Function at 0x1400ddf10
Capabilities:
Create process on windows

Disassembly:
jmp 0x1400ddf10
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov eax, 0x14b0
call fcn.140001e38
sub rsp, 0x14b0
lea rbp, [rsp + 0x30]
lea rcx, [0x140635c60]
mov rax, rsp
mov edx, 0x1390
lea r8, [0x1404be28c]
xor r9d, r9d
mov qword [rax + 0x20], 0
call fcn.1400025f4
movsxd r14, dword [0x140898f40]
xor ebx, ebx
test r14, r14
lea rsi, [0x1408b3ee0]
cmovle r14, rbx
lea rcx, [0x1404be290]
mov qword [rbp + 0x1418], r14
add r14, 0xc
mov rax, r14
mov rdi, rsp
mov qword [rbp + 0x1410], rsi
mov qword [rbp + 0x1420], rcx
mov qword [rbp + 0x1428], 0xc
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140001e38
sub rsp, rax
lea rax, [rsp + 0x30]
mov r13, rax
lea rcx, [rbp + 0x1410]
mov edx, 2
mov r8, r13
mov r9, r14
call fcn.1400048cc
mov rcx, r13
mov rdx, r14
call fcn.140001929
mov r14d, eax
mov rax, rdi
mov rsp, rax
movsxd rdi, dword [0x140898f40]
test rdi, rdi
lea rcx, [0x1404be2a0]
mov r13, rsp
cmovle rdi, rbx
mov qword [rbp + 0x1438], rdi
add rdi, 0xe
mov rax, rdi
mov qword [rbp + 0x1430], rsi
mov qword [rbp + 0x1440], rcx
mov qword [rbp + 0x1448], 0xe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140001e38
sub rsp, rax
lea rax, [rsp + 0x30]
mov r15, rax
lea rcx, [rbp + 0x1430]
mov edx, 2
mov r8, r15
mov r9, rdi
call fcn.1400048cc
mov rcx, r15
mov rdx, rdi
call fcn.140001929
mov edx, eax
mov rax, r13
mov rsp, rax
test r14d, 1
je 0x1400de0a0
cmp byte [0x1408bce82], 0x59
je 0x1400de091
test dl, 1
je 0x1400de082
cmp byte [0x1408bce82], 0x4e
je 0x1400de0c1
lea r8, [0x1404be2b0]
mov r9d, 0xc
jmp 0x1400de0ce
lea r8, str.WININPUT.EXE
mov r9d, 0xc
jmp 0x1400de0ce
test dl, 1
je 0x1400de273
cmp byte [0x1408bce82], 0x4e
je 0x1400de0c1
lea r8, [0x1404be2d0]
mov r9d, 0xe
jmp 0x1400de0ce
lea r8, str.WININPUT64.EXE
mov r9d, 0xe
mov rax, rsp
lea rcx, [0x140635c60]
mov edx, 0x1390
mov qword [rax + 0x20], 0
call fcn.1400025f4
movsxd rax, dword [0x140898f40]
test rax, rax
lea rdx, [0x140635c60]
lea rcx, [rbp + 0x1390]
mov qword [rcx + 0x10], rdx
lea r8, [0x140635c60]
cmovg rbx, rax
mov edx, 2
mov r9d, 0x1390
mov qword [rcx], rsi
mov qword [rcx + 8], rbx
mov qword [rcx + 0x18], 0x1390
call fcn.1400048cc
lea rdx, [0x1404be2f0]
lea rcx, [rbp + 0x1450]
mov qword [rbp + 0x13b0], rdx
mov edx, 2
mov qword [rbp + 0x13c0], rcx
lea rcx, [rbp + 0x13b0]
lea r8, [0x140637000]
mov r9d, 0x12c
mov eax, 0x4957
mov word [0x1408bab27], ax
mov byte [0x1408bab29], 0x4e
mov qword [rcx + 8], 4
mov byte [rbp + 0x1450], 0
mov qword [rcx + 0x18], 1
call fcn.1400048cc
mov edx, 0x1390
lea rbx, [rbp]
mov rcx, rbx
lea r8, [0x140635c60]
mov r9d, edx
call fcn.140002c52
lea r8, [0x140637140]
lea rdx, [rbp + 0x1460]
mov qword [rdx - 0x80], rdx
lea rcx, [rbp + 0x13d0]
mov edx, 2
mov r9d, 0x12c
movsxd rax, eax
mov qword [rcx], rbx
mov qword [rcx + 8], rax
mov byte [rbp + 0x1460], 0
mov qword [rcx + 0x18], 1
call fcn.1400048cc
lea r8, [0x140637280]
lea rdx, [rbp + 0x1470]
mov qword [rdx - 0x70], rdx
lea rcx, [rbp + 0x13f0]
mov edx, 2
mov r9d, 0x12c
lea rax, str.All
mov qword [rcx], rax
mov qword [rcx + 8], 4
mov byte [rbp + 0x1470], 0
mov qword [rcx + 0x18], 1
call fcn.1400048cc
mov rax, rsp
xor ecx, ecx
lea rdx, [0x140637000]
lea r8, [0x140637140]
lea r9, [0x140637280]
mov qword [rax + 0x20], 0
mov dword [rax + 0x28], 1
call sub.SHELL32.dll_ShellExecuteA
call fcn.140006681
jmp 0x1400de2f6
movsxd rcx, dword [0x140898f40]
test rcx, rcx
mov qword [rbp + 0x10], rsi
lea rdx, str._Excel_RSSST_interface_failed.
cmovg rbx, rcx
lea rsi, str.WININPUT_module_not_found.
mov qword [rbp + 0x18], rbx
add rbx, 0x39
mov rax, rbx
mov rdi, rsp
mov qword [rbp], rdx
mov qword [rbp + 8], 0x1f
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], 0x1a
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140001e38
sub rsp, rax
lea rax, [rsp + 0x30]
mov rsi, rax
lea rcx, [rbp]
mov edx, 3
mov r8, rsi
mov r9, rbx
call fcn.1400048cc
mov rcx, rsi
mov rdx, rbx
call fcn.1400040c0
mov rax, rdi
mov rsp, rax
lea rsp, [rbp + 0x1480]
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret