Function at 0x1400022f0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov qword [rbp - 0x49], 0xfffffffffffffffe
mov qword [rsp + 0xf0], rbx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, rdx
mov rbx, rcx
call fcn.140037b20
test al, al
jne 0x14000262a
cmp byte [rbx + 0x210], al
je 0x1400023c9
lea rdx, str.Unable_to_re_spawn_cleanup_in_admin_user_
mov rcx, rbx
call fcn.1400333e0
mov rcx, rbx
call fcn.140032620
mov qword [rbp - 0x29], 7
xor edi, edi
mov qword [rbp - 0x31], rdi
mov word [rbp - 0x41], di
lea rcx, [rbx + 0x258]
call fcn.140035130
lea r8, [rbp - 0x41]
movzx edx, ax
lea ecx, [rdi + 0x6a]
call fcn.140037210
test al, al
je 0x1400023a8
lea rdx, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rdx, qword [rbp - 0x41]
lea r8, [rbx + 0xc80]
xor ecx, ecx
mov r9d, 0x1010
call fcn.140039bb0
nop
mov r8, qword [rbp - 0x29]
cmp r8, 8
jb 0x1400023c2
inc r8
mov rdx, qword [rbp - 0x41]
lea rcx, [rbp - 0x41]
call fcn.140003ec0
xor al, al
jmp 0x14000262c
mov qword [rbp - 0x29], 7
xor edi, edi
mov qword [rbp - 0x31], rdi
mov word [rbp - 0x41], di
lea r8d, [rdi + 9]
lea rdx, str.__respawn
lea rcx, [rbp - 0x41]
call fcn.140003a80
nop
mov qword [rbp + 0x17], 7
mov qword [rbp + 0xf], rdi
mov word [rbp - 1], di
cmp word [rsi], di
jne 0x14000240a
mov r8d, edi
jmp 0x14000241b
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rsi + r8*2], 0
jne 0x140002410
mov rdx, rsi
lea rcx, [rbp - 1]
call fcn.140003a80
nop
lea r8, [rbp - 0x41]
lea rdx, [rbp - 1]
lea rcx, [rbp + 0x1f]
call fcn.140004ba0
nop
mov r8, qword [rbp + 0x17]
cmp r8, 8
jb 0x140002454
inc r8
mov rdx, qword [rbp - 1]
lea rcx, [rbp - 1]
call fcn.140003ec0
mov qword [rbp + 0x17], 7
mov qword [rbp + 0xf], rdi
mov word [rbp - 1], di
mov r8, qword [rbp - 0x29]
cmp r8, 8
jb 0x14000247e
inc r8
mov rdx, qword [rbp - 0x41]
lea rcx, [rbp - 0x41]
call fcn.140003ec0
mov qword [rbp - 0x29], 7
mov qword [rbp - 0x31], rdi
mov word [rbp - 0x41], di
lea r9, [rbp + 0x1f]
cmp qword [rbp + 0x37], 8
cmovae r9, qword [rbp + 0x1f]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
lea r8, str.cleanup.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja case.default.0x1400024e3
cdqe
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x2684]
mov ecx, dword [rdx + rax*4 + 0x264c]
add rcx, rdx
jmp rcx
lea rdx, str.ERROR:_The_operating_is_out_of_memory_or_resources.__Terminating_install.
jmp 0x14000257a
mov r8, rbx
lea rdx, str.ERROR:_Cleanup.exe_not_found_in__s.__Terminating_install.
mov rcx, rbx
call fcn.1400333e0
jmp 0x140002582
mov r8, rbx
lea rdx, str.ERROR:_The_path__s_is_not_found.__Terminating_install.
mov rcx, rbx
call fcn.1400333e0
jmp 0x140002582
lea rdx, str.ERROR:_The_.exe_file_is_invalid_or_error_in_.exe_image.__Terminating_install.
jmp 0x14000257a
lea rdx, str.ERROR:_Operating_system_denied_access_to_Cleanup.exe.__Terminating_install.
jmp 0x14000257a
lea rdx, str.ERROR:_The_file_name_association_is_incomplete_or_invalid.__Terminating_install.
jmp 0x14000257a
lea rdx, str.ERROR:_The_DDE_transaction_could_not_be_completed_because_other_DDE_transactions_were_being_processed.__Terminating_install.
jmp 0x14000257a
lea rdx, str.ERROR:_The_DDE_transaction_failed.__Terminating_install.
jmp 0x14000257a
lea rdx, str.ERROR:_The_DDE_transaction_could_not_be_completed_because_the_request_timed_out.__Terminating_install.
jmp 0x14000257a
lea rdx, str.ERROR:_The_specified_DLL_was_not_found.__Terminating_install.
jmp 0x14000257a
lea rdx, str.ERROR:_There_is_no_application_associated_with_the_given_file_name_extension._This_error_will_also_be_returned_if_you_attempt_to_print_a_file_that_is_not_printable.__Terminating_install.
jmp 0x14000257a
lea rdx, str.ERROR:_There_was_not_enough_memory_to_complete_the_operation.__Terminating_install.
jmp 0x14000257a
lea rdx, str.ERROR:_A_sharing_violation_occurred.__Terminating_install.
jmp 0x14000257a
lea rdx, str.ERROR:_Unable_to_re_spawn_Cleanup.exe_as_admin_user.__Terminating_install.
mov rcx, rbx
call fcn.1400333e0
mov rcx, rbx
call fcn.140032620
mov qword [rbp - 9], 7
mov qword [rbp - 0x11], rdi
mov word [rbp - 0x21], di
lea rcx, [rbx + 0x258]
call fcn.140035130
lea r8, [rbp - 0x21]
movzx edx, ax
mov ecx, 0x6a
call fcn.140037210
test al, al
je 0x1400025de
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rdx, qword [rbp - 0x21]
lea r8, [rbx + 0xc80]
xor ecx, ecx
mov r9d, 0x1010
call fcn.140039bb0
nop
mov r8, qword [rbp - 9]
cmp r8, 8
jb 0x1400025f8
inc r8
mov rdx, qword [rbp - 0x21]
lea rcx, [rbp - 0x21]
call fcn.140003ec0
mov qword [rbp - 9], 7
mov qword [rbp - 0x11], rdi
mov word [rbp - 0x21], di
mov r8, qword [rbp + 0x37]
cmp r8, 8
jb 0x1400023c2
inc r8
mov rdx, qword [rbp + 0x1f]
lea rcx, [rbp + 0x1f]
call fcn.140003ec0
xor al, al
jmp 0x14000262c
mov al, 1
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14003a3d0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret