Function at 0x1400935f0
Capabilities:
Create process on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
xor edi, edi
mov rsi, r9
mov rbx, r8
mov rbp, rdx
mov r14, rcx
test rdx, rdx
jne 0x14009361b
xor eax, eax
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
movzx eax, byte [rdx + 0x4c]
cmp eax, 0x10
ja case.default.0x140093646
mov qword [rsp + 0x70], r12
lea rdx, [0x140000000]
mov qword [rsp + 0x80], r15
mov ecx, dword [rdx + rax*4 + 0x938d4]
add rcx, rdx
jmp rcx
mov rcx, qword [rbp + 0x51]
add rcx, 0x24
cmp qword [rcx + 0x18], 8
jb 0x14009365a
mov rcx, qword [rcx]
mov ebp, 1
mov edx, ebp
call fcn.140084ca0
mov edi, ebp
inc dword [rbx]
xor r9d, r9d
movsxd r8, dword [rbx]
mov edx, 0x4cd
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_PostMessageW]
mov r8, qword [rsi]
mov edx, 0x4ce
jmp 0x1400938ac
mov rdx, qword [rbp + 0x51]
mov rcx, r14
call fcn.140092c80
mov edi, eax
jmp case.0x140093646.10
mov r15, qword [rbp + 0x51]
add r15, 0x24
cmp qword [r15 + 0x18], 8
jb 0x1400936b1
mov r15, qword [r15]
cmp dword [0x14045ebc8], edi
mov ebp, 1
jne 0x1400936c8
call fcn.14005e1b0
test eax, eax
cmovne edi, ebp
mov r8d, 3
mov edx, ebp
mov rcx, r15
call fcn.1400526c0
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400936ff
lea rdx, [0x140069b20]
mov r8, r15
mov r9, rsi
mov rcx, r12
call fcn.140052980
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140093666
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x140093666
mov r15, qword [rbp + 0x51]
add r15, 0x24
cmp qword [r15 + 0x18], 8
jb 0x140093724
mov r15, qword [r15]
cmp dword [0x14045ebc8], edi
mov ebp, 1
jne 0x14009373b
call fcn.14005e1b0
test eax, eax
cmovne edi, ebp
mov r8d, 3
mov edx, ebp
mov rcx, r15
call fcn.1400526c0
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400936ff
lea rdx, [0x1400bad90]
jmp 0x1400936e8
mov rcx, rsi
call fcn.1400a59e0
test eax, eax
je case.0x140093646.10
mov edi, 1
jmp 0x140093668
mov edx, 4
mov qword [rsp + 0x78], rdi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rdx, [rsp + 0x78]
call fcn.1400a5b60
mov ebp, eax
test eax, eax
js 0x1400937c2
mov r15, qword [rsp + 0x78]
test r15, r15
je 0x1400937c2
call fcn.1400a5c80
mov ebp, eax
test eax, eax
js 0x1400937c2
lea rcx, [0x14045dcf8]
call fcn.140278e0c
test rsi, rsi
je 0x1400937c2
add qword [rsi], r15
call qword [sym.imp.ole32.dll_CoUninitialize]
not ebp
test ebp, ebp
jns case.0x140093646.10
inc dword [rbx]
mov edi, 1
mov r8, qword [rsi]
mov edx, 0x4ce
jmp 0x1400938ac
call fcn.1400a6350
test eax, eax
je case.0x140093646.10
mov rax, qword [rbp + 0x51]
mov edi, 1
mov rcx, qword [rax + 0x44]
add qword [rsi], rcx
jmp 0x140093668
call fcn.1400a6120
mov rax, qword [rbp + 0x51]
xor r9d, r9d
mov edx, 0x4cd
mov rcx, qword [rax + 0x44]
add qword [rsi], rcx
inc dword [rbx]
movsxd r8, dword [rbx]
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_PostMessageW]
mov r8, qword [rsi]
xor r9d, r9d
mov rcx, qword [r14 + 8]
mov edx, 0x4ce
call qword [sym.imp.USER32.dll_PostMessageW]
xor edx, edx
lea rcx, str.powercfg__h_off
call qword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1400937f3
call fcn.1400ace90
test eax, eax
je case.0x140093646.10
jmp 0x1400938a2
mov ebp, 1
mov dword [r14 + 0xb28], ebp
inc dword [r8]
movsxd r8, dword [r8]
jmp 0x1400938a7
mov rcx, rbp
call fcn.140092f80
jmp 0x1400937eb
mov rcx, rbp
call fcn.1400930e0
jmp 0x1400937eb
mov rcx, rbp
call fcn.1400933d0
jmp 0x1400938a0
mov rcx, rbp
call fcn.140093250
mov edi, eax
inc dword [rbx]
movsxd r8, dword [rbx]
mov edx, 0x4cd
mov rcx, qword [r14 + 8]
xor r9d, r9d
call qword [sym.imp.USER32.dll_PostMessageW]
mov r12, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
mov eax, edi
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret