Function at 0x14000a5e0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push r13
lea rbp, [rsp - 0xd8]
sub rsp, 0x1d8
mov rax, qword [0x140063848]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov edi, edx
mov r13, rcx
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp byte [0x140065a70], 0
mov rsi, rax
jbe 0x14000a624
xor al, al
jmp 0x14000aa89
mov qword [rsp + 0x210], rbx
mov qword [rsp + 0x1c0], r15
test rax, rax
je 0x14000aa77
lea r8, [rsp + 0x38]
xor r15d, r15d
mov edx, 0x6e744243
mov ecx, edi
mov qword [rsp + 0x38], r15
call fcn.14000ae10
mov ebx, r15d
lea r8d, [r15 + 0x6c]
test al, al
lea rcx, [rsp + 0x44]
mov dword [rsp + 0x40], 0x70
cmovne rbx, qword [rsp + 0x38]
xor edx, edx
call fcn.14003e820
test rbx, rbx
je 0x14000aa77
mov eax, dword [rbx + 0x38]
mov qword [rsp + 0x1d0], r12
cmp eax, 1
je 0x14000a8de
cmp eax, 2
je 0x14000a8de
cmp eax, 6
je 0x14000a8de
xor r12b, r12b
xor edx, edx
mov ecx, 1
mov qword [rsp + 0x1c8], r14
call fcn.14000dfb0
mov edx, dword [rbx + 0x38]
lea rcx, [0x14004eb38]
test edx, edx
je 0x14000a6d6
cmp edx, 1
jne 0x14000a79d
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbx + 0x28]
xor dil, dil
call fcn.14002e590
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rax
mov r15, rax
call fcn.1400161d0
mov r14, rax
test rax, rax
je 0x14000a77d
mov rcx, rax
call fcn.140009f80
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x58], r14
neg al
sbb ecx, ecx
xor eax, eax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
and ecx, 0x80
mov qword [rsp + 0x60], rax
bts ecx, 0xa
mov eax, 1
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x44], ecx
mov rcx, qword [rbx + 0x30]
cmp byte [rcx], dil
je 0x14000a76c
lea rdx, [rbp - 0x50]
mov r8d, pe_nt_image_headers64
call fcn.140011d20
test al, al
lea rax, [rbp - 0x50]
jne 0x14000a763
mov rax, qword [rbx + 0x30]
or dword [rsp + 0x44], 1
mov qword [rbp - 0x78], rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
setne dil
mov rcx, r15
call fcn.14002e3f0
movzx r12d, r12b
test dil, dil
mov r15d, 0
lea rcx, [0x14004eb38]
cmove r12d, r15d
mov eax, dword [rbx + 0x38]
cmp eax, 4
je 0x14000a7aa
cmp eax, 6
jne 0x14000a813
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbx + 0x28]
xor dil, dil
call fcn.14002e590
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.1400161d0
test rax, rax
je 0x14000a800
cmp dword [rbx + 0x38], 6
mov r9, qword [rsp + 0x30]
mov edx, r15d
mov ecx, 1
mov r8, rax
cmove edx, ecx
inc byte [0x140065a70]
mov rcx, r13
call fcn.1400045c0
dec byte [0x140065a70]
movzx edi, al
mov rcx, r14
call fcn.14002e3f0
movzx r12d, r12b
test dil, dil
cmove r12d, r15d
cmp dword [rbx + 0x38], 3
jne 0x14000a86f
mov rdi, qword [rbx + 0x28]
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
not rcx
lea r14, [rcx - 1]
call fcn.14002e3a0
mov rdi, rax
test rax, rax
je 0x14000a86f
mov rcx, qword [rbx + 0x28]
lea r9, [r14 + 1]
mov r8, rax
xor edx, edx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call fcn.14002fc10
test al, al
je 0x14000a867
xor r8d, r8d
mov rdx, rdi
mov rcx, r13
call fcn.140003cf0
mov rcx, rdi
call fcn.14002e3f0
mov r14, qword [rsp + 0x1c8]
test r12b, r12b
je 0x14000a88f
xor r9d, r9d
xor r8d, r8d
mov rcx, r13
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageA]
cmp dword [rbx + 0x38], 5
jne 0x14000a8a3
mov edx, 6
mov rcx, r13
call qword [sym.imp.USER32.dll_ShowWindow]
cmp dword [rbx + 0x38], 7
jne 0x14000a8ae
call fcn.1400071f0
cmp dword [rbx + 0x38], 8
jne 0x14000a8b9
call fcn.140007270
cmp dword [rbx + 0x38], 0xb
jne 0x14000a8fc
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x14000a8f7
call fcn.1400071f0
jmp 0x14000a8fc
mov r12b, 1
call fcn.14000de30
test al, al
je 0x14000a6ab
movzx edx, r12b
jmp 0x14000a6ad
call fcn.140007270
cmp dword [rbx + 0x38], 0xc
jne 0x14000a925
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x14000a91e
xor ecx, ecx
jmp 0x14000a920
mov cl, 1
call fcn.14000ddf0
mov eax, dword [rbx + 0x38]
cmp eax, 0xb
je 0x14000a932
cmp eax, 0xc
jne 0x14000a96f
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageA]
xor r9d, r9d
mov edx, 0xf1
mov rcx, rsi
test eax, eax
jne 0x14000a966
mov r12d, 1
mov r8d, r12d
call qword [sym.imp.USER32.dll_SendMessageA]
jmp 0x14000a975
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageA]
mov r12d, 1
cmp dword [rbx + 0x38], 0xd
jne 0x14000a9ed
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageA]
xor r9d, r9d
mov edx, 0xf1
mov rdi, rax
mov rcx, rsi
test eax, eax
jne 0x14000a9a6
mov r8, r12
jmp 0x14000a9a9
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageA]
mov r8, qword [rbx + 0x30]
mov rdx, qword [rbx + 0x28]
mov eax, 0
test edi, edi
mov rcx, r13
sete al
mov r9d, eax
call fcn.14000ad40
test eax, eax
je 0x14000a9d9
dec eax
jne 0x14000a9ed
mov r8, r12
jmp 0x14000a9dc
xor r8d, r8d
xor r9d, r9d
mov edx, 0xf1
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageA]
cmp dword [rbx + 0x38], 0xe
jne 0x14000aa4a
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageA]
xor r9d, r9d
mov edx, 0xf1
mov rcx, rsi
test eax, eax
jne 0x14000aa30
mov r8, r12
call qword [sym.imp.USER32.dll_SendMessageA]
mov rdx, qword [rbx + 0x28]
mov r8b, 1
mov rcx, r13
call fcn.14000a110
jmp 0x14000aa59
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageA]
mov rdx, qword [rbx + 0x28]
xor r8d, r8d
mov rcx, r13
call fcn.14000a110
jmp 0x14000aa59
lea rcx, [0x14000a200]
mov rdx, r13
call fcn.14000c000
cmp dword [rbx + 0x38], 9
mov r12, qword [rsp + 0x1d0]
jne 0x14000aa73
mov rdx, qword [rbx + 0x28]
mov rcx, r13
call fcn.140012430
mov al, 1
jmp 0x14000aa79
xor al, al
mov rbx, qword [rsp + 0x210]
mov r15, qword [rsp + 0x1c0]
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14003e7f0
add rsp, 0x1d8
pop r13
pop rdi
pop rsi
pop rbp
ret