Function at 0x14009bca0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov qword [rbp - 0x59], 0xfffffffffffffffe
mov rdi, rcx
cmp dword [rcx + 0x9c], 0
jne 0x14009bcd2
xor eax, eax
jmp 0x14009bf30
and dword [rcx + 0x9c], 0
lea rdx, str.Restarting_the_application...
lea rcx, [rbp - 0x61]
call fcn.14006874c
lea r14, [rdi + 0x5d8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, r14
call fcn.14006caa0
mov ebx, 0x68
mov r8d, ebx
xor edx, edx
lea rcx, [rbp - 0x49]
call sub.MSVCR120.dll_memset
mov dword [rbp - 0x49], ebx
xor edx, edx
lea r8d, [rbx - 0x50]
lea rcx, [rsp + 0x50]
call sub.MSVCR120.dll_memset
mov rax, qword [0x140108018]
mov qword [rbp + 0x67], rax
lea r15, [rdi + 0xa0]
mov rax, qword [r15]
or r13d, 0xffffffff
lea rsi, [rdi + 8]
mov edx, dword [rdi + 0x5c4]
mov rcx, rsi
cmp dword [rax - 8], 0
jne 0x14009bd9e
call fcn.140077180
mov rcx, rax
lea rdx, [rbp + 0x6f]
call fcn.140076ccc
nop
mov r8, qword [rax]
lea rdx, [0x1400cc4e8]
lea rcx, [rbp + 0x67]
call fcn.140069514
nop
mov rcx, qword [rbp + 0x6f]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140108010]
je 0x14009bdff
mov eax, r13d
lock xadd dword [rcx], eax
add eax, r13d
test eax, eax
jg 0x14009bdff
mov rcx, qword [rbp + 0x6f]
jmp 0x14009bdf6
call fcn.140077180
mov rcx, rax
lea rdx, [rbp + 0x77]
call fcn.140076ccc
mov rbx, rax
xor edx, edx
mov rcx, r15
call fcn.140069bfc
mov r9, rax
mov r8, qword [rbx]
lea rdx, str.__s___s
lea rcx, [rbp + 0x67]
call fcn.140069514
nop
mov rdx, qword [rbp + 0x77]
add rdx, 0xfffffffffffffff4
cmp rdx, qword [0x140108010]
je 0x14009bdff
mov eax, r13d
lock xadd dword [rdx], eax
add eax, r13d
test eax, eax
jg 0x14009bdff
mov rcx, qword [rbp + 0x77]
add rcx, 0xfffffffffffffff4
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov edx, dword [rdi + 0x5c4]
mov rcx, rsi
call fcn.140077180
mov rcx, rax
lea rdx, [rbp + 0x7f]
call fcn.140076ccc
nop
mov rbx, qword [rax]
xor edx, edx
lea rcx, [rbp + 0x67]
call fcn.140069bfc
mov rdx, rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
mov rdx, qword [rbp + 0x7f]
add rdx, 0xfffffffffffffff4
cmp rdx, qword [0x140108010]
je 0x14009be91
mov ecx, r13d
lock xadd dword [rdx], ecx
add ecx, r13d
test ecx, ecx
jg 0x14009be91
mov rcx, qword [rbp + 0x7f]
add rcx, 0xfffffffffffffff4
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14009bea7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14009bebd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsp + 0x58], 0
test ebx, ebx
jne 0x14009bee4
lea rdx, str.Error_restarting_the_application_
lea rcx, [rbp - 0x71]
call fcn.14006874c
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, r14
call fcn.14006caa0
jmp 0x14009bf0a
lea rdx, str.Application_restarted_OK.
lea rcx, [rbp - 0x69]
call fcn.14006874c
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, r14
call fcn.14006caa0
mov ebx, 1
mov rcx, qword [rbp + 0x67]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140108010]
je 0x14009bf2e
mov edx, r13d
lock xadd dword [rcx], edx
add edx, r13d
test edx, edx
jg 0x14009bf2e
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov eax, ebx
add rsp, 0x100
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret