Function at 0x140001000
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x470
mov rsi, rdx
lea rdx, [rsp + 0x50]
xor bl, bl
mov ecx, 0x104
xor dil, dil
mov byte [rax + 0x18], bl
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [0x1400bb0a0]
mov rdx, rsi
call fcn.14000161c
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14000106c
lea r8, [0x140095492]
lea rdx, str.This_is_a_compiled_AutoIt_script._AV_researchers_please_email_avsupport_autoitscript.com_for_support.
mov r9d, reloc.WSOCK32.dll_recv
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1400012a0
mov eax, dword [0x1400bb0c8]
test eax, eax
jne 0x140001082
or dword [0x1400aa624], 0xffffffff
jmp 0x140001295
mov ebp, 1
lea rcx, [0x1400bcef0]
cmp eax, ebp
jne 0x1400010b4
mov r8, qword [0x1400bb0d0]
or r9d, 0xffffffff
mov edx, ebp
call fcn.14000aa18
mov r11b, byte [0x1400aa618]
mov byte [0x1400bcef3], r11b
jmp 0x140001125
mov r9b, byte [0x1400aa618]
lea rax, [rsp + 0x490]
lea r8, [0x1400bb0c8]
lea rdx, [0x1400bb0f0]
mov qword [rsp + 0x20], rax
call fcn.14000b2d8
test al, al
jne 0x1400010ea
mov dword [0x1400aa624], ebp
jmp 0x140001295
mov al, byte [0x1400bcef0]
mov dil, byte [0x1400bcef1]
lea r9, [0x1400bb0c0]
lea r8, [rsp + 0x260]
lea rcx, [0x1400bb0f0]
mov edx, 0x104
mov byte [0x1400bb0cc], al
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov bl, byte [rsp + 0x490]
mov r8d, dword [0x1400bb0c8]
lea rdx, [0x1400bb0f0]
lea rcx, [0x1400bb300]
call fcn.140025ad4
test eax, eax
je 0x140001165
lea rcx, [0x1400bcef0]
call fcn.14000ac70
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x1400aa624], ebp
jmp 0x1400012a0
cmp dil, bpl
jne 0x140001239
call fcn.140013468
test al, al
jne 0x140001239
lea rdx, [rsp + 0x260]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test bl, bl
je 0x140001208
lea rdx, [0x140095508]
lea rcx, [rsp + 0x30]
call fcn.140001d54
lea rdx, [0x1400bb0f0]
lea rcx, [rsp + 0x30]
call fcn.140001ef4
lea rdx, [0x140095508]
lea rcx, [rsp + 0x30]
call fcn.140001ef4
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r9, qword [rsp + 0x30]
mov rcx, rax
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x260]
lea rdx, str.runas
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x30]
call fcn.140001e50
jmp 0x140001289
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [rsp + 0x260]
lea rdx, str.runas
mov rcx, rax
lea rax, [rsp + 0x50]
mov r9, rsi
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x140001289
lea rcx, [0x1400bb0a0]
call fcn.1400012bc
lea rcx, [0x1400bb0a0]
call fcn.140001548
cmp byte [0x1400bb0cc], 0
jne 0x140001266
lea rcx, [0x1400bbb50]
call fcn.14000f1cc
lea rcx, [0x1400bb300]
mov edx, ebp
call fcn.140025da8
cmp byte [0x1400bb0cc], 0
jne 0x140001289
lea rcx, [0x1400bbb50]
call fcn.14000f60c
lea rcx, [0x1400bcef0]
call fcn.14000ac70
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret