Function at 0x14004f510
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x410
mov qword [rsp + 0x3f0], 0xfffffffffffffffe
mov rax, qword [0x1402aa808]
xor rax, rsp
mov qword [rsp + 0x400], rax
mov rax, qword [rsp + 0x420]
add rax, 0x138
mov rcx, rax
call fcn.140038d30
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0xffffffff
je 0x14004f8d1
mov rax, qword [rsp + 0x420]
mov ecx, dword [rsp + 0x50]
cmp dword [rax + 0x238], ecx
jne 0x14004f663
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x420]
add rcx, 0x218
mov rdx, rax
call fcn.1400109d0
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140010440
nop
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rax, [rsp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, VarBstrFromDisp
rep stosb byte [rdi], al
mov dword [rsp + 0x90], VarBstrFromDisp
mov dword [rsp + 0x94], 0x4540
lea rax, str.open
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0x60]
call fcn.140003530
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0xc0], 5
lea rcx, [rsp + 0x90]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14004f627
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14004f64d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x100], eax
mov r8d, dword [rsp + 0x100]
lea rdx, str.CReadmeDlg::OnReadme_ShellExecuteEx_return_FALSE__GetLastError___1_d___n
mov ecx, 4
call fcn.14001c160
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
lea rcx, [rsp + 0x60]
call fcn.140003430
jmp 0x14004f8d1
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x420]
add rcx, 0x218
mov rdx, rax
call fcn.1400109d0
mov rdx, rax
lea rcx, [rsp + 0x328]
call fcn.140010440
nop
lea rcx, [rsp + 0x3e0]
call fcn.140001cf0
nop
lea rcx, [rsp + 0x320]
call fcn.140001cf0
nop
mov dword [rsp + 0x104], 0
call fcn.140018340
add rax, 0x158
mov rcx, rax
call fcn.14000c560
mov qword [rsp + 0x3f8], rax
call fcn.140018340
add rax, 0x158
mov rcx, rax
call fcn.14000d400
mov rcx, qword [rsp + 0x3f8]
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0x320]
call fcn.140002800
lea rcx, [rsp + 0x328]
call fcn.140003530
mov rdx, rax
lea rcx, [rsp + 0x3e0]
call fcn.1400185f0
lea rdx, [0x140207bd4]
lea rcx, [rsp + 0x3e0]
call fcn.14000fd10
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x3e0]
call fcn.14000fce0
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x370]
call fcn.1401ac6a0
mov dword [rsp + 0x370], VarBstrFromDisp
mov r8d, 0x20a
xor edx, edx
lea rcx, [rsp + 0x110]
call fcn.1401ac6a0
xor edx, edx
lea rcx, [rsp + 0x3e0]
call fcn.140001da0
mov r8, rax
mov edx, 0x105
lea rcx, [rsp + 0x110]
call fcn.1401ac9a0
lea r8, [rsp + 0x110]
lea rdx, str.CReadmeDlg::OnReadme__szCmdLine____1_s____n
mov ecx, 5
call fcn.14001c160
lea rax, [rsp + 0x350]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x370]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x110]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14004f896
mov rcx, qword [rsp + 0x358]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x64
mov rcx, qword [rsp + 0x350]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x3e8], eax
call fcn.14000e450
cmp dword [rsp + 0x3e8], 0x102
je 0x14004f820
lea rdx, [rsp + 0x104]
mov rcx, qword [rsp + 0x350]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov r8d, dword [rsp + 0x104]
lea rdx, str.CReadmeDlg::OnReadme__nExitCode___1_d__n
mov ecx, 4
call fcn.14001c160
mov rcx, qword [rsp + 0x350]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14004f8a8
lea rdx, str.CReadmeDlg::OnReadme_CreateProcess_return_FALSE._n
mov ecx, 4
call fcn.14001c160
nop
lea rcx, [rsp + 0x320]
call fcn.140001d50
nop
lea rcx, [rsp + 0x3e0]
call fcn.140001d50
nop
lea rcx, [rsp + 0x328]
call fcn.140003430
mov rcx, qword [rsp + 0x400]
xor rcx, rsp
call fcn.1401ab2d0
add rsp, 0x410
pop rdi
ret