Function at 0x140026590
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov rax, qword [0x140055038]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r14b, r9b
mov ebx, r8d
mov rdi, rdx
mov r15, rcx
mov qword [rbp - 0x29], rdx
mov rcx, rdx
call fcn.140006934
xor r12d, r12d
test al, al
jne 0x1400268b3
call fcn.140001ae4
cmp rax, 0x10000
jae 0x1400268b3
lea esi, [r12 + 0x70]
mov r8d, esi
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14002b2c0
mov dword [rsp + 0x20], esi
mov eax, 0x1c0
mov ecx, 0x5c0
test r14b, r14b
cmovne eax, ecx
mov dword [rsp + 0x24], eax
xor edx, edx
mov rcx, rdi
call fcn.140002908
mov rcx, rdi
cmp word [rax], 0x22
jne 0x14002662b
lea edx, [rsi - 0x6f]
call fcn.140002908
mov qword [rsp + 0x38], rax
mov r8, r12
mov rcx, rdi
call fcn.140001ae4
test rax, rax
je 0x1400266dc
mov r10d, 0x20
mov rdx, r8
mov rcx, rdi
call fcn.140002908
cmp word [rax], 0x22
jne 0x14002669a
inc r8
mov rcx, rdi
call fcn.140001ae4
mov r9, rax
cmp r8, rax
jae 0x14002669a
mov rdx, r8
mov rcx, rdi
call fcn.140002908
cmp word [rax], 0x22
je 0x14002668e
inc r8
cmp r8, r9
jb 0x140026673
jmp 0x14002669a
mov rcx, rdi
call fcn.140002908
mov word [rax], r10w
mov rdx, r8
mov rcx, rdi
call fcn.140002908
lea r9, [r8 + 1]
cmp word [rax], r10w
je 0x1400268d9
mov rdx, r9
mov rcx, rdi
call fcn.140002908
cmp word [rax], 0x2f
je 0x1400268d9
mov r8, r9
mov rcx, rdi
call fcn.140001ae4
cmp r9, rax
jb 0x14002664f
mov rax, qword [rbp - 0x79]
test rax, rax
je 0x1400266eb
cmp word [rax], r12w
jne 0x140026709
test r14b, r14b
jne 0x140026709
lea rcx, [0x140057598]
call fcn.140006934
test al, al
jne 0x140026709
call fcn.14000128c
mov qword [rbp - 0x79], rax
mov dword [rbp - 0x69], ebx
mov rcx, qword [rsp + 0x38]
call fcn.1400134f0
mov rsi, rax
test rax, rax
je 0x140026741
lea rdx, str..inf
mov rcx, rax
call fcn.14001c5e8
lea rcx, [0x14004db58]
test eax, eax
cmovne rcx, qword [rsp + 0x30]
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x38]
lea rcx, [rbp - 0x21]
call fcn.1400020b4
nop
lea rcx, [rbp - 0x21]
call fcn.1400115c4
mov bl, al
lea rcx, [rbp - 0x21]
call fcn.140002254
lea rcx, [rbp - 1]
call fcn.1400026bc
nop
test bl, bl
je 0x1400267a6
mov rdx, qword [rsp + 0x38]
lea rcx, [rbp - 0x21]
call fcn.1400020b4
nop
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x21]
call fcn.140013cb8
nop
lea rcx, [rbp - 0x21]
call fcn.140002254
lea rcx, [rbp - 1]
call fcn.14000128c
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1400268a9
mov bl, r12b
cmp byte [0x140057540], r12b
jne 0x1400267d3
test r14b, r14b
jne 0x1400267d3
cmp byte [0x140057512], r12b
je 0x140026844
test r15, r15
je 0x1400267f2
mov rcx, r15
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400267f2
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
mov bl, 1
mov edx, 0x7d0
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rbp - 0x31]
call fcn.14002690c
cmp byte [0x140057512], r12b
je 0x140026844
test r14b, r14b
jne 0x140026844
lea rdx, [rbp - 0x29]
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140026844
mov eax, dword [0x14005751c]
cmp dword [rbp - 0x29], eax
cmova eax, dword [rbp - 0x29]
mov dword [0x14005751c], eax
mov byte [0x140057513], 1
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x140026866
lea rdx, str..exe
mov rcx, rsi
call fcn.14001c5e8
test eax, eax
je 0x140026891
cmp byte [0x140057540], r12b
je 0x140026891
test r14b, r14b
jne 0x140026891
mov eax, dword [0x14005d380]
mov r8d, 0x1b58
cmp byte [0x140057512], r12b
cmove eax, r8d
mov dword [0x14005d380], eax
test bl, bl
je 0x1400268a9
test r14b, r14b
je 0x1400268a9
mov edx, 1
mov rcx, r15
call qword [sym.imp.USER32.dll_ShowWindow]
nop
lea rcx, [rbp - 1]
call fcn.140002254
nop
mov rcx, rdi
call fcn.140002254
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140028a30
add rsp, 0xe0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rdx, r8
mov rcx, rdi
call fcn.140002908
cmp word [rax], r10w
jne 0x1400268f6
mov rcx, rdi
call fcn.140002908
mov word [rax], r12w
mov rdx, r9
mov rcx, rdi
call fcn.140002908
mov qword [rbp - 0x79], rax
jmp 0x1400266e0