Function at 0x14001eda0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x320
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140194020]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov r13, rdx
mov qword [rsp + 0x60], rdx
xor ebx, ebx
mov dword [rsp + 0x90], ebx
mov rdi, qword [0x1401a4d48]
lea rsi, [rdi + 0x30]
cmp rsi, rdx
je 0x14001ee0e
cmp qword [rdx + 0x18], 0x10
jb 0x14001ee01
mov rdx, qword [rdx]
mov r8, qword [r13 + 0x10]
mov rcx, rsi
call fcn.140004c30
nop
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
mov r14d, 1
mov dword [rsp + 0x90], r14d
lea r15, [rsi + 0x10]
mov rdx, qword [r15]
add rdx, 0x19
cmp rdx, 0x10
jb 0x14001ee4f
lea rcx, [rsp + 0x30]
call fcn.140022ee0
mov qword [rsp + 0x40], rbx
mov r8d, Ordinal_27
lea rdx, str.__AC___RECEIVED_FROM_AC:
lea rcx, [rsp + 0x30]
call fcn.140004d90
cmp qword [rsi + 0x18], 0x10
jb 0x14001ee70
mov rsi, qword [rsi]
mov r8, qword [r15]
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140004d90
lea r15, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae r15, qword [rsp + 0x30]
mov rsi, qword [0x1401a4e50]
test rsi, rsi
jne 0x14001eec8
lea ecx, [rsi + 4]
call fcn.1400ace1c
mov rsi, rax
mov qword [rsp + 0x98], rax
call fcn.14002cc80
mov dword [rsi], eax
test eax, eax
je 0x14001eec1
call fcn.14002cd70
nop
mov qword [0x1401a4e50], rsi
xor r8d, r8d
mov rdx, r15
mov rcx, rsi
call fcn.14002d1d0
nop
lea rcx, [rsp + 0x30]
call fcn.140004bd0
mov rcx, rdi
call fcn.140018e70
test al, al
jne 0x14001eefa
mov rcx, r13
call fcn.140004bd0
jmp 0x14001f8a3
lea rcx, [rdi + 0x50]
mov r12, qword [rdi + 0x68]
cmp r12, 0x10
jb 0x14001ef0c
mov rcx, qword [rdi + 0x50]
mov r15, qword [rdi + 0x60]
cmp r15, 0x26
jne 0x14001f0a1
mov r8, r15
lea rdx, str.4DC2157A_9687_45EB_982E_E5328E617509
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f0a1
lea rcx, [rdi + 0x70]
mov r14, qword [rdi + 0x88]
cmp r14, 0x10
jb 0x14001ef46
mov rcx, qword [rdi + 0x70]
mov rsi, qword [rdi + 0x80]
cmp rsi, 0x14
jne 0x14001ef73
mov r8, rsi
lea rdx, str.GetDeviceProfileList
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001ef73
mov rcx, rdi
call fcn.1400195a0
jmp 0x14001f87c
lea rcx, [rdi + 0x70]
cmp r14, 0x10
jb 0x14001ef81
mov rcx, qword [rdi + 0x70]
cmp rsi, 0x10
jne 0x14001efa7
mov r8, rsi
lea rdx, str.GetDeviceProfile
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001efa7
mov rcx, rdi
call fcn.1400195a0
jmp 0x14001f87c
lea rcx, [rdi + 0x70]
cmp r14, 0x10
jb 0x14001efb5
mov rcx, qword [rdi + 0x70]
cmp rsi, 0x10
jne 0x14001efdb
mov r8, rsi
lea rdx, str.SetDeviceProfile
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001efdb
mov rcx, rdi
call fcn.140019e20
jmp 0x14001f87c
lea rcx, [rdi + 0x70]
cmp r14, 0x10
jb 0x14001efe9
mov rcx, qword [rdi + 0x70]
cmp rsi, 0x19
jne 0x14001f00f
mov r8, rsi
lea rdx, str.GetRelScenarioProfileList
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f00f
mov rcx, rdi
call fcn.14001a7a0
jmp 0x14001f87c
lea rcx, [rdi + 0x70]
cmp r14, 0x10
jb 0x14001f01d
mov rcx, qword [rdi + 0x70]
cmp rsi, 0x13
jne 0x14001f03a
mov r8, rsi
lea rdx, str.UpdateDeviceProfile
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001f87c
lea rcx, [rdi + 0x70]
cmp r14, 0x10
jb 0x14001f048
mov rcx, qword [rdi + 0x70]
cmp rsi, 0x13
jne 0x14001f065
mov r8, rsi
lea rdx, str.DeviceProfileChange
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001f87c
lea rcx, [rdi + 0x70]
cmp r14, 0x10
jb 0x14001f073
mov rcx, qword [rdi + 0x70]
cmp rsi, 0x14
jne 0x14001f87e
mov r8, rsi
lea rdx, str.GetDeviceDescription
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f87e
mov rcx, rdi
call fcn.14001dff0
jmp 0x14001f87c
lea rcx, [rdi + 0x50]
cmp r12, 0x10
jb 0x14001f0af
mov rcx, qword [rdi + 0x50]
cmp r15, 0x26
jne 0x14001f1b6
mov r8, r15
lea rdx, str.e43c9c38_7dbd_4f80_82e9_b71b5c9f762e
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f1b6
lea rcx, [rdi + 0x70]
mov rsi, qword [rdi + 0x88]
cmp rsi, 0x10
jb 0x14001f0e5
mov rcx, qword [rdi + 0x70]
mov r14, qword [rdi + 0x80]
cmp r14, 0xc
jne 0x14001f112
mov r8, r14
lea rdx, str.GetMacroList
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f112
mov rcx, rdi
call fcn.14001add0
jmp 0x14001f87c
lea rcx, [rdi + 0x70]
cmp rsi, 0x10
jb 0x14001f120
mov rcx, qword [rdi + 0x70]
cmp r14, 0xb
jne 0x14001f146
mov r8, r14
lea rdx, str.MacroRename
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f146
mov rcx, rdi
call fcn.14001b8e0
jmp 0x14001f87c
lea rcx, [rdi + 0x70]
cmp rsi, 0x10
jb 0x14001f154
mov rcx, qword [rdi + 0x70]
cmp r14, 0xb
jne 0x14001f17a
mov r8, r14
lea rdx, str.MacroDelete
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f17a
mov rcx, rdi
call fcn.14001b8e0
jmp 0x14001f87c
lea rcx, [rdi + 0x70]
cmp rsi, 0x10
jb 0x14001f188
mov rcx, qword [rdi + 0x70]
cmp r14, 8
jne 0x14001f87e
mov r8, r14
lea rdx, str.MacroNew
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f87e
mov rcx, rdi
call fcn.14001b8e0
jmp 0x14001f87c
lea rcx, [rdi + 0x50]
cmp r12, 0x10
jb 0x14001f1c4
mov rcx, qword [rdi + 0x50]
cmp r15, 0x26
jne 0x14001f7db
mov r8, r15
lea rdx, str.4A47B00C_D8DA_4178_965B_F62CD40886B1
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f7db
lea rcx, [rdi + 0x70]
mov r12, qword [rdi + 0x88]
cmp r12, 0x10
jb 0x14001f1fa
mov rcx, qword [rdi + 0x70]
mov r15, qword [rdi + 0x80]
cmp r15, 0xa
jne 0x14001f227
mov r8, r15
lea rdx, str.UnAuraSync
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f227
mov rcx, rdi
call fcn.14001c160
jmp 0x14001f87c
lea rcx, [rdi + 0x70]
cmp r12, 0x10
jb 0x14001f235
mov rcx, qword [rdi + 0x70]
cmp r15, 0xe
jne 0x14001f25b
mov r8, r15
lea rdx, str.GetProductName
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f25b
mov rcx, rdi
call fcn.14001c5b0
jmp 0x14001f87c
lea rcx, [rdi + 0x70]
cmp r12, 0x10
jb 0x14001f269
mov rcx, qword [rdi + 0x70]
cmp r15, 8
jne 0x14001f28f
mov r8, r15
lea rdx, str.DeviceIn
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f28f
mov rcx, rdi
call fcn.14001cf70
jmp 0x14001f87c
lea rcx, [rdi + 0x70]
cmp r12, 0x10
jb 0x14001f29d
mov rcx, qword [rdi + 0x70]
cmp r15, 9
jne 0x14001f2c3
mov r8, r15
lea rdx, str.DeviceOut
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f2c3
mov rcx, rdi
call fcn.14001c160
jmp 0x14001f87c
lea rcx, [rdi + 0x70]
cmp r12, 0x10
jb 0x14001f2d1
mov rcx, qword [rdi + 0x70]
cmp r15, 0xd
jne 0x14001f2f7
mov r8, r15
lea rdx, str.Multilanguage
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f2f7
mov rcx, rdi
call fcn.14001d550
jmp 0x14001f87c
lea rcx, [rdi + 0x70]
cmp r12, 0x10
jb 0x14001f305
mov rcx, qword [rdi + 0x70]
cmp r15, 0x13
jne 0x14001f43f
mov r8, r15
lea rdx, str.DeviceProfileBackup
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f43f
lea ecx, [rax + 8]
call fcn.1400ace1c
mov rsi, rax
mov qword [rax], rdi
mov qword [rsp + 0x98], rax
