Function at 0x14002a800
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x238
movaps xmmword [rsp + 0x220], xmm7
movaps xmmword [rsp + 0x210], xmm6
mov rsi, r9
mov ebx, r8d
mov rdi, rdx
mov r14, rcx
mov rax, qword [0x1401e8038]
xor rax, rsp
mov qword [rsp + 0x208], rax
mov rcx, qword [0x140202078]
test rcx, rcx
jne 0x14002a85c
call fcn.140047b60
mov rcx, rax
mov qword [0x140202078], rax
mov rdx, r14
mov r8d, 1
mov r9d, 0x1201bf
call fcn.140047e50
mov ebp, eax
mov rcx, qword [0x140202078]
test rcx, rcx
jne 0x14002a88d
call fcn.140047b60
mov rcx, rax
mov qword [0x140202078], rax
mov edx, ebx
mov r8d, ebp
call fcn.140048c00
test al, al
je 0x14002aaa7
xor ecx, ecx
call fcn.14002b6b0
test al, al
je 0x14002aa2a
movaps xmm6, xmmword [0x1401bc9e0]
lea rdi, [rsp + 0x1b0]
movaps xmmword [rdi + 0x40], xmm6
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
mov rcx, rdi
xor edx, edx
call fcn.14009a0e0
lea rcx, str.newautoupdater
lea rbx, [rsp + 0x1a0]
mov qword [rbx], rcx
call fcn.1401464a0
mov qword [rbx + 8], rax
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
call fcn.14009b990
movabs rdi, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x180]
mov qword [rsi + 0x10], rdi
movaps xmmword [rsi], xmm6
mov rcx, rsi
call fcn.1400efe80
mov ecx, 1
mov rdx, rsi
call fcn.14008b4d0
test al, al
je 0x14002aa10
xorps xmm0, xmm0
movups xmmword [rsp + 0x118], xmm0
movups xmmword [rsp + 0x128], xmm0
movups xmmword [rsp + 0x168], xmm0
movups xmmword [rsp + 0x158], xmm0
movups xmmword [rsp + 0x148], xmm0
movups xmmword [rsp + 0x138], xmm0
mov qword [rsp + 0x178], 0
movabs rax, 0x4000000070
mov qword [rsp + 0x110], rax
lea rax, str.runas
mov qword [rsp + 0x120], rax
cmp byte [rsp + 0x197], 0
jns 0x14002a9ab
mov rsi, qword [rsp + 0x180]
mov qword [rsp + 0x128], rsi
lea rsi, [rsp + 0xf0]
mov qword [rsi + 0x10], rdi
movaps xmmword [rsi], xmm6
lea rcx, [rsp + 0x1b0]
mov rdx, rsi
call fcn.14009c5d0
cmp byte [rsi + 0x17], 0
jns 0x14002a9e0
mov rsi, qword [rsp + 0xf0]
lea rcx, [rsp + 0x110]
mov qword [rcx + 0x20], rsi
mov dword [rcx + 0x30], 5
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp byte [rsp + 0x107], 0
jns 0x14002aa10
mov rcx, qword [rsp + 0xf0]
call fcn.140123e5c
lea rcx, [rsp + 0x180]
call fcn.1400f0110
lea rcx, [rsp + 0x1b0]
call fcn.14009a670
mov rcx, qword [rsp + 0x208]
xor rcx, rsp
call fcn.1401249d0
movaps xmm6, xmmword [rsp + 0x210]
movaps xmm7, xmmword [rsp + 0x220]
add rsp, 0x238
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, r14
and rax, 0xfffffffffffffff8
add rax, 8
mov r15, r14
or r15, 7
cmp r15, 0x17
cmove r15, rax
inc r15
mov rcx, r15
call fcn.140123e20
mov rcx, rax
mov qword [rsp + 0x1b0], rax
add r13, 9
or r13, r15
mov qword [rsp + 0x1c0], r13
mov qword [rsp + 0x1b8], r14
jmp 0x14002ab0d
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x120], r12
movaps xmm6, xmmword [0x1401bc9e0]
movaps xmmword [rsp + 0x110], xmm6
call fcn.1400393c0
test rax, rax
je 0x14002b0c7
mov rbx, rax
movabs r13, 0x7ffffffffffffff7
mov rcx, rax
call fcn.1401464a0
cmp rax, r13
ja 0x14002b08e
mov r14, rax
cmp rax, 0x16
ja 0x14002aa5e
lea rcx, [rsp + 0x1b0]
mov byte [rcx + 0x17], r14b
lea r15, [rcx + r14]
cmp rcx, rbx
ja 0x14002ab1f
cmp r15, rbx
ja 0x14002b0f3
test r14, r14
je 0x14002ab2f
mov rdx, rbx
mov r8, r14
call fcn.1401272b0
mov byte [r15], 0
lea rdx, str._autoupdate.version
lea rbx, [rsp + 0x1b0]
mov r8d, shutdown
mov rcx, rbx
call fcn.14007c060
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x120], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x110], xmm0
xorps xmm7, xmm7
movups xmmword [rax], xmm7
mov qword [rax + 0x10], 0
cmp byte [rbx + 0x17], 0
jns 0x14002ab88
mov rcx, qword [rsp + 0x1b0]
call fcn.140123e5c
lea r14, [rsp + 0x1b0]
mov qword [r14 + 0x10], r12
movaps xmmword [r14], xmm6
lea rcx, str.files_list
lea rbx, [rsp + 0xe0]
mov qword [rbx], rcx
call fcn.140146754
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, r14
mov r8, rbx
call fcn.1400f1a30
lea rbx, [rsp + 0x180]
movaps xmmword [rbx], xmm7
mov qword [rbx + 0x10], 0
mov rcx, r14
mov rdx, rbx
call fcn.14008c2d0
test al, al
je 0x14002ae1a
mov qword [rsp + 0x100], r12
movaps xmmword [rsp + 0xf0], xmm6
movzx ecx, byte [rsp + 0x197]
mov eax, ecx
and eax, 0x7f
test cl, cl
lea rcx, [0x1401c0845]
cmovs rax, qword [rsp + 0x188]
mov qword [rsp + 0xd0], rcx
cmovs rbx, qword [rsp + 0x180]
mov qword [rsp + 0xd8], 2
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xc8], rax
test rax, rax
js 0x14002b062
test rbx, rbx
jne 0x14002ac5a
test rax, rax
jne 0x14002b09b
mov dword [rsp + 0x20], 1
lea rbx, [rsp + 0xf0]
lea rdx, [rsp + 0xc0]
lea r8, [rsp + 0xd0]
mov rcx, rbx
xor r9d, r9d
call fcn.1400e7100
mov r14, qword [rbx]
cmp r14, qword [rbx + 8]
je 0x14002ae15
lea r14, str.opera_autoupdate.exe
lea r15, [rsp + 0x98]
mov qword [r15], r14
mov rcx, r14
call fcn.1401464a0
mov rbx, rax
mov qword [r15 + 8], rax
lea r12, [rsp + 0xa8]
mov rcx, rdi
mov rdx, r12
mov r8, r15
call fcn.140098e00
lea r8, [rsp + 0x70]
mov qword [r8], r14
mov qword [rsp + 0x28], rbx
mov qword [r8 + 8], rbx
lea r14, [rsp + 0x80]
mov rcx, rsi
mov rdx, r14
call fcn.140098e00
mov rcx, r14
mov rdx, r12
call fcn.14018bb90
mov ebp, eax
mov rcx, r14
call fcn.1400f0110
mov rcx, r12
call fcn.1400f0110
test bpl, bpl
je 0x14002ae0d
lea rdx, [rsp + 0x110]
movzx ecx, byte [rdx + 0x17]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [rdx + 8]
mov rcx, qword [rdx]
cmovns rcx, rdx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
test rax, rax
js 0x14002b062
test rcx, rcx
jne 0x14002ad53
test rax, rax
jne 0x14002b09b
lea rdx, [rsp + 0xa8]
lea r8, [rsp + 0x60]
mov rcx, rdi
call fcn.140098e00
movzx ecx, byte [rsp + 0x127]
mov eax, ecx
and eax, 0x7f
test cl, cl
cmovs rax, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x110]
lea rdx, [rsp + 0x110]
cmovns rcx, rdx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
test rax, rax
js 0x14002b062
test rcx, rcx
jne 0x14002adb5
test rax, rax
jne 0x14002b09b
lea r14, [rsp + 0x80]
lea r8, [rsp + 0x50]
mov rcx, rsi
mov rdx, r14
call fcn.140098e00
lea r15, [rsp + 0xa8]
mov rcx, r14
mov rdx, r15
call fcn.14018bb90
mov rcx, r14
call fcn.1400f0110
mov rcx, r15
call fcn.1400f0110
mov r12, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xf8]
jmp 0x14002afdc
mov rcx, rsi
call fcn.140088f20
mov r14, qword [rsp + 0xf0]
test r14, r14
jne 0x14002ae5e
cmp byte [rsp + 0x197], 0
jns 0x14002ae31
mov rcx, qword [rsp + 0x180]
call fcn.140123e5c
lea rcx, [rsp + 0x1b0]
call fcn.1400f0110
cmp byte [rsp + 0x127], 0
jns 0x14002aa2a
mov rcx, qword [rsp + 0x110]
call fcn.140123e5c
jmp 0x14002aa2a
mov rsi, qword [rsp + 0xf8]
mov rcx, r14
cmp rsi, r14
je 0x14002ae95
add rsi, 0xffffffffffffffe8
test rsi, rsi
je 0x14002b11f
cmp byte [rsi + 0x17], 0
js 0x14002aea7
lea rax, [rsi - 0x18]
cmp rsi, r14
mov rsi, rax
jne 0x14002ae72
mov rcx, qword [rsp + 0xf0]
mov qword [rsp + 0xf8], r14
call fcn.140123e5c
jmp 0x14002ae1a
mov rcx, qword [rsi]
call fcn.140123e5c
jmp 0x14002ae81
mov rcx, qword [r12]
mov rax, qword [r12 + 8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
test rax, rax
jns 0x14002af8f
jmp 0x14002b062
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r15
test r15, r15
jns 0x14002af51
jmp 0x14002b062
mov rcx, qword [r12]
mov r8, r15
call fcn.1401271b0
test eax, eax
je 0x14002afd8
test r14b, r14b
mov r13, qword [r12]
mov rcx, r12
cmovs rcx, r13
test rbx, rbx
js 0x14002b062
je 0x14002af1c
test rcx, rcx
je 0x14002b09b
cmp rbx, qword [rsp + 0x28]
jne 0x14002af3c
lea rdx, str.opera_autoupdate.exe
mov r8, qword [rsp + 0x28]
call fcn.1401271b0
test eax, eax
je 0x14002afd8
test r14b, r14b
js 0x14002aed2
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r14
mov r13, r12
mov r15, r14
test r13, r13
jne 0x14002af5f
test r15, r15
jne 0x14002b09b
mov rcx, rdi
lea rdx, [rsp + 0xa8]
lea r8, [rsp + 0x40]
call fcn.140098e00
movzx eax, byte [r12 + 0x17]
test al, al
js 0x14002aeb1
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], rax
mov rcx, r12
test rcx, rcx
jne 0x14002af9d
test rax, rax
jne 0x14002b09b
mov rcx, rsi
lea r14, [rsp + 0x80]
mov rdx, r14
lea r8, [rsp + 0x30]
call fcn.140098e00
mov rcx, r14
lea rbx, [rsp + 0xa8]
mov rdx, rbx
call fcn.14018bb90
mov rcx, r14
call fcn.1400f0110
mov rcx, rbx
call fcn.1400f0110
add r12, 0x18
cmp r12, rbp
je 0x14002ae05
movzx r14d, byte [r12 + 0x17]
mov eax, r14d
and eax, 0x7f
test r14b, r14b
mov r15, qword [r12 + 8]
mov rbx, rax
cmovs rbx, r15
movzx ecx, byte [rsp + 0x127]
test cl, cl
js 0x14002b013
mov edx, ecx
and edx, 0x7f
jmp 0x14002b01b
mov rdx, qword [rsp + 0x118]
cmp rbx, rdx
jne 0x14002aefa
lea rdx, [rsp + 0x110]
test cl, cl
jns 0x14002b038
mov rdx, qword [rsp + 0x110]
test r14b, r14b
js 0x14002aee6
test al, al
je 0x14002afd8
xor ecx, ecx
mov r8b, byte [r12 + rcx]
cmp r8b, byte [rdx + rcx]
jne 0x14002aefa
inc rcx
cmp rax, rcx
jne 0x14002b047
jmp 0x14002afd8
lea rax, str.string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len___static_cast_size_type__numeric_limits_difference_type_::max___
mov r8d, 0x13a
call fcn.14016a900
lea rcx, [rsp + 0x1b0]
call fcn.14015f3a0
lea rax, str.string_view::string_view__CharT___size_t_:_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string_view
lea r9, str.__len__0____s___nullptr
mov r8d, 0x13c
call fcn.14016a900
lea rax, str.basic_string_const_char__detected_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude_string
lea r9, str.__s___nullptr
mov r8d, 0x3a7
call fcn.14016a900
lea rax, str.char_traits::copy_overlapped_range
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__stringchar_traits.h
lea r9, str.__s2_____s1____s2_____s1____n
mov r8d, 0xf3
call fcn.14016a900
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x44
call fcn.14016a900
int3