Function at 0x1000022c0
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0xf0]
mov qword [rbp - 8], rcx
mov qword [rbp - 0xb8], 0
mov qword [rbp - 0xb0], 0
mov qword [rbp - 0xa8], 0
mov qword [rbp - 0xa0], 0
mov qword [rbp - 0x98], 0
mov qword [rbp - 0x90], 0
mov qword [rbp - 0x88], 0
mov qword [rbp - 0x80], 0
mov qword [rbp - 0x78], 0
mov qword [rbp - 0x70], 0
mov qword [rbp - 0x68], 0
mov qword [rbp - 0x28], 0
nop
lea rcx, [rbp - 0x28]
call fcn.1000065b0
mov eax, 0x1d
lea rcx, [rbp - 0x68]
mov edx, eax
call dbg.CODELYRICS
mov rax, qword [rbp - 0x68]
mov qword [rbp - 0x60], rax
mov edx, 0x27
lea rcx, [rbp - 0x70]
call dbg.CODELYRICS
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x58], rax
mov edx, 0x1e
lea rcx, [rbp - 0x78]
call dbg.CODELYRICS
mov rax, qword [rbp - 0x78]
mov qword [rbp - 0x50], rax
mov edx, 0x41
lea rcx, [rbp - 0x80]
call dbg.CODELYRICS
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x48], rax
mov edx, 0x1f
lea rcx, [rbp - 0x88]
call dbg.CODELYRICS
mov rax, qword [rbp - 0x88]
mov qword [rbp - 0x40], rax
mov edx, 0x32
lea rcx, [rbp - 0x90]
call dbg.CODELYRICS
mov rax, qword [rbp - 0x90]
mov qword [rbp - 0x38], rax
mov edx, 0x1f
lea rcx, [rbp - 0x98]
call dbg.CODELYRICS
mov rax, qword [rbp - 0x98]
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x60]
xor r9d, r9d
mov r8d, 6
lea rcx, [rbp - 0x28]
call fcn.100006a20
mov rax, qword [rbp - 0x28]
test rax, rax
jne 0x100002423
lea rax, [0x100026550]
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0xa0]
call fcn.1000065b0
mov edx, 0x29
lea rcx, [rbp - 0x98]
call dbg.CODELYRICS
mov rax, qword [rbp - 0x98]
mov qword [rbp - 0x60], rax
mov edx, 0x2a
lea rcx, [rbp - 0x90]
call dbg.CODELYRICS
mov rax, qword [rbp - 0x90]
mov qword [rbp - 0x58], rax
mov edx, 0x1f
lea rcx, [rbp - 0x88]
call dbg.CODELYRICS
mov rax, qword [rbp - 0x88]
mov qword [rbp - 0x50], rax
mov edx, 0x28
lea rcx, [rbp - 0x80]
call dbg.CODELYRICS
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x60]
xor r9d, r9d
mov r8d, 3
lea rcx, [rbp - 0xa0]
call fcn.100006a20
mov rax, qword [rbp - 0xa0]
test rax, rax
jne 0x1000024c9
lea rax, [0x100026550]
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0xa8]
call fcn.1000065b0
mov edx, 0x40
lea rcx, [rbp - 0x98]
call dbg.CODELYRICS
mov rax, qword [rbp - 0x98]
mov qword [rbp - 0x40], rax
mov edx, 3
lea rcx, [rbp - 0x90]
call dbg.CODELYRICS
mov rax, qword [rbp - 0x90]
mov qword [rbp - 0x38], rax
mov edx, 0x47
lea rcx, [rbp - 0x88]
call dbg.CODELYRICS
mov rax, qword [rbp - 0x88]
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x40]
xor r9d, r9d
mov r8d, 2
lea rcx, [rbp - 0xa8]
call fcn.100006a20
mov rax, qword [rbp - 0xa8]
test rax, rax
jne 0x100002559
lea rax, [0x100026550]
mov qword [rbp - 0x20], rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea rcx, [rbp - 0xb0]
call fcn.1000065b0
mov rdx, qword [rbp - 0x20]
xor r8d, r8d
lea rcx, [rbp - 0xb8]
call fcn.1000070a0
mov rdx, qword [rbp - 0xb8]
mov r8, qword [rbp - 8]
xor r9d, r9d
lea rcx, [rbp - 0xb0]
call fcn.100006750
mov r9, qword [rbp - 0xb0]
test r9, r9
jne 0x1000025ba
lea r9, [0x100026550]
mov r8, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
xor ecx, ecx
call sub.shell32.dll_ShellExecuteA
nop
mov rcx, rbp
call dbg.fin$00000087
nop
lea rsp, [rbp]
pop rbp
ret