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x68]
call fcn.14000a3e0
lea rax, vtable.std::_LaunchPad_class_std::unique_ptr_class_std::tuple_class__lambda_3efd8bd8c0f10f8377c7dde38dfda731____struct_std::default_delete_class_std::tuple_class__lambda_3efd8bd8c0f10f8377c7dde38dfda731_____.0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x88], rsi
lea r8, [rsp + 0x68]
lea rdx, [0x14000a500]
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll__Thrd_start]
cmp eax, 4
cmovne r14d, eax
test r14d, r14d
je 0x14001f3b0
mov ecx, r14d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
cmp byte [rsp + 0x80], 0
jne 0x14001f3d8
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Cnd_wait]
test eax, eax
je 0x14001f3b0
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
jmp 0x14001f3b0
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14001f3f0
mov edx, 8
call fcn.1400ace14
nop
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
test eax, eax
je 0x14001f40f
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll__Mtx_destroy]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Cnd_destroy]
nop
lea rcx, [rsp + 0x30]
call fcn.14000a530
nop
cmp dword [rsp + 0x38], 0
je 0x14001f87c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
lea rcx, [rdi + 0x70]
cmp r12, 0x10
jb 0x14001f44d
mov rcx, qword [rdi + 0x70]
cmp r15, 0x14
jne 0x14001f58f
mov r8, r15
lea rdx, str.DeviceProfileRestore
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f58f
lea ecx, [rax + 8]
call fcn.1400ace1c
mov rsi, rax
mov qword [rax], rdi
mov qword [rsp + 0x98], rax
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x68]
call fcn.14000a3e0
lea rax, vtable.std::_LaunchPad_class_std::unique_ptr_class_std::tuple_class__lambda_e1219a60eb6a87dbe6325f344c475b46____struct_std::default_delete_class_std::tuple_class__lambda_e1219a60eb6a87dbe6325f344c475b46_____.0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x88], rsi
lea r8, [rsp + 0x68]
lea rdx, [0x14000a500]
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll__Thrd_start]
cmp eax, 4
cmovne r14d, eax
test r14d, r14d
je 0x14001f500
mov ecx, r14d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop word [rax + rax]
cmp byte [rsp + 0x80], 0
jne 0x14001f528
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Cnd_wait]
test eax, eax
je 0x14001f500
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
jmp 0x14001f500
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14001f540
mov edx, 8
call fcn.1400ace14
nop
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
test eax, eax
je 0x14001f55f
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll__Mtx_destroy]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Cnd_destroy]
nop
lea rcx, [rsp + 0x30]
call fcn.14000a530
nop
cmp dword [rsp + 0x38], 0
je 0x14001f87c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
lea rcx, [rdi + 0x70]
cmp r12, 0x10
jb 0x14001f59d
mov rcx, qword [rdi + 0x70]
cmp r15, 8
jne 0x14001f5c3
mov r8, r15
lea rdx, str.SetTheme
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f5c3
mov rcx, rdi
call fcn.14001dd30
jmp 0x14001f87c
lea rcx, [rdi + 0x70]
cmp r12, 0x10
jb 0x14001f5d1
mov rcx, qword [rdi + 0x70]
cmp r15, 0x11
jne 0x14001f7a2
mov r8, r15
lea rdx, str.LaunchAuraCreator
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f7a2
lea edx, [rax + 2]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov edi, eax
