]
call fcn.140018ec0
mov rdi, qword [rsp + 0x60]
movsxd rax, dword [rsp + 0x48]
lea r8, [rax + rax]
mov qword [rsp + 0x48], r8
test r8, r8
je 0x14011f897
test rdi, rdi
jne 0x14011f88c
call fcn.1401fae4c
mov dword [rax], 0x16
call fcn.1401facac
jmp 0x14011f897
mov rdx, rbx
mov rcx, rdi
call fcn.1401f61a0
movsxd r8, esi
add r8, r8
mov rcx, qword [rsp + 0x48]
lea rcx, [rcx + rdi]
je 0x14011f8cb
test rcx, rcx
jne 0x14011f8bf
call fcn.1401fae4c
mov dword [rax], 0x16
call fcn.1401facac
jmp 0x14011f8cb
lea rdx, str.web32.exe
call fcn.1401f61a0
cmp r15d, dword [rdi - 0xc]
jg 0x14011fc0d
mov dword [rdi - 0x10], r15d
movsxd rax, r15d
xor r15d, r15d
mov word [rdi + rax*2], r15w
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9, qword [rbp - 0x70]
mov r8, rdi
lea rdx, [0x140265d30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
and r13d, 0xfffffffb
mov dword [rsp + 0x40], r13d
lea rdx, [rdi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14011f92e
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
and dword [rsp + 0x40], 0xfffffffd
mov eax, r14d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x14011f956
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14011f97d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x14011f9e3
nop word [rax + rax]
lea rdi, [rbx]
mov rbx, qword [rbx]
mov rsi, qword [rdi + 0x18]
test rsi, rsi
je 0x14011f9b4
mov rcx, rsi
call fcn.14003eff0
mov edx, 0x30
mov rcx, rsi
call fcn.1401f3fac
mov qword [rdi + 0x18], r15
mov rsi, qword [rdi + 0x20]
test rsi, rsi
je 0x14011f9d6
mov rcx, rsi
call fcn.140044580
mov edx, 0x48
mov rcx, rsi
call fcn.1401f3fac
mov qword [rdi + 0x20], r15
test rbx, rbx
jne 0x14011f990
mov rbx, qword [rbp - 0x60]
cmp qword [rbp - 0x50], 0
jbe 0x14011fa66
nop word [rax + rax]
mov qword [rsp + 0x48], rbx
test rbx, rbx
je 0x14011fbf7
mov rax, qword [rbx]
mov qword [rbp - 0x60], rax
lea rax, [rbx + 0x10]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov rdx, qword [rax]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14011fa35
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov rax, qword [rbp - 0x40]
mov qword [rbx], rax
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x50]
sub rax, 1
mov qword [rbp - 0x50], rax
jne 0x14011fa5b
lea rcx, [rbp - 0x60]
call fcn.1400446f0
mov rax, qword [rbp - 0x50]
test rax, rax
je 0x14011fa66
mov rbx, qword [rbp - 0x60]
jmp 0x14011f9f0
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x40], r15
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14011fa94
nop dword [rax + rax]
mov rbx, qword [rcx]
call fcn.140203254
mov rcx, rbx
test rbx, rbx
jne 0x14011fa80
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x30], r15
mov dword [rbp - 0x28], r15d
mov rbx, qword [rbp + 0x10]
test rbx, rbx
je 0x14011faba
mov rcx, rbx
call fcn.140044580
mov edx, 0x48
mov rcx, rbx
call fcn.1401f3fac
mov qword [rbp + 0x10], r15
cmp qword [rbp - 0x50], 0
jbe 0x14011fb39
mov rbx, qword [rbp - 0x60]
mov qword [rbp - 0x78], rbx
test rbx, rbx
je 0x14011fc02
mov rax, qword [rbx]
mov qword [rbp - 0x60], rax
lea rax, [rbx + 0x10]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x48], rax
mov rdx, qword [rax]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14011fb0e
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov rax, qword [rbp - 0x40]
mov qword [rbx], rax
mov qword [rbp - 0x40], rbx
mov rax, qword [rbp - 0x50]
sub rax, 1
mov qword [rbp - 0x50], rax
jne 0x14011fb34
lea rcx, [rbp - 0x60]
call fcn.1400446f0
mov rax, qword [rbp - 0x50]
test rax, rax
jne 0x14011fac5
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x40], r15
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14011fb64
nop
mov rbx, qword [rcx]
call fcn.140203254
mov rcx, rbx
test rbx, rbx
jne 0x14011fb50
mov qword [rbp - 0x48], r15
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x14011fb88
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1401f3bf0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80070057
call fcn.140019320
nop
mov ecx, 0x80070057
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80070057
call fcn.140019320
int3
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov ebp, ecx
mov dword [rsp + 0x20], 0
call fcn.1400dfe10
cmp dword [rax + 0x10], 0
jne 0x14011fe93
call fcn.140163500
mov rbx, rax
call fcn.1401285c0
cmp dword [rax + 0x120], 0
je 0x14011fc68
cmp dword [rbx + 0x1a8], 2
je 0x14011fe93
call fcn.140022a90
test eax, eax
je 0x14011fe93
call fcn.1401ab2a0
mov ebx, eax
call fcn.140163500
cmp ebx, dword [rax + 0xd4]
je 0x14011fe93
call fcn.140163500
mov dword [rax + 0xd4], ebx
call fcn.140163500
mov rcx, rax
xor edx, edx
call fcn.14016a570
call fcn.1400dfe10
cmp byte [rax + 0x14], 0
je 0x14011fcc3
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
jmp 0x14011f360
lea rcx, [rsp + 0x78]
call fcn.140022bf0
mov esi, 1
mov dword [rsp + 0x20], esi
lea r8, str.langs_
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x30]
call fcn.1400179d0
mov rbx, rax
call fcn.140163500
lea r8, [rax + 0x508]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140029020
mov rbx, rax
lea rcx, [rsp + 0x88]
call fcn.140022bf0
nop
lea r8, str.updater.exe
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.1400179d0
nop
mov r8, qword [rbx]
mov rdx, qword [rax]
lea rcx, str.LaunchUpdater______s___s
call fcn.140021520
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, esi
jg 0x14011fd71
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14011fd9a
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14011fdc0
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14011fde5
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
and esi, 0xfffffffe
mov dword [rsp + 0x20], esi
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14011fe11
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
lea rcx, [rsp + 0x40]
call fcn.140022bf0
nop
lea r8, str.updater.exe
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400179d0
mov rbx, rax
call fcn.1401b0030
mov rcx, rax
xor r9d, r9d
mov r8d, ebp
mov rdx, qword [rbx]
call fcn.1401b00b0
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14011fe70
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14011fe93
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret