Function at 0x140059a8a
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x348
movaps xmmword [rsp + 0x330], xmm7
movaps xmmword [rsp + 0x320], xmm6
mov r12, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x318], rax
movabs rbx, 0x7fffffffffffffef
call fcn.1400c2420
mov r14, rax
mov r8d, dword [rax + 4]
mov r9d, dword [rax + 8]
mov eax, dword [rax + 0xc]
movabs r15, 0xaaaaaaaaaaaaaaaa
lea r13, [rsp + 0xe0]
mov qword [r13 + 0x10], r15
movaps xmm6, xmmword [0x1402ae190]
movaps xmmword [r13], xmm6
mov dword [rsp + 0x20], eax
lea rdx, [0x1402b618e]
mov rcx, r13
call fcn.14000acc0
mov qword [rsp + 0xd0], r15
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0x2d0], r15
movaps xmmword [rsp + 0x2c0], xmm6
mov rax, qword [0x1403152a0]
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x10]
mov rdi, qword [rax + 0xe0]
mov rcx, rdi
call fcn.1401124ec
cmp rax, rbx
ja 0x14005a7a0
mov rsi, rax
cmp rax, 0xb
jae 0x140059b77
lea rbp, [rsp + 0x2c0]
mov byte [rbp + 0x17], sil
test rsi, rsi
jne 0x140059bb4
jmp 0x140059bc5
lea rbx, [rsi + 8]
and rbx, 0xfffffffffffffff8
lea rcx, [rbx + rbx]
call fcn.140112048
mov rbp, rax
mov qword [rsp + 0x2c0], rax
movabs rax, 0x7fffffffffffffef
add rax, 0x11
or rax, rbx
mov qword [rsp + 0x2d0], rax
mov qword [rsp + 0x2c8], rsi
mov r8, rsi
add r8, rsi
mov rcx, rbp
mov rdx, rdi
call fcn.1401178b0
mov word [rbp + rsi*2], 0
movzx eax, byte [rsp + 0x2d7]
test al, al
jns 0x140059be0
mov rax, qword [rsp + 0x2c8]
test rax, rax
xorps xmm0, xmm0
lea rsi, [rsp + 0x100]
movaps xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
lea rax, str.https:__go.microsoft.com_fwlink__linkid2108824hl_1
lea rbp, str.https:__go.microsoft.com_fwlink__linkid2058861hl_1
cmove rbp, rax
mov rcx, rsi
call fcn.1401eb66e
test al, al
jne 0x140059c4b
cmp byte [rsp + 0x117], 0
jns 0x140059c37
mov qword [rsp + 0x108], 2
mov rsi, qword [rsp + 0x100]
jmp 0x140059c3f
mov byte [rsp + 0x117], 2
mov dword [rsi], 0x6e0065
mov word [rsi + 4], 0
mov qword [rsp + 0x250], r15
movaps xmmword [rsp + 0x240], xmm6
cmp byte [rsp + 0x117], 0
jns 0x140059c84
mov rdx, qword [rsp + 0x100]
mov r8, qword [rsp + 0x108]
lea rcx, [rsp + 0x300]
call fcn.1400e6dd4
jmp 0x140059ca4
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x310], rax
movaps xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0x300], xmm0
mov qword [rsp + 0x40], r12
lea rdi, [rsp + 0x300]
lea rsi, [rsp + 0xa0]
mov qword [rsi], rdi
mov qword [rsi + 8], 1
lea rcx, [rsp + 0x240]
mov rdx, rsi
call fcn.14019656a
cmp byte [rdi + 0x17], 0
jns 0x140059ce7
mov rcx, qword [rsp + 0x300]
call fcn.140112038
lea r12, [rsp + 0x300]
mov qword [r12], rbp
mov qword [r12 + 8], 0x35
lea rcx, [rsp + 0xc0]
lea rdi, [rsp + 0x240]
mov rdx, r12
mov r8, rdi
xor r9d, r9d
call fcn.1401cf9a0
mov rbx, qword [rdi]
test rbx, rbx
je 0x140059d64
mov rax, qword [rsp + 0x248]
cmp rax, rbx
je 0x140059d54
lea rbp, [rax - 0x18]
cmp byte [rax - 1], 0
jns 0x140059d42
mov rcx, qword [rax - 0x18]
call fcn.140112038
mov rax, rbp
cmp rbx, rbp
jne 0x140059d2f
mov rcx, qword [rsp + 0x240]
jmp 0x140059d57
mov rcx, rbx
mov qword [rsp + 0x248], rbx
call fcn.140112038
cmp byte [rsp + 0x117], 0
jns 0x140059d7b
mov rcx, qword [rsp + 0x100]
call fcn.140112038
mov qword [rsp + 0x48], r14
cmp byte [rsp + 0x2d7], 0
jns 0x140059d97
mov rcx, qword [rsp + 0x2c0]
call fcn.140112038
mov qword [rsp + 0xb0], r15
movaps xmmword [rsp + 0xa0], xmm6
mov rax, qword [0x1403152a0]
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x10]
mov r14, qword [rax + 0xe0]
mov rcx, r14
call fcn.1401124ec
mov rbp, rax
movabs rax, 0x7fffffffffffffef
cmp rbp, rax
ja 0x14005a7ad
mov rdi, r15
cmp rbp, 0xb
jae 0x140059df7
lea r15, [rsp + 0xa0]
mov byte [r15 + 0x17], bpl
test rbp, rbp
jne 0x140059e34
jmp 0x140059e45
lea rbx, [rbp + 8]
and rbx, 0xfffffffffffffff8
lea rcx, [rbx + rbx]
call fcn.140112048
mov r15, rax
mov qword [rsp + 0xa0], rax
movabs rax, 0x7fffffffffffffef
add rax, 0x11
or rax, rbx
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xa8], rbp
mov r8, rbp
add r8, rbp
mov rcx, r15
mov rdx, r14
call fcn.1401178b0
mov word [r15 + rbp*2], 0
movzx eax, byte [rsp + 0xb7]
mov rcx, rax
test al, al
jns 0x140059e63
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
mov r14, rdi
lea r15, [rsp + 0x240]
jne 0x140059eb2
test al, al
js 0x140059e85
lea rax, [rsp + 0xa0]
mov byte [rax + 0x17], 6
jmp 0x140059e99
mov qword [rsp + 0xa8], 6
mov rax, qword [rsp + 0xa0]
mov ecx, dword [0x1402b1e0a]
mov dword [rax + 8], ecx
mov rcx, qword [0x1402b1e02]
mov qword [rax], rcx
mov word [rax + 0xc], 0
mov qword [rsp + 0x90], r14
movaps xmmword [rsp + 0x80], xmm6
lea rbp, [rsp + 0x100]
mov qword [rbp + 0x10], r14
movaps xmmword [rbp], xmm6
mov rcx, rbp
call fcn.1400e6d60
lea r8, str.SOFTWAREMicrosoftSQMClient
mov rcx, rbp
mov rdx, 0xffffffff80000002
mov r9d, 0x101
call fcn.140009250
test eax, eax
je 0x140059f16
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], 0
jmp 0x14005a072
xorps xmm7, xmm7
lea r8, [rsp + 0x240]
movaps xmmword [r8], xmm7
mov qword [r8 + 0x10], 0
lea rdx, str.MachineId
lea rcx, [rsp + 0x100]
call fcn.14015c930
test eax, eax
je 0x140059f5e
movaps xmmword [rsp + 0x80], xmm7
mov qword [rsp + 0x90], 0
jmp 0x14005a05b
mov qword [rsp + 0x310], r14
movaps xmmword [rsp + 0x300], xmm6
mov byte [rsp + 0x317], 2
mov dword [rsp + 0x300], 0x3a0073
mov word [rsp + 0x304], 0
movzx r9d, byte [rsp + 0x257]
test r9b, r9b
jns 0x140059fa1
mov r9, qword [rsp + 0x248]
add r9, 0xfffffffffffffffe
lea rax, [rsp + 0x258]
mov qword [rsp + 0x20], rax
lea rbp, [rsp + 0x2c0]
lea rdx, [rsp + 0x240]
mov r8d, 1
mov rcx, rbp
call fcn.1400d1d6e
movzx r8d, byte [rbp + 0x17]
test r8b, r8b
jns 0x140059fea
mov r8, qword [rsp + 0x2c8]
mov rbp, qword [rsp + 0x2c0]
lea rcx, [rsp + 0x300]
mov rdx, rbp
call fcn.1400ebd2e
cmp byte [rax + 0x17], 0
js 0x14005a019
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x90], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x80], xmm0
jmp 0x14005a02d
mov rdx, qword [rax]
mov r8, qword [rax + 8]
lea rcx, [rsp + 0x80]
call fcn.1400e6dd4
cmp byte [rsp + 0x2d7], 0
jns 0x14005a044
mov rcx, qword [rsp + 0x2c0]
call fcn.140112038
cmp byte [rsp + 0x317], 0
jns 0x14005a05b
mov rcx, qword [rsp + 0x300]
call fcn.140112038
cmp byte [rsp + 0x257], 0
jns 0x14005a072
mov rcx, qword [rsp + 0x240]
call fcn.140112038
lea rbp, [rsp + 0x100]
mov rcx, rbp
call fcn.1400e6d80
mov qword [rsp + 0x70], r14
movaps xmmword [rsp + 0x60], xmm6
cmp byte [rsp + 0x97], 0
jns 0x14005a0a0
mov rbx, qword [rsp + 0x80]
jmp 0x14005a0a8
lea rbx, [rsp + 0x80]
cmp byte [rsp + 0xb7], 0
jns 0x14005a0ba
mov rsi, qword [rsp + 0xa0]
cmp byte [rsp + 0xf7], 0
jns 0x14005a0cc
mov r13, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x40]
mov rdx, r15
call fcn.1401cd750
movzx eax, byte [rsp + 0x257]
test al, al
mov rcx, qword [rsp + 0x240]
cmovns rcx, r15
lea rdx, [rsp + 0x50]
mov qword [rdx], rcx
cmovs rax, qword [rsp + 0x248]
mov qword [rdx + 8], rax
mov rcx, rbp
call fcn.140019630
cmp byte [rsp + 0x117], 0
jns 0x14005a11e
mov rbp, qword [rsp + 0x100]
cmp byte [rsp + 0xd7], 0
lea r8, [rsp + 0xc0]
jns 0x14005a138
mov r8, qword [rsp + 0xc0]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r13
lea rdx, str._lsversion_lsosVer_lsch_lsdeviceId_ls
lea rsi, [rsp + 0x60]
mov rcx, rsi
mov r9, rbp
call fcn.14000acc0
cmp byte [rsp + 0x117], 0
jns 0x14005a175
mov rcx, qword [rsp + 0x100]
call fcn.140112038
cmp byte [rsp + 0x257], 0
jns 0x14005a18c
mov rcx, qword [rsp + 0x240]
call fcn.140112038
mov rax, qword [rsp + 0x48]
cmp dword [rax], 7
jl 0x14005a36a
xorps xmm0, xmm0
movaps xmmword [rsp + 0x300], xmm0
mov qword [rsp + 0x310], 0
movzx ebx, byte [rsp + 0x77]
mov rbp, rbx
test bl, bl
jns 0x14005a1c2
mov rbp, qword [rsp + 0x68]
lea rax, [rbp + 0xf]
movabs rcx, 0x7fffffffffffffef
cmp rax, rcx
ja 0x14005a7ba
cmp rax, 0xa
jbe 0x14005a21f
lea rdi, [rbp + 0x17]
and rdi, 0xfffffffffffffff8
lea rcx, [rdi + rdi]
call fcn.140112048
mov qword [rsp + 0x300], rax
movabs rcx, 0x7fffffffffffffef
add rcx, 0x11
or rcx, rdi
mov qword [rsp + 0x310], rcx
mov qword [rsp + 0x308], 0xf
jmp 0x14005a22b
lea rax, [rsp + 0x300]
mov byte [rax + 0x17], 0xf
movups xmm0, xmmword [0x1402b62fe]
movups xmmword [rax + 0xe], xmm0
movups xmm0, xmmword [str.microsoft_edge:]
movups xmmword [rax], xmm0
mov word [rax + 0x1e], 0
test bl, bl
jns 0x14005a24f
mov rsi, qword [rsp + 0x60]
mov rcx, r12
mov rdx, rsi
mov r8, rbp
call fcn.1400ebd2e
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
movups xmmword [rsp + 0x258], xmm0
movups xmmword [rsp + 0x268], xmm0
movups xmmword [rsp + 0x298], xmm0
movups xmmword [rsp + 0x288], xmm0
movups xmmword [rsp + 0x278], xmm0
mov qword [rsp + 0x2a8], 0
movabs rax, 0x10000000070
mov qword [rsp + 0x240], rax
lea rax, [0x1402b6310]
mov qword [rsp + 0x250], rax
cmp byte [rsp + 0x317], 0
jns 0x14005a2cf
mov r12, qword [rsp + 0x300]
lea rcx, [rsp + 0x240]
mov qword [rcx + 0x18], r12
mov dword [rcx + 0x30], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
test eax, eax
jne 0x14005a34b
mov ecx, 2
call fcn.1400f34e0
test al, al
je 0x14005a34b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str..._.._chrome_installer_setup_microsoft_edge_behaviors.cc
lea rdi, [rsp + 0x100]
mov rcx, rdi
mov r8d, 0x51
mov r9d, 2
call fcn.14019f9e0
lea rcx, [rsp + 0x110]
lea rdx, str.Failed_to_launch_Edge_for_uninstall_survey
mov r8d, 0x2a
call fcn.1400ff874
mov rcx, rdi
call fcn.140183e60
cmp byte [rsp + 0x317], 0
jns 0x14005a362
mov rcx, qword [rsp + 0x300]
call fcn.140112038
test esi, esi
jne 0x14005a6ff
xorps xmm7, xmm7
lea rdx, [rsp + 0x300]
movaps xmmword [rdx], xmm7
mov qword [rdx + 0x10], 0
mov ecx, 0x67
call fcn.1400efc90
test al, al
je 0x14005a6f2
lea rax, [0x1402b637e]
lea r8, [rsp + 0x2f0]
mov qword [r8], rax
mov qword [r8 + 8], 0x11
lea rsi, [rsp + 0x300]
lea rdi, [rsp + 0x100]
mov rcx, rsi
mov rdx, rdi
call fcn.1400eea10
mov rcx, rsi
mov rdx, rdi
call fcn.1400f94f0
mov rcx, rdi
call fcn.1400e1350
lea rax, str.iexplore.exe
lea r8, [rsp + 0x2e0]
mov qword [r8], rax
mov qword [r8 + 8], 0xc
lea rdi, [rsp + 0x100]
mov rcx, rsi
mov rdx, rdi
call fcn.1400eea10
mov rcx, rsi
mov rdx, rdi
call fcn.1400f94f0
mov rcx, rdi
call fcn.1400e1350
mov qword [rsp + 0x2d0], r14
movaps xmmword [rsp + 0x2c0], xmm6
movaps xmmword [rsp + 0x240], xmm7
mov qword [rsp + 0x250], 0
movzx ebx, byte [rsi + 0x17]
mov rdi, rbx
test bl, bl
jns 0x14005a451
mov rdi, qword [rsp + 0x308]
lea rax, [rdi + 1]
movabs rcx, 0x7fffffffffffffef
cmp rax, rcx
ja 0x14005a7c7
cmp rax, 0xa
jbe 0x14005a4b3
lea rbp, [rdi + 9]
and rbp, 0xfffffffffffffff8
mov rcx, rbp
add rcx, rbp
call fcn.140112048
mov r15, rax
mov qword [rsp + 0x240], rax
movabs rax, 0x7fffffffffffffef
add rax, 0x11
or rax, rbp
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x248], 1
jmp 0x14005a4bb
mov byte [rsp + 0x257], 1
mov dword [r15], 0x22
test bl, bl
jns 0x14005a4ce
mov rsi, qword [rsp + 0x300]
lea rbx, [rsp + 0x240]
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.1400ebd2e
lea rdx, [0x1402b63c8]
mov rcx, rbx
call fcn.1400ebece
mov rcx, qword [rax + 0x10]
lea rsi, [rsp + 0x100]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsi], xmm0
xorps xmm7, xmm7
movups xmmword [rax], xmm7
xor edi, edi
mov qword [rax + 0x10], rdi
lea rdx, [rsp + 0x60]
movzx r8d, byte [rdx + 0x17]
test r8b, r8b
cmovs r8, qword [rdx + 8]
cmovs rdx, qword [rdx]
mov rcx, rsi
call fcn.1400ebd2e
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x2d0], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x2c0], xmm0
movups xmmword [rax], xmm7
mov qword [rax + 0x10], rdi
cmp byte [rsi + 0x17], 0
jns 0x14005a564
mov rcx, qword [rsp + 0x100]
call fcn.140112038
cmp byte [rsp + 0x257], 0
jns 0x14005a57b
mov rcx, qword [rsp + 0x240]
call fcn.140112038
call fcn.1401d0cb0
test al, al
je 0x14005a6c0
lea rsi, [rsp + 0x240]
mov qword [rsi + 0x40], r14
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
lea rax, [rsp + 0x2c0]
movzx ecx, byte [rax + 0x17]
test cl, cl
mov rbp, qword [rax]
cmovns rbp, rax
lea rdx, [rsp + 0x2b0]
mov qword [rdx], rbp
cmovs rcx, qword [rax + 8]
mov qword [rdx + 8], rcx
mov rcx, rsi
call fcn.1401c6110
lea rdi, [rsp + 0x100]
mov rcx, rdi
call fcn.1401cbc50
mov rcx, rsi
mov rdx, rdi
call fcn.1401ce920
mov esi, eax
mov rcx, rdi
call fcn.140165010
test esi, esi
jns 0x14005a6b1
mov ecx, 2
call fcn.1400f34e0
test al, al
je 0x14005a654
lea rdx, str..._.._chrome_installer_setup_microsoft_edge_behaviors.cc
lea rdi, [rsp + 0x100]
mov rcx, rdi
mov r8d, 0x65
mov r9d, 2
call fcn.14019a740
lea rcx, [rsp + 0x110]
lea rdx, str.Failed_to_launch_Edge_for_uninstall_survey
mov r8d, 0x2a
call fcn.1400ff874
mov rcx, rdi
call fcn.140001d00
mov ecx, 2
call fcn.1400f34e0
test al, al
je 0x14005a6b1
lea rdx, str..._.._chrome_installer_setup_microsoft_edge_behaviors.cc
lea rdi, [rsp + 0x100]
mov rcx, rdi
mov r8d, 0x66
mov r9d, 2
call fcn.14019a740
lea rcx, [rsp + 0x110]
lea rdx, str.base::LaunchNonElevatedProcess_failed:_HR
mov r8d, 0x2a
call fcn.1400ff874
mov rcx, rax
mov edx, esi
call fcn.1401d8722
mov rcx, rdi
call fcn.140001d00
lea rcx, [rsp + 0x240]
call fcn.1401c5ae0
jmp 0x14005a6db
lea rdx, [rsp + 0x100]
mov dword [rdx], 0
lea rcx, [rsp + 0x2c0]
call fcn.1401f7cb0
cmp byte [rsp + 0x2d7], 0
jns 0x14005a6f2
mov rcx, qword [rsp + 0x2c0]
call fcn.140112038
lea rcx, [rsp + 0x300]
call fcn.1400e1350
cmp byte [rsp + 0x77], 0
jns 0x14005a710
mov rcx, qword [rsp + 0x60]
call fcn.140112038
cmp byte [rsp + 0x97], 0
jns 0x14005a727
mov rcx, qword [rsp + 0x80]
call fcn.140112038
cmp byte [rsp + 0xb7], 0
jns 0x14005a73e
mov rcx, qword [rsp + 0xa0]
call fcn.140112038
cmp byte [rsp + 0xd7], 0
jns 0x14005a755
mov rcx, qword [rsp + 0xc0]
call fcn.140112038
cmp byte [rsp + 0xf7], 0
jns 0x14005a76c
mov rcx, qword [rsp + 0xe0]
call fcn.140112038
mov rcx, qword [rsp + 0x318]
xor rcx, rsp
call fcn.140115e50
movaps xmm6, xmmword [rsp + 0x320]
movaps xmm7, xmmword [rsp + 0x330]
add rsp, 0x348
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x2c0]
call fcn.1401573b4
lea rcx, [rsp + 0xa0]
call fcn.1401573b4
lea rcx, [rsp + 0x300]
call fcn.1401573b4
lea rcx, [rsp + 0x240]
call fcn.1401573b4
int3