test eax, eax
jns 0x14001f61c
mov edi, r14d
mov r8d, r14d
lea rdx, str.B9ECED6F.AURACreator_qmba6cd70vzyy_App
lea rcx, str.LaunchApp__s:_Failed_to_init_COM._hr__0x_08lx__n
call fcn.140017660
mov rcx, rbx
mov qword [rsp + 0x98], rbx
test edi, edi
js 0x14001f6c6
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea r9, [0x14013fcd8]
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [0x1401291b0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x14001f670
mov r8d, r14d
lea rdx, str.B9ECED6F.AURACreator_qmba6cd70vzyy_App
lea rcx, str.LaunchApp__s:_Failed_to_create_Application_Activation_Manager.hr__0x_08lx__n
call fcn.140017660
mov dword [rsp + 0x90], ebx
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx]
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.B9ECED6F.AURACreator_qmba6cd70vzyy_App
call qword [rax + Ordinal_26]
mov edi, eax
test eax, eax
jns 0x14001f6be
mov edi, r14d
mov r8d, r14d
lea rdx, str.B9ECED6F.AURACreator_qmba6cd70vzyy_App
lea rcx, str.LaunchApp__s:_Failed_to_Activate_App._hr__0x_08lx__n
call fcn.140017660
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x14001f6d1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp edi, 1
jne 0x14001f87c
movsd xmm0, qword [str.open]
movsd qword [rsp + 0x98], xmm0
movzx eax, word [0x140140988]
mov word [rsp + 0xa0], ax
movaps xmm0, xmmword [str.ms_windows_store:__pdp__ProductId9mwz3vlw5hbw]
movaps xmmword [rsp + 0xb0], xmm0
movaps xmm1, xmmword [0x1401409a0]
movaps xmmword [rsp + 0xc0], xmm1
movaps xmm0, xmmword [0x1401409b0]
movaps xmmword [rsp + 0xd0], xmm0
movaps xmm1, xmmword [0x1401409c0]
movaps xmmword [rsp + 0xe0], xmm1
movaps xmm0, xmmword [0x1401409d0]
movaps xmmword [rsp + 0xf0], xmm0
movsd xmm1, qword [0x1401409e0]
movsd qword [rsp + 0x100], xmm1
mov eax, dword [0x1401409e8]
mov dword [rsp + 0x108], eax
movzx eax, word [0x1401409ec]
mov word [rsp + 0x10c], ax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x98]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x14001f87c
lea rcx, [rdi + 0x70]
cmp r12, 0x10
jb 0x14001f7b0
mov rcx, qword [rdi + 0x70]
cmp r15, 0xe
jne 0x14001f87e
mov r8, r15
lea rdx, str.SoftwareUpdate
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f87e
call fcn.14000c040
jmp 0x14001f87c
lea rcx, [rdi + 0x50]
cmp r12, 0x10
jb 0x14001f7e9
mov rcx, qword [rdi + 0x50]
cmp r15, 0x26
jne 0x14001f83e
mov r8, r15
lea rdx, str.5AAA201A_9497_4C3F_BABB_7032DE94FB1C
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f83e
cmp qword [rdi + 0x88], 0x10
lea rcx, [rdi + 0x70]
jb 0x14001f814
mov rcx, qword [rdi + 0x70]
cmp qword [rdi + 0x80], 0xa
jne 0x14001f87e
mov r8d, 0xa
lea rdx, str.ReloadPage
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f87e
mov rcx, rdi
call fcn.14001d200
jmp 0x14001f87c
lea rcx, [rdi + 0x50]
cmp r12, 0x10
jb 0x14001f84c
mov rcx, qword [rdi + 0x50]
cmp r15, 0x26
jne 0x14001f865
mov r8, r15
lea rdx, str.5DEFE16A_AA49_4745_8BD8_D50BE0053A88
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001f802
lea rdx, [rdi + 0x50]
lea rcx, [rsp + 0x68]
call fcn.140004880
mov rdx, rax
call fcn.140019470
nop
jmp 0x14001f89b
lea rdx, [rdi + 0x70]
lea rcx, [rsp + 0x68]
call fcn.140004880
mov rdx, rax
call fcn.140019470
jmp 0x14001f87c
mov rcx, r13
call fcn.140004bd0
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.1400acdf0
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret