Function at 0x14000eb74
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x8d0
mov dil, dl
mov rbx, rcx
call fcn.14000c808
cmp rax, 0x3f6
jae 0x14000ee30
mov esi, 0x70
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8, rsi
call fcn.14000c654
mov al, byte [rbx]
mov r10b, 0x22
cmp al, r10b
lea r8, [rbx + 1]
mov r9, rbx
cmove r9, r8
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x34], 0x5c0
mov qword [rsp + 0x48], r9
test al, al
je 0x14000ec37
mov rax, rbx
cmp byte [rax], r10b
jne 0x14000ec03
jmp 0x14000ebf2
cmp byte [rcx + rbx], r10b
je 0x14000ebff
inc rcx
inc edx
cmp byte [rcx + rbx], 0
jne 0x14000ebec
jmp 0x14000ec03
mov byte [rcx + rbx], 0x20
cmp byte [rcx + rbx], 0x20
je 0x14000ec20
cmp byte [r8 + rcx], 0x2f
je 0x14000ec20
inc rcx
inc edx
lea rax, [rcx + rbx]
cmp byte [rax], 0
jne 0x14000ebe5
jmp 0x14000ec37
movsxd rax, edx
cmp byte [rax + rbx], 0x20
jne 0x14000ec2d
mov byte [rax + rbx], 0
lea rax, [rax + rbx + 1]
mov qword [rsp + 0x50], rax
test dil, dil
jne 0x14000ec55
cmp byte [0x14001f85a], dil
lea rax, [0x14001f85a]
cmove rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov rcx, r9
mov dword [rsp + 0x60], 1
call fcn.140008d00
mov rsi, rax
test rax, rax
je 0x14000ec90
lea rdx, str..inf
mov rcx, rax
call fcn.14000cb34
lea rcx, [0x1400169f0]
test eax, eax
cmovne rcx, qword [rsp + 0x40]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x48]
xor edx, edx
call fcn.140006560
mov bpl, al
test al, al
je 0x14000ecc4
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x4d0]
call fcn.140006670
lea rdx, [rsp + 0x4d0]
mov qword [rsp + 0x48], rdx
jmp 0x14000ecc9
mov rdx, qword [rsp + 0x48]
test dil, dil
je 0x14000ed0b
test bpl, bpl
jne 0x14000ed0b
lea rcx, [rsp + 0xd0]
call fcn.14000c978
lea rdx, str..exe
lea rcx, [rsp + 0xd0]
call fcn.14000cbc0
lea rcx, [rsp + 0xd0]
xor edx, edx
call fcn.140006560
test al, al
je 0x14000ee30
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
setne al
test al, al
jne 0x14000ed42
btr dword [rsp + 0x34], 0xa
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x48], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
setne al
test al, al
je 0x14000ee30
xor bl, bl
cmp byte [0x14001f450], bl
jne 0x14000ed51
test dil, dil
je 0x14000edc8
mov rcx, qword [0x14001f440]
test rcx, rcx
je 0x14000ed78
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x14000ed78
mov rcx, qword [0x14001f440]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov bl, 1
mov rcx, qword [rsp + 0x98]
mov edx, 0x7d0
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rbp, qword [rsp + 0x98]
jmp 0x14000edb3
lea rcx, [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageA]
mov edx, 0xa
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x14000ed95
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x14000edee
lea rdx, str..exe
mov rcx, rsi
call fcn.14000cb34
test eax, eax
je 0x14000ee1a
cmp byte [0x14001f450], 0
je 0x14000ee03
test dil, dil
jne 0x14000ee03
mov ecx, 0x1b58
jmp 0x14000ee14
neg dil
sbb ecx, ecx
and ecx, 0xfffffce0
add ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
test bl, bl
je 0x14000ee30
mov rcx, qword [0x14001f440]
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
lea r11, [rsp + 0x8d0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret