Function at 0x140001000
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rsi, rcx
lea rdx, [rsp + 0x50]
xor bl, bl
mov ecx, 0x104
xor dil, dil
mov byte [rbp + 0x398], bl
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, rsi
call fcn.1400015ac
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14000106e
lea r8, [0x14008ae52]
lea rdx, str.This_is_a_compiled_AutoIt_script._AV_researchers_please_email_avsupport_autoitscript.com_for_support.
mov r9d, reloc.WSOCK32.dll_recv
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000127f
mov eax, dword [0x1400b56f8]
test eax, eax
jne 0x140001084
or dword [0x1400a4c54], 0xffffffff
jmp 0x140001274
mov r12d, 1
lea rcx, [0x1400b61b0]
cmp eax, r12d
jne 0x1400010b9
mov r8, qword [0x1400b5700]
or r9d, 0xffffffff
mov edx, r12d
call fcn.14000a65c
mov r11b, byte [0x1400a4c48]
mov byte [0x1400b61b3], r11b
jmp 0x14000111c
lea r9, [rbp + 0x398]
lea r8, [0x1400b56f8]
lea rdx, [0x1400b5720]
call fcn.14000ad78
test al, al
jne 0x1400010e3
mov dword [0x1400a4c54], r12d
jmp 0x140001274
mov al, byte [0x1400b61b0]
mov dil, byte [0x1400b61b1]
lea r9, [0x1400b56f0]
lea r8, [rbp + 0x160]
lea rcx, [0x1400b5720]
mov edx, 0x104
mov byte [0x1400b56fc], al
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov bl, byte [rbp + 0x398]
mov edx, dword [0x1400b56f8]
lea rcx, [0x1400b5720]
call fcn.14001d0a0
test eax, eax
je 0x140001155
lea rcx, [0x1400b61b0]
call fcn.14000a8b4
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x1400a4c54], r12d
jmp 0x14000127f
cmp dil, r12b
jne 0x140001225
call fcn.140013620
test al, al
jne 0x140001225
lea rdx, [rbp + 0x160]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test bl, bl
je 0x1400011f4
lea rdx, [0x14008aec8]
lea rcx, [rsp + 0x30]
call fcn.140001c28
lea rdx, [0x1400b5720]
lea rcx, [rsp + 0x30]
call fcn.140001dc4
lea rdx, [0x14008aec8]
lea rcx, [rsp + 0x30]
call fcn.140001dc4
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r9, qword [rsp + 0x30]
mov rcx, rax
lea rax, [rsp + 0x50]
lea r8, [rbp + 0x160]
lea rdx, str.runas
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x30]
call fcn.140001d20
jmp 0x140001268
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [rbp + 0x160]
lea rdx, str.runas
mov rcx, rax
lea rax, [rsp + 0x50]
mov r9, rsi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x140001268
call fcn.140001298
call fcn.1400014d8
cmp byte [0x1400b56fc], 0
jne 0x140001244
lea rcx, [0x14009f470]
call fcn.14000edcc
lea rcx, [0x1400b5930]
mov edx, r12d
call fcn.14001d4ec
cmp byte [0x1400b56fc], 0
jne 0x140001268
lea rcx, [0x14009f470]
call fcn.14000f200
lea rcx, [0x1400b61b0]
call fcn.14000a8b4
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret