Function at 0x140079a20
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xdd0]
sub rsp, 0xef0
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rbp + 0xdc0], rax
mov r12, qword [rbp + 0xe30]
mov r13, qword [rbp + 0xe38]
mov rsi, qword [rbp + 0xe40]
mov rbx, rdx
mov r14, rcx
lea rdx, str.Stub_Plugin.exe
lea rcx, [rbp + 0x260]
mov rdi, r9
mov r15d, r8d
call fcn.1400748e0
lea rcx, [rbp + 0x260]
call fcn.1400e7210
test eax, eax
jne 0x140079aad
lea r8d, [rax + 1]
lea rdx, [rbp + 0x10]
lea rcx, str.Stub_Plugin.exe
call fcn.140077e40
jmp 0x140079cfa
lea rdx, str.z__s
lea rcx, [rbp + 0x10]
mov r8, rdi
call fcn.1400f98c8
lea rcx, [rbp + 0x10]
call fcn.1400743a0
cmp eax, 1
jne 0x140079ae6
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x10]
mov r8d, eax
call fcn.140077e40
jmp 0x140079cfa
mov rcx, qword [0x1401fbb88]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140079b04
mov rcx, qword [0x1401fbb88]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [0x1401fbb00]
call fcn.140077f20
mov qword [0x1401fbb88], rax
test rax, rax
je 0x140079cfa
mov rax, qword [r14]
xor r14d, r14d
lea rcx, [rbp - 0x60]
lea r8d, [r14 + 0x68]
xor edx, edx
mov dword [0x1401fbf68], r14d
mov qword [0x1401fbf78], rax
mov dword [0x1401fbf6c], r14d
mov dword [0x1401fbf70], r14d
mov dword [0x1401f7250], 2
call fcn.1400f9ab0
xor eax, eax
lea r8d, [r14 + 0x3b]
lea edx, [rax + 0x7c]
mov rcx, rsi
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x60], 0x68
call fcn.1400ef610
lea rdx, [rbp + 0x7a0]
lea rcx, [rbp + 0x260]
call fcn.140074980
lea rdx, [rbp + 0x690]
mov rcx, rdi
call fcn.140074980
lea rdx, [rbp + 0x470]
mov rcx, r13
call fcn.140074980
lea rdx, [rbp + 0x580]
mov rcx, rsi
call fcn.140074980
lea rax, [rbp + 0x580]
lea r9d, [r14 + 1]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x90], r12
lea rax, [rbp + 0x690]
mov qword [rsp + 0x88], rax
lea rax, [rbp + 0x470]
lea r8, [rbp + 0x7a0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x78], r14
mov dword [rsp + 0x70], r15d
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
lea rax, [0x140188451]
lea rdx, [0x140189730]
mov qword [rsp + 0x48], rax
mov eax, dword [0x1401f7250]
lea rcx, [rbp + 0x9b0]
mov dword [rsp + 0x40], eax
mov eax, dword [0x1401fbb88]
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], InitCommonControls
call fcn.1400f9828
lea rax, [rbp - 0x80]
lea rdx, [rbp + 0x9b0]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140079cb9
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140079cfa
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rbp + 0x260]
lea rdx, [0x1401897c0]
lea rcx, [rbp + 0x10]
mov r9d, eax
call fcn.1400f98c8
lea r8, [0x140189810]
lea rdx, [rbp + 0x10]
xor r9d, r9d
mov rcx, rbx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [0x1401fbf68], 1
xor eax, eax
mov rcx, qword [rbp + 0xdc0]
xor rcx, rsp
call fcn.1400f9a80
mov rbx, qword [rsp + 0xf30]
add rsp, 0xef0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret