Function at 0x14010cf30
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, rcx
test r9d, r9d
jne 0x14010d020
lea rax, [rbp - 0x40]
mov qword [rbp - 0x38], rax
call fcn.140044940
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_UPDATE_DOWNLOAD_FAILED
call fcn.140048080
mov rbx, rax
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x14010d2a5
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rbp - 0x40], rax
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.140018bd0
test al, al
jne 0x14010cfed
test rbx, rbx
jne 0x14010cfc9
xor r14d, r14d
jmp 0x14010cfdd
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rbx + rdi*2], 0
jne 0x14010cfd0
mov r14d, edi
mov r8d, r14d
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.140018f70
nop
call fcn.1401285c0
lea rcx, [0x1402620b8]
lea r8, [0x1402620c0]
cmp dword [rax + 0x88], 0
cmovne r8, rcx
xor r9d, r9d
lea rdx, [rbp - 0x40]
mov rcx, qword [r15 + 8]
call fcn.14005fae0
jmp 0x14010d273
xor r14d, r14d
mov qword [rbp - 0x20], r14
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x14010d2b0
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rbp - 0x20], rax
mov dword [0x140306110], 1
lea rdx, [rbp - 0x20]
mov rcx, qword [r15 + 0xb0]
call fcn.14002ecd0
mov rbx, qword [rbp - 0x20]
test eax, eax
je 0x14010d1a1
cmp dword [rbx - 0x10], r14d
jl 0x14010d1a1
lea rdx, str.CNBandisoft
mov rcx, rbx
call fcn.1401f5a20
test rax, rax
je 0x14010d1a1
sub rax, rbx
sar rax, 1
test eax, eax
js 0x14010d1a1
lea rax, [rbp - 0x38]
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x40]
mov qword [rbp - 0x28], rax
call fcn.140044940
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_UPDATE_DOWNLOAD_COMPLETED
call fcn.140048080
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.140019100
mov r12, rax
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x14010d2bb
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rbp - 0x40], rax
lea rsi, [0x140293008]
mov rdx, rsi
lea rcx, [rbp - 0x40]
call fcn.140018bd0
lea rdi, [r14 - 1]
test al, al
jne 0x14010d139
mov r8, rdi
inc r8
cmp word [rsi + r8*2], 0
jne 0x14010d121
mov rdx, rsi
lea rcx, [rbp - 0x40]
call fcn.140018f70
nop
mov r8, r12
lea rdx, [rbp - 0x40]
mov rcx, qword [r15 + 0xa8]
call fcn.1400ca920
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, qword [r15 + 0xb0]
lea rdx, [0x140265d30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov dword [0x140306110], r14d
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14010d273
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
jmp 0x14010d273
mov dword [0x140306110], r14d
lea rdx, [rbx - 0x18]
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14010d1cf
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
lea rax, [rbp - 0x38]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rbp - 0x30], rax
call fcn.140044940
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_UPDATE_DOWNLOAD_FAILED
call fcn.140048080
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.140019100
mov rbx, rax
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x14010d29a
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rbp - 0x40], rax
lea rsi, [0x140293008]
mov rdx, rsi
lea rcx, [rbp - 0x40]
call fcn.140018bd0
test al, al
jne 0x14010d260
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x14010d246
mov r8d, edi
mov rdx, rsi
lea rcx, [rbp - 0x40]
call fcn.140018f70
nop
mov r8, rbx
lea rdx, [rbp - 0x40]
mov rcx, qword [r15 + 0xa8]
call fcn.1400ca920
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1401f3bf0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
int3
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
int3