Function at 0x14000ead0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x68]
sub rsp, 0x150
mov qword [rbp], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140137088]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov rbx, rcx
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9d, dword [rsp + 0x4c]
mov r8d, dword [rsp + 0x48]
mov edx, 0x100
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.USER32.dll_TrackPopupMenu]
mov esi, eax
mov edx, eax
sub edx, 2
je 0x14000f043
sub edx, 4
je 0x14000f022
sub edx, 1
je 0x14000efe4
cmp edx, 1
je 0x14000efa8
call fcn.140002d80
lea rdx, [rax + 0xf0]
lea rcx, [rbp - 0x18]
call fcn.14000f1f0
nop
mov r9, qword [rbp - 0x18]
mov rbx, r9
mov r8, qword [rbp - 0x10]
cmp r9, r8
je 0x14000ebda
nop word [rax + rax]
mov edi, dword [rbx]
lea eax, [rdi + 0x3e8]
lea ecx, [rax + rax*4]
add ecx, ecx
mov edx, esi
sub edx, ecx
je 0x14000ed64
sub edx, 1
je 0x14000ecc2
sub edx, 1
je 0x14000ec69
cmp edx, 1
je 0x14000ec4d
add rbx, 0x405
cmp rbx, r8
jne 0x14000eba0
sub r8, r9
movabs rax, 0x7f60c70736fb45e9
imul r8
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov eax, esi
sub eax, edx
cmp eax, 0x3e8
mov eax, dword [0x14013b418]
jne 0x14000eebe
test al, 1
jne 0x14000ec3a
or eax, 1
mov dword [0x14013b418], eax
call fcn.1400046a0
lea rax, vtable.RC::RCSingleton_class_RC::HaoZipCDBizApplicate_.0
mov qword [0x14013b150], rax
lea rcx, [0x1400e52c0]
call fcn.1400a92f4
nop
mov dl, 1
lea rcx, [0x14013b150]
call fcn.1400073c0
jmp 0x14000ef9a
test edi, edi
js 0x14000ef9a
call fcn.140002d80
mov rcx, rax
mov edx, edi
call fcn.140007170
jmp 0x14000ef9a
lea rdx, [rbx + 5]
cmp word [rdx], 0
je 0x14000ef9a
movdqa xmm0, xmmword [0x140101490]
movdqu xmmword [rbp + 0x38], xmm0
mov word [rbp + 0x28], r14w
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x14000ec90
lea rcx, [rbp + 0x28]
call fcn.140002400
nop
call fcn.140002d80
lea rdx, [rbp + 0x28]
call fcn.140004d30
nop
lea rcx, [rbp + 0x28]
call fcn.140002380
jmp 0x14000ef9a
cmp word [rbx + 5], 0
je 0x14000ef9a
call fcn.140002d80
mov rsi, rax
lea rax, [rbp + 8]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x18], r14
mov qword [rbp + 0x20], 7
mov word [rbp + 8], r14w
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2 + 5], 0
jne 0x14000ed00
lea rdx, [rbx + 5]
lea rcx, [rbp + 8]
call fcn.140002400
nop
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r14w
xor r8d, r8d
lea rdx, [0x1400f7030]
lea rcx, [rbp + 0x28]
call fcn.140002400
call qword [sym.imp.USER32.dll_GetActiveWindow]
nop
mov qword [rsp + 0x20], rax
movzx r9d, byte [rbx + 4]
lea r8, [rbp + 8]
lea rdx, [rbp + 0x28]
mov rcx, rsi
call fcn.140005e40
jmp 0x14000ef9a
cmp word [rbx + 5], 0
je 0x14000ef9a
call fcn.140002d80
mov edi, r14d
movdqa xmm0, xmmword [0x140101490]
movdqu xmmword [rbp + 0x18], xmm0
mov word [rbp + 8], r14w
lea rcx, [rbx + 4]
lea r8, [rbp + 8]
call fcn.140021e70
mov r8d, 1
lea rdx, [0x1400f8740]
lea rcx, [rbp + 8]
call fcn.140009030
lea rbx, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae rbx, qword [rbp + 8]
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x68]
call fcn.1400ab220
mov dword [rsp + 0x60], 0x70
mov dword [rsp + 0x64], 0x400
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x70], 1
mov qword [rbp - 0x38], r14
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14000ee23
cmp qword [rbp - 0x68], 0x20
seta al
test al, al
jne 0x14000eeb0
jmp 0x14000ee32
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x4c7
je 0x14000eeb0
lea rbx, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae rbx, qword [rbp + 8]
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x68]
call fcn.1400ab220
mov dword [rsp + 0x60], 0x70
mov dword [rsp + 0x64], 0x400
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x68], rax
lea rax, str.edit
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x70], 1
mov qword [rbp - 0x38], r14
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14000eea8
cmp qword [rbp - 0x68], 0x20
seta al
jmp 0x14000eeb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rcx, [rbp + 8]
call fcn.140002380
jmp 0x14000ef9a
test al, 1
jne 0x14000eeeb
or eax, 1
mov dword [0x14013b418], eax
call fcn.1400046a0
lea rax, vtable.RC::RCSingleton_class_RC::HaoZipCDBizApplicate_.0
mov qword [0x14013b150], rax
lea rcx, [0x1400e52c0]
call fcn.1400a92f4
nop
lea rdx, [0x14013b2b0]
lea rcx, [rbp - 0x30]
call fcn.14000f310
nop
lea ecx, [rsi - 0x7d0]
test ecx, ecx
js 0x14000ef38
mov rax, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x30]
sub rax, rdx
sar rax, 5
cmp ecx, eax
jge 0x14000ef38
movsxd rbx, ecx
shl rbx, 5
add rbx, rdx
call fcn.140002d80
mov rcx, rax
xor r8d, r8d
mov rdx, rbx
call fcn.140007080
jmp 0x14000ef90
cmp esi, 0xa
jne 0x14000ef90
call fcn.140002d80
mov r14, rax
mov rdi, qword [rax + 0x168]
mov rbx, qword [rax + 0x160]
cmp rbx, rdi
je 0x14000ef70
mov rcx, rbx
call fcn.140002380
add rbx, 0x20
cmp rbx, rdi
jne 0x14000ef58
mov rbx, qword [r14 + 0x160]
mov qword [r14 + 0x168], rbx
lea rcx, [r14 + 0x118]
call fcn.140018ba0
lea rcx, [r14 + 0x180]
call fcn.1400143c8
nop
lea rcx, [rbp - 0x30]
call fcn.140008f80
nop
lea rcx, [rbp - 0x18]
call fcn.140008e20
jmp 0x14000f0c5
mov edx, 3
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.USER32.dll_GetSubMenu]
xor r8d, r8d
lea edx, [r8 + 8]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMenuState]
mov ebx, eax
shr ebx, 3
and bl, 1
call fcn.140002d80
xor bl, 1
movzx edx, bl
call fcn.140008200
jmp 0x14000f0c5
mov edx, 3
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.USER32.dll_GetSubMenu]
xor r8d, r8d
lea edx, [r8 + 7]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMenuState]
mov ebx, eax
shr ebx, 3
not bl
and bl, 1
call fcn.140002d80
mov rcx, rax
movzx edx, bl
call fcn.140008030
jmp 0x14000f0c5
call fcn.140002d80
cmp byte [rax + 0x1a2], r14b
jne 0x14000f0c5
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x14000f0c5
lea rax, [rbp + 0x28]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r14w
xor r8d, r8d
lea rdx, [0x1400f7030]
lea rcx, [rbp + 0x28]
call fcn.140002400
nop
mov qword [rbp + 0x18], r14
mov qword [rbp + 0x20], 7
mov word [rbp + 8], r14w
xor r8d, r8d
lea rdx, [0x1400f7030]
lea rcx, [rbp + 8]
call fcn.140002400
nop
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
call fcn.140002d80
mov rcx, rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rbp + 0x28]
lea rdx, [rbp + 8]
call fcn.140005e40
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.1400a8f20
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret