Function at 0x140002d0c
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov rsi, rcx
xor r12d, r12d
lea rcx, [rbp - 0x69]
mov ebx, r12d
mov r15b, dl
call fcn.140006158
or r13, 0xffffffffffffffff
test al, al
je 0x140002de6
mov rdi, qword [rbp - 0x61]
test rdi, rdi
je 0x140002de6
cmp byte [rbp - 0x59], r12b
jne 0x140002de6
lea rdx, [rbp + 0x77]
mov dword [rbp + 0x77], r12d
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [rbp + 0x77]
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov rax, r13
mov qword [rbp - 0x69], 0x9753
inc rax
cmp word [rsi + rax*2], r12w
jne 0x140002d85
lea eax, [rax*2 + 2]
mov qword [rbp - 0x59], rsi
xor r8d, r8d
mov dword [rbp - 0x61], eax
lea rax, [rbp + 0x7f]
mov qword [rbp + 0x7f], r12
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x69]
mov dword [rsp + 0x28], 0x2710
mov rcx, rdi
lea edx, [r8 + 0x4a]
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov rbx, rax
test eax, eax
je 0x140002de6
mov rcx, qword [rbp + 0x7f]
neg rcx
sbb edx, edx
and ebx, edx
jne 0x140002fc3
mov r14b, r12b
call fcn.140001e70
test al, al
jne 0x140002e1e
lea rdx, str._sidenote
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140002e1e
mov dl, 1
mov ecx, 0x420b
call fcn.140002c64
test al, al
je 0x140002fe8
mov r14b, 1
cmp word [0x140010b80], r12w
lea rax, [0x140010b80]
jne 0x140002eb4
xor r8d, r8d
lea rcx, str.msi.dll
call fcn.140001b90
mov rdi, rax
test rax, rax
jne 0x140002e55
mov dword [0], 1
lea rdx, str.MsiProvideQualifiedComponentW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 0x77]
mov dword [rbp + 0x77], 0x104
mov qword [rsp + 0x20], rcx
lea r9, [0x140010b80]
lea rcx, [0x14000c530]
mov r8d, 0xfffffffe
lea rdx, str.onenote.exe
call qword [0x14000b538]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp word [0x140010b80], r12w
je 0x140002fc3
lea rax, [0x140010b80]
mov rcx, r13
inc rcx
cmp word [rsi + rcx*2], r12w
jne 0x140002eb7
mov rdx, r13
inc rdx
cmp word [rax + rdx*2], r12w
jne 0x140002ec4
lea rbx, [rdx + 4]
mov eax, 2
add rbx, rcx
mul rbx
cmovo rax, r13
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140002fec
lea rax, [0x14000babc]
test r14b, r14b
lea r8, str.__s___s
mov rdx, rbx
cmovne rsi, rax
mov rcx, rdi
mov qword [rsp + 0x20], rsi
lea rsi, [0x140010b80]
mov r9, rsi
call fcn.140001248
xor eax, eax
mov dword [rbp - 0x49], 0x68
xorps xmm0, xmm0
mov qword [rbp - 0x59], rax
xor edx, edx
lea rcx, [rbp - 0x41]
movups xmmword [rbp - 0x69], xmm0
lea r8d, [rax + 0x60]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp - 0x69]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp - 0x49]
mov rdx, rdi
mov qword [rsp + 0x40], rax
mov rcx, rsi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
test eax, eax
je 0x140002fba
mov ecx, dword [rbp - 0x59]
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
test r15b, r15b
je 0x140002fa6
mov rcx, qword [rbp - 0x69]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.14000270c
test ebx, ebx
setne al
mov rbx, qword [rsp + 0x120]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor al, al
jmp 0x140002fcd
call fcn.1400063c8
int3