Function at 0x1800114f0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x9e8]
sub rsp, 0xad0
mov qword [rbp + 0x80], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1800560e0]
xor rax, rsp
mov qword [rbp + 0x9c0], rax
mov r14d, edx
mov rsi, rcx
xor edi, edi
mov dword [rsp + 0x50], edi
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x180]
call fcn.18001be70
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x5a0]
call fcn.18001be70
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x7b0]
call fcn.18001be70
mov r8d, 0x104
lea rdx, [rbp + 0x180]
mov rcx, qword [0x180057e48]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x180]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, str.PDF_Converthead
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x7b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, str.PDF_Convert2
lea rcx, [rbp + 0x7b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [0x180000000]
lea rax, [rcx + 0x3eb48]
mov qword [rbp - 0x80], rax
lea rax, [rcx + 0x3eb50]
mov qword [rbp - 0x70], rax
mov dword [rsp + 0x50], 1
lea rax, vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + 0x18], rax
mov dword [rbp + 0x14], 0x80
mov qword [rbp - 0x78], rdi
xor r8d, r8d
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x18]
call fcn.180014ee0
nop
lea rax, [rbp - 0x70]
mov qword [rsp + 0x58], rax
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx - 0x70], rax
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx - 0x74], edx
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx - 0x80], rax
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x20]
mov dword [rsp + rcx + 0x7c], edx
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx - 0x80], rax
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x7c], edx
lea rax, [rbp - 0x68]
mov qword [rsp + 0x58], rax
lea rcx, [rbp - 0x68]
call fcn.180010070
nop
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp - 0x68], rax
mov qword [rbp], rdi
mov dword [rbp + 8], edi
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmp eax, 0x10
je 0x180011a5c
lea rcx, [rbp + 0x7b0]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x180011a5c
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x390]
call fcn.18001be70
mov dword [rsp + 0x50], 0x208
mov qword [rbp + 0x118], 7
mov qword [rbp + 0x110], rdi
mov word [rbp + 0x100], di
or rbx, 0xffffffffffffffff
cmp word [rsi], di
jne 0x18001173c
mov r8d, edi
jmp 0x18001174b
mov r8, rbx
nop
inc r8
cmp word [rsi + r8*2], 0
jne 0x180011740
mov rdx, rsi
lea rcx, [rbp + 0x100]
call fcn.180003d60
nop
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x140]
call fcn.18000f0b0
nop
mov r8, qword [rbp + 0x118]
cmp r8, 8
jb 0x180011792
inc r8
mov rdx, qword [rbp + 0x100]
lea rcx, [rbp + 0x100]
call fcn.180003eb0
mov qword [rbp + 0x118], 7
mov qword [rbp + 0x110], rdi
mov word [rbp + 0x100], di
lea rcx, [rbp + 0x140]
cmp qword [rbp + 0x158], 0x10
cmovae rcx, qword [rbp + 0x140]
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x390]
mov edx, dword [rbp + 0x150]
call fcn.180001230
lea rdx, [rbp + 0x180]
lea rcx, [rbp - 0x70]
call fcn.18000f6e0
mov rcx, rax
lea rdx, str.PDF_Convert2pdfconverter.exe
call fcn.18000f6e0
lea rdx, str.__from:
lea rcx, [rbp - 0x70]
call fcn.18000f6e0
mov rcx, rax
mov edx, 0xe
call fcn.1800107a0
lea rdx, str.__type:
lea rcx, [rbp - 0x70]
call fcn.18000f6e0
mov rcx, rax
mov edx, r14d
call fcn.1800107a0
lea rdx, str.__vipfrom:
lea rcx, [rbp - 0x70]
call fcn.18000f6e0
mov rcx, rax
lea rdx, str.JiKePDFReader
call fcn.18000f6e0
mov qword [rbp + 0x178], 0xf
mov qword [rbp + 0x170], rdi
mov byte [rbp + 0x160], 0
cmp byte [rbp + 0x390], 0
jne 0x180011876
mov rbx, rdi
jmp 0x180011889
lea rax, [rbp + 0x390]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180011880
mov r8, rbx
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x160]
call fcn.1800022a0
nop
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x120]
call fcn.18000eba0
mov rbx, rax
cmp qword [rax + 0x18], 8
jb 0x1800118c0
mov rbx, qword [rax]
lea rdx, str.__selpath:
lea rcx, [rbp - 0x70]
call fcn.18000f6e0
mov rcx, rax
mov rdx, rbx
call fcn.18000f6e0
nop
mov r8, qword [rbp + 0x138]
cmp r8, 8
jb 0x1800118ff
inc r8
mov rdx, qword [rbp + 0x120]
lea rcx, [rbp + 0x120]
call fcn.180003eb0
mov qword [rbp + 0x138], 7
mov qword [rbp + 0x130], rdi
mov word [rbp + 0x120], di
mov rax, qword [rbp + 0x178]
cmp rax, 0x10
jb 0x180011974
inc rax
mov rcx, qword [rbp + 0x160]
cmp rax, 0x1000
jb 0x18001196f
test cl, 0x1f
je 0x180011942
call fcn.18001d1c0
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180011951
call fcn.18001d1c0
int3
sub rcx, rax
cmp rcx, 8
jae 0x180011960
call fcn.18001d1c0
int3
cmp rcx, 0x27
jbe 0x18001196c
call fcn.18001d1c0
int3
mov rcx, rax
call fcn.180018e50
mov rax, qword [0x180057918]
test rax, rax
jne 0x1800119a8
mov ecx, 0x1a0
call fcn.180018e14
mov qword [rsp + 0x58], rax
test rax, rax
je 0x18001199e
mov rcx, rax
call fcn.18000f4d0
jmp 0x1800119a1
mov rax, rdi
mov qword [0x180057918], rax
lea rdx, [rbp + 0x120]
mov rcx, rax
call fcn.180004630
mov rbx, rax
lea rdx, str.__qid:
lea rcx, [rbp - 0x70]
call fcn.18000f6e0
mov rcx, rax
mov rdx, rbx
call fcn.18000f940
nop
mov r8, qword [rbp + 0x138]
cmp r8, 8
jb 0x1800119fa
inc r8
mov rdx, qword [rbp + 0x120]
lea rcx, [rbp + 0x120]
call fcn.180003eb0
nop
mov rax, qword [rbp + 0x158]
cmp rax, 0x10
jb 0x180011a9e
inc rax
mov rcx, qword [rbp + 0x140]
cmp rax, 0x1000
jb 0x180011a55
test cl, 0x1f
je 0x180011a28
call fcn.18001d1c0
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180011a37
call fcn.18001d1c0
int3
sub rcx, rax
cmp rcx, 8
jae 0x180011a46
call fcn.18001d1c0
int3
cmp rcx, 0x27
jbe 0x180011a52
call fcn.18001d1c0
int3
mov rcx, rax
call fcn.180018e50
jmp 0x180011a9e
mov rcx, rsi
call fcn.1800123a0
lea rdx, [rbp + 0x180]
lea rcx, [rbp - 0x70]
call fcn.18000f6e0
mov rcx, rax
lea rdx, str.PDF_Convertpdfconverter.exe
call fcn.18000f6e0
lea rdx, str.__from:14__kpath__type:
lea rcx, [rbp - 0x70]
call fcn.18000f6e0
mov rcx, rax
mov edx, r14d
call fcn.1800107a0
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rbp + 0x98]
call fcn.18001be70
mov qword [rsp + 0x60], rdi
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov dword [rbp + 0x90], 0x68
lea rdx, [rbp + 0x140]
lea rcx, [rbp - 0x80]
call fcn.1800156f0
cmp qword [rax + 0x18], 8
jb 0x180011ae5
mov rax, qword [rax]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x90]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
sete bl
mov r8, qword [rbp + 0x158]
cmp r8, 8
jb 0x180011b4a
inc r8
mov rdx, qword [rbp + 0x140]
lea rcx, [rbp + 0x140]
call fcn.180003eb0
test bl, bl
jne 0x180011b5e
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
lea rcx, [rbp + 0x18]
call fcn.180010540
nop
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x18], rax
lea rcx, [rbp + 0x18]
call fcn.18001819c
nop
mov eax, edi
mov rcx, qword [rbp + 0x9c0]
xor rcx, rsp
call fcn.180018f70
lea r11, [rsp + 0xad0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret