Function at 0x1000c6d60
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0xb0]
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], rsi
mov qword [rbp - 8], rcx
mov byte [rbp - 0x10], dl
mov rcx, qword [rbp - 8]
call fcn.100008e60
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x68], 0
mov qword [rbp - 0x60], 0
mov qword [rbp - 0x58], 0
nop
mov byte [rbp - 0x14], 0
cmp qword [rbp - 8], 0
je 0x1000c6dc2
jmp 0x1000c6dc8
jmp 0x1000c708b
lea rax, [rbp - 0x20]
mov rbx, rax
mov rcx, rbx
call fcn.10000a950
lea rsi, [rbp - 0x28]
mov rcx, rsi
call fcn.10000a950
mov rdx, rsi
mov rcx, rbx
call fcn.1000c6800
test al, al
jne 0x1000c6df7
jmp 0x1000c7010
mov rdx, qword [rbp - 0x28]
mov r8, 1
lea rcx, [0x1001f7c20]
call fcn.10000b3d0
cmp rax, 0
jg 0x1000c6e19
jmp 0x1000c6f30
mov rdx, qword [rbp - 0x28]
mov r8, 1
lea rcx, [0x1001f7a58]
call fcn.10000b3d0
test rax, rax
je 0x1000c6e37
jmp 0x1000c6e88
cmp byte [rbp - 0x10], 0
jne 0x1000c6e3f
jmp 0x1000c6e88
mov rcx, qword [rbp - 0x20]
call fcn.1000c6320
test al, al
je 0x1000c6e4e
jmp 0x1000c6e88
lea rax, [0x1001f79d8]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x48], rax
lea rax, [0x1001f79d8]
mov qword [rbp - 0x40], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 8]
mov r9d, 0
mov r8, 2
call fcn.100009280
nop
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x58]
call fcn.10000bab0
mov rax, qword [rbp - 0x58]
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x38]
mov r8, qword [rbp - 0x40]
test r8, r8
je 0x1000c6eae
mov r8, qword [r8 - 8]
mov rdx, qword [rbp - 0x40]
test rdx, rdx
jne 0x1000c6ebe
lea rdx, [0x100294460]
call fcn.100032840
mov rax, qword [rbp - 8]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0xb
lea r8, [rbp - 0x50]
mov rdx, qword [rbp - 0x38]
mov r9, 0
lea rcx, [rbp - 0x60]
call fcn.100052770
mov rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x38]
call fcn.100008e90
mov r8, qword [rbp - 0x38]
test r8, r8
je 0x1000c6f05
mov r8, qword [r8 - 8]
mov rdx, qword [rbp - 0x38]
test rdx, rdx
jne 0x1000c6f15
lea rdx, [0x100294460]
lea rcx, [rbp - 0x68]
call fcn.100032750
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x28]
call fcn.10000ba60
jmp 0x1000c6fc3
cmp byte [rbp - 0x10], 0
jne 0x1000c6f38
jmp 0x1000c6f90
mov rdx, qword [rbp - 8]
mov r8, 1
mov ecx, 0x20
call fcn.10000a030
cmp rax, 0
jg 0x1000c6f55
jmp 0x1000c6f90
lea rax, [0x1001f79d8]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x48], rax
lea rax, [0x1001f79d8]
mov qword [rbp - 0x40], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 8]
mov r9d, 0
mov r8, 2
call fcn.100009280
nop dword [rax]
mov r8, qword [rbp - 8]
test r8, r8
je 0x1000c6f9d
mov r8, qword [r8 - 8]
mov rdx, qword [rbp - 8]
test rdx, rdx
jne 0x1000c6fad
lea rdx, [0x100294460]
lea rcx, [rbp - 0x68]
call fcn.100032750
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x28]
call fcn.10000ba60
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9, qword [rbp - 0x28]
test r9, r9
jne 0x1000c6fe4
lea r9, [0x100294460]
mov r8, qword [rbp - 0x20]
test r8, r8
jne 0x1000c6ff4
lea r8, [0x100294460]
lea rdx, str.open
mov rcx, 0
call sub.shell32.dll_ShellExecuteW
mov qword [rbp - 0x30], rax
jmp 0x1000c7082
mov r8, qword [rbp - 8]
test r8, r8
je 0x1000c701d
mov r8, qword [r8 - 8]
mov rdx, qword [rbp - 8]
test rdx, rdx
jne 0x1000c702d
lea rdx, [0x100294460]
lea rcx, [rbp - 0x68]
call fcn.100032750
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x28]
call fcn.10000ba60
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r8, qword [rbp - 0x28]
test r8, r8
jne 0x1000c7064
lea r8, [0x100294460]
mov r9, 0
mov rdx, 0
mov rcx, 0
call sub.shell32.dll_ShellExecuteW
mov qword [rbp - 0x30], rax
cmp qword [rbp - 0x30], 0x20
seta byte [rbp - 0x14]
nop
mov rcx, rbp
call fcn.1000c6d00
mov al, byte [rbp - 0x14]
mov rbx, qword [rbp - 0x78]
mov rsi, qword [rbp - 0x70]
lea rsp, [rbp]
pop rbp
ret