Function at 0x140002390
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov qword [rbp - 0x49], 0xfffffffffffffffe
mov qword [rsp + 0xf0], rbx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, rdx
mov rbx, rcx
call fcn.14003b060
test al, al
jne 0x1400026ca
cmp byte [rbx + 0x210], al
je 0x140002469
lea rdx, str.Unable_to_re_spawn_cleanup_in_admin_user_
mov rcx, rbx
call fcn.140036ed0
mov rcx, rbx
call fcn.140036110
mov qword [rbp - 0x29], 7
xor edi, edi
mov qword [rbp - 0x31], rdi
mov word [rbp - 0x41], di
lea rcx, [rbx + 0x258]
call fcn.140038c20
lea r8, [rbp - 0x41]
movzx edx, ax
lea ecx, [rdi + 0x6a]
call fcn.14003a750
test al, al
je 0x140002448
lea rdx, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rdx, qword [rbp - 0x41]
lea r8, [rbx + 0xc80]
xor ecx, ecx
mov r9d, 0x1010
call fcn.14003cb30
nop
mov r8, qword [rbp - 0x29]
cmp r8, 8
jb 0x140002462
inc r8
mov rdx, qword [rbp - 0x41]
lea rcx, [rbp - 0x41]
call fcn.140003f70
xor al, al
jmp 0x1400026cc
mov qword [rbp - 0x29], 7
xor edi, edi
mov qword [rbp - 0x31], rdi
mov word [rbp - 0x41], di
lea r8d, [rdi + 9]
lea rdx, str.__respawn
lea rcx, [rbp - 0x41]
call fcn.140003b30
nop
mov qword [rbp + 0x17], 7
mov qword [rbp + 0xf], rdi
mov word [rbp - 1], di
cmp word [rsi], di
jne 0x1400024aa
mov r8d, edi
jmp 0x1400024bb
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rsi + r8*2], 0
jne 0x1400024b0
mov rdx, rsi
lea rcx, [rbp - 1]
call fcn.140003b30
nop
lea r8, [rbp - 0x41]
lea rdx, [rbp - 1]
lea rcx, [rbp + 0x1f]
call fcn.140004c50
nop
mov r8, qword [rbp + 0x17]
cmp r8, 8
jb 0x1400024f4
inc r8
mov rdx, qword [rbp - 1]
lea rcx, [rbp - 1]
call fcn.140003f70
mov qword [rbp + 0x17], 7
mov qword [rbp + 0xf], rdi
mov word [rbp - 1], di
mov r8, qword [rbp - 0x29]
cmp r8, 8
jb 0x14000251e
inc r8
mov rdx, qword [rbp - 0x41]
lea rcx, [rbp - 0x41]
call fcn.140003f70
mov qword [rbp - 0x29], 7
mov qword [rbp - 0x31], rdi
mov word [rbp - 0x41], di
lea r9, [rbp + 0x1f]
cmp qword [rbp + 0x37], 8
cmovae r9, qword [rbp + 0x1f]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
lea r8, str.cleanup.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja case.default.0x140002583
cdqe
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x2724]
mov ecx, dword [rdx + rax*4 + 0x26ec]
add rcx, rdx
jmp rcx
lea rdx, str.ERROR:_The_operating_is_out_of_memory_or_resources.__Terminating_install.
jmp 0x14000261a
mov r8, rbx
lea rdx, str.ERROR:_Cleanup.exe_not_found_in__s.__Terminating_install.
mov rcx, rbx
call fcn.140036ed0
jmp 0x140002622
mov r8, rbx
lea rdx, str.ERROR:_The_path__s_is_not_found.__Terminating_install.
mov rcx, rbx
call fcn.140036ed0
jmp 0x140002622
lea rdx, str.ERROR:_The_.exe_file_is_invalid_or_error_in_.exe_image.__Terminating_install.
jmp 0x14000261a
lea rdx, str.ERROR:_Operating_system_denied_access_to_Cleanup.exe.__Terminating_install.
jmp 0x14000261a
lea rdx, str.ERROR:_The_file_name_association_is_incomplete_or_invalid.__Terminating_install.
jmp 0x14000261a
lea rdx, str.ERROR:_The_DDE_transaction_could_not_be_completed_because_other_DDE_transactions_were_being_processed.__Terminating_install.
jmp 0x14000261a
lea rdx, str.ERROR:_The_DDE_transaction_failed.__Terminating_install.
jmp 0x14000261a
lea rdx, str.ERROR:_The_DDE_transaction_could_not_be_completed_because_the_request_timed_out.__Terminating_install.
jmp 0x14000261a
lea rdx, str.ERROR:_The_specified_DLL_was_not_found.__Terminating_install.
jmp 0x14000261a
lea rdx, str.ERROR:_There_is_no_application_associated_with_the_given_file_name_extension._This_error_will_also_be_returned_if_you_attempt_to_print_a_file_that_is_not_printable.__Terminating_install.
jmp 0x14000261a
lea rdx, str.ERROR:_There_was_not_enough_memory_to_complete_the_operation.__Terminating_install.
jmp 0x14000261a
lea rdx, str.ERROR:_A_sharing_violation_occurred.__Terminating_install.
jmp 0x14000261a
lea rdx, str.ERROR:_Unable_to_re_spawn_Cleanup.exe_as_admin_user.__Terminating_install.
mov rcx, rbx
call fcn.140036ed0
mov rcx, rbx
call fcn.140036110
mov qword [rbp - 9], 7
mov qword [rbp - 0x11], rdi
mov word [rbp - 0x21], di
lea rcx, [rbx + 0x258]
call fcn.140038c20
lea r8, [rbp - 0x21]
movzx edx, ax
mov ecx, 0x6a
call fcn.14003a750
test al, al
je 0x14000267e
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rdx, qword [rbp - 0x21]
lea r8, [rbx + 0xc80]
xor ecx, ecx
mov r9d, 0x1010
call fcn.14003cb30
nop
mov r8, qword [rbp - 9]
cmp r8, 8
jb 0x140002698
inc r8
mov rdx, qword [rbp - 0x21]
lea rcx, [rbp - 0x21]
call fcn.140003f70
mov qword [rbp - 9], 7
mov qword [rbp - 0x11], rdi
mov word [rbp - 0x21], di
mov r8, qword [rbp + 0x37]
cmp r8, 8
jb 0x140002462
inc r8
mov rdx, qword [rbp + 0x1f]
lea rcx, [rbp + 0x1f]
call fcn.140003f70
xor al, al
jmp 0x1400026cc
mov al, 1
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14003d350
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret