Function at 0x14010f940
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, rcx
test r9d, r9d
jne 0x14010fa30
lea rax, [rbp - 0x40]
mov qword [rbp - 0x38], rax
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_UPDATE_DOWNLOAD_FAILED
call fcn.140048480
mov rbx, rax
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x14010fcbf
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbp - 0x40], rax
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.140018bb0
test al, al
jne 0x14010f9fd
test rbx, rbx
jne 0x14010f9d9
xor r14d, r14d
jmp 0x14010f9ed
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rbx + rdi*2], 0
jne 0x14010f9e0
mov r14d, edi
mov r8d, r14d
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.140018f50
nop
call fcn.14012bfe0
lea rcx, [0x1402670d8]
lea r8, [0x1402670e0]
cmp dword [rax + 0x88], 0
cmovne r8, rcx
xor r9d, r9d
lea rdx, [rbp - 0x40]
mov rcx, qword [r15 + 8]
call fcn.140061b80
jmp 0x14010fc8d
xor r14d, r14d
mov qword [rbp - 0x20], r14
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x14010fcca
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbp - 0x20], rax
mov dword [0x14030c210], 1
lea rdx, [rbp - 0x20]
mov rcx, qword [r15 + 0xb0]
call fcn.14002ed00
mov rbx, qword [rbp - 0x20]
test eax, eax
je 0x14010fbb5
cmp dword [rbx - 0x10], r14d
jl 0x14010fbb5
lea rdx, str.CNBandisoft
mov rcx, rbx
call fcn.1401f92c8
test rax, rax
je 0x14010fbb5
sub rax, rbx
sar rax, 1
test eax, eax
js 0x14010fbb5
lea rax, [rbp - 0x38]
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x40]
mov qword [rbp - 0x28], rax
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_UPDATE_DOWNLOAD_COMPLETED
call fcn.140048480
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.1400190e0
mov r12, rax
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x14010fcd5
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbp - 0x40], rax
lea rsi, [0x140298920]
mov rdx, rsi
lea rcx, [rbp - 0x40]
call fcn.140018bb0
lea rdi, [r14 - 1]
test al, al
jne 0x14010fb49
mov r8, rdi
inc r8
cmp word [rsi + r8*2], 0
jne 0x14010fb31
mov rdx, rsi
lea rcx, [rbp - 0x40]
call fcn.140018f50
nop
mov r8, r12
lea rdx, [rbp - 0x40]
mov rcx, qword [r15 + 0xa8]
call fcn.1400cce40
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
lea r9, str._nolaunch
mov r8, qword [r15 + 0xb0]
lea rdx, [0x14026ad70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov dword [0x14030c210], r14d
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14010fc8d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
jmp 0x14010fc8d
mov dword [0x14030c210], r14d
lea rdx, [rbx - 0x18]
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14010fbe3
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
lea rax, [rbp - 0x38]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rbp - 0x30], rax
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_UPDATE_DOWNLOAD_FAILED
call fcn.140048480
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.1400190e0
mov rbx, rax
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x14010fcb4
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbp - 0x40], rax
lea rsi, [0x140298920]
mov rdx, rsi
lea rcx, [rbp - 0x40]
call fcn.140018bb0
test al, al
jne 0x14010fc7a
nop word [rax + rax]
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x14010fc60
mov r8d, edi
mov rdx, rsi
lea rcx, [rbp - 0x40]
call fcn.140018f50
nop
mov r8, rbx
lea rdx, [rbp - 0x40]
mov rcx, qword [r15 + 0xa8]
call fcn.1400cce40
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1401f74b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
int3
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
int3