Function at 0x14016f8d0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rbx, rdx
mov r14, rcx
mov rsi, qword [rcx]
mov rdi, qword [rsi + 0x2e8]
cmp dword [rdx + 0x48], 0xf
je 0x14016f94b
mov dword [rdx + 0x48], 0xf
movzx eax, byte [rdx + 0x40]
shr al, 4
test al, 1
jne 0x14016f92a
mov rcx, rdx
call fcn.1400d61e0
mov dl, 1
mov rcx, rax
call fcn.1400e03e0
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], 4
lea rcx, [rsi + 0x388]
lea r8, [rsp + 0x48]
mov rdx, rsi
call fcn.140119670
lea r15, [0x140323de0]
mov qword [rsp + 0x58], r15
xor ebp, ebp
mov qword [rsp + 0x60], rbp
lea r8, [rsp + 0x58]
mov rdx, rbx
mov rcx, r14
call fcn.14016fb80
mov esi, eax
lea edx, [rax + 2]
cmp edx, 1
jbe 0x14016faac
test eax, eax
jne 0x14016f9f0
cmp qword [rdi + 8], rbp
je 0x14016f9b3
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov rcx, rax
mov dword [rsp + 0x30], 0x13
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 2]
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x14016f9ba
mov byte [rdi + 0xaf], 0
mov r8, qword [r14]
xor edx, edx
mov rcx, rbx
call fcn.1400d6b40
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov r8, qword [rsp + 0x58]
lea rdx, str.OPEN
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x14016fb49
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], rbp
lea r8, [rsp + 0x48]
mov rdx, rbx
mov rcx, r14
call fcn.140170400
mov esi, eax
test eax, eax
jne 0x14016fa9b
cmp qword [rdi + 8], 0
je 0x14016fa48
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov rcx, rax
mov dword [rsp + 0x30], 0x13
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
lea rdx, [r9 - 2]
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x14016fa4f
mov byte [rdi + 0xaf], 0
mov r8, qword [r14]
xor edx, edx
mov rcx, rbx
call fcn.1400d6b40
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov r8, qword [rsp + 0x48]
lea rdx, str.OPEN
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
cmp dword [rsp + 0x50], 0
jle 0x14016fb49
mov rcx, qword [rsp + 0x48]
call fcn.140298600
jmp 0x14016fb49
cmp dword [rsp + 0x50], 0
jle 0x14016faac
mov rcx, qword [rsp + 0x48]
call fcn.140298600
mov rdi, qword [r14]
cmp dword [rbx + 0x48], 6
je 0x14016fafa
mov dword [rbx + 0x48], 6
movzx eax, byte [rbx + 0x40]
shr al, 4
test al, 1
jne 0x14016fad9
mov rcx, rbx
call fcn.1400d61e0
mov dl, 1
mov rcx, rax
call fcn.1400e03e0
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], 4
lea rcx, [rdi + 0x388]
lea r8, [rsp + 0x48]
mov rdx, rdi
call fcn.140119670
cmp esi, 0xffffffff
jne 0x14016fb17
mov rax, qword [r14]
mov rcx, qword [rax + 0x2e8]
mov rax, qword [rcx]
call qword [rax]
lea rdx, str.API_key_invalid__result__1_
jmp 0x14016fb32
cmp esi, 0xfffffffe
jne 0x14016fb49
mov rax, qword [r14]
mov rcx, qword [rax + 0x2e8]
mov rax, qword [rcx]
call qword [rax]
lea rdx, str.Quota_exceeded__result__2__r_n_r_nVirusTotal_allows_20_requests_of_any_nature_in_a_given_5_minutes_time_frame._r_n_r_nTry_again_in_a_few_minutes.
mov r9d, 0x30
lea r8, str.VirusTotal
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
cmp dword [rsp + 0x60], 0
jle 0x14016fb5a
mov rcx, qword [rsp + 0x58]
call fcn.140298600
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret