Function at 0x14008ccd0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x38]
sub rsp, 0x138
movzx r15d, dl
xor esi, esi
mov dword [rsp + 0x50], esi
xor edx, edx
lea rcx, str.PROCEXPL
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
lea r14d, [rsi - 1]
test rax, rax
jne 0x14008d19a
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x14008d34c
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x98], rbx
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x200
or eax, ecx
jge 0x14008cd68
mov edx, 0x200
lea rcx, [rbp + 0x98]
call fcn.140006870
mov rbx, qword [rbp + 0x98]
cmp dword [rbx - 0xc], 0x200
jl 0x14008d357
mov dword [rbx - 0x10], 0x200
mov word [rbx + 0x400], si
mov r8d, 0x200
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14008cda0
xor dil, dil
jmp 0x14008d0cf
mov edx, 0x5c
mov rcx, rbx
call fcn.14009eee8
mov rdi, rax
test rax, rax
jne 0x14008cdba
mov edi, r14d
jmp 0x14008cdc0
sub rdi, rbx
sar rdi, 1
lea rdx, str.procexp
lea rcx, [rsp + 0x60]
call fcn.140006110
nop
test r15b, r15b
jne 0x14008ce03
call fcn.14002dbb0
test al, al
je 0x14008cde9
lea rdx, [0x1400d9f10]
jmp 0x14008cdf9
call fcn.14002db50
test al, al
je 0x14008ce03
lea rdx, [0x1400d9f18]
lea rcx, [rsp + 0x60]
call fcn.140012e60
lea rdx, [0x1400f0090]
lea rcx, [rsp + 0x60]
call fcn.140012e60
mov r8d, edi
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x98]
call fcn.140012c30
mov r15, rax
mov rcx, qword [rax]
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x14008ce44
mov rdx, qword [rcx]
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
jne 0x14008ce5e
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x14008d362
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x50], 2
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x78], rax
mov eax, dword [rax - 0x10]
mov dword [rbp + 0x90], eax
mov r13, qword [r15]
movsxd r12, dword [r13 - 0x10]
lea r15d, [rax + r12]
test r15d, r15d
js 0x14008d341
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r15d
or eax, ecx
jge 0x14008cec0
mov edx, r15d
lea rcx, [rsp + 0x70]
call fcn.140006870
mov rdi, qword [rsp + 0x70]
add r12, r12
je 0x14008cef6
test rdi, rdi
je 0x14008cee6
mov r8, r12
mov rcx, rdi
test r13, r13
je 0x14008cedf
mov rdx, r13
call fcn.14009d3c0
jmp 0x14008cef6
xor edx, edx
call fcn.14009e880
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
movsxd r8, dword [rbp + 0x90]
add r8, r8
lea rcx, [r12 + rdi]
je 0x14008cf31
test rcx, rcx
je 0x14008cf21
mov rdx, qword [rsp + 0x78]
test rdx, rdx
je 0x14008cf1c
call fcn.14009d3c0
jmp 0x14008cf31
call fcn.14009e880
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
cmp r15d, dword [rdi - 0xc]
jg 0x14008d341
mov dword [rdi - 0x10], r15d
movsxd rax, r15d
mov word [rdi + rax*2], si
lea r15, [rdi - 0x18]
add rbx, 0xffffffffffffffe8
cmp r15, rbx
je 0x14008cfa6
cmp dword [rbx + 0x10], 0
jl 0x14008cf93
mov rax, qword [rbx]
cmp qword [r15], rax
jne 0x14008cf93
mov rcx, r15
call fcn.140006780
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14008cf86
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rVariantCopy + 8]
lea rax, [rdi + 0x18]
mov qword [rbp + 0x98], rax
jmp 0x14008cfa6
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
lea rcx, [rbp + 0x98]
call fcn.1400068f0
mov eax, 2
and eax, 0xfffffffd
mov dword [rsp + 0x50], eax
mov eax, r14d
lock xadd dword [r15 + 0x10], eax
sub eax, 1
jg 0x14008cfcd
mov rcx, qword [r15]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008cfeb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov dword [rbp - 0x40], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
mov dword [rbp - 4], 1
mov eax, 5
mov word [rbp], ax
mov rdx, qword [rbp + 0x98]
cmp dword [rdx - 8], 1
jle 0x14008d040
mov edx, dword [rdx - 0x10]
lea rcx, [rbp + 0x98]
call fcn.140006a80
mov rdx, qword [rbp + 0x98]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne bl
test eax, eax
jne 0x14008d0a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14008d0a2
cmp byte [rbp + 0x88], 0
jne 0x14008d0a2
mov dl, 1
mov rcx, qword [rbp + 0x80]
call fcn.14008ccd0
movzx edi, al
jmp 0x14008d0a9
test bl, bl
jne 0x14008d0f1
xor dil, dil
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008d0c8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rbp + 0x98]
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x14008d0e8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
movzx eax, dil
jmp 0x14008d32d
mov edx, 0x3e8
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax]
nop dword [rax + rax]
xor edx, edx
lea rcx, str.PROCEXPL
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
test rax, rax
jne 0x14008d149
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 5
jl 0x14008d120
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008d169
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008d18a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
test rbx, rbx
jne 0x14008d196
xor al, al
jmp 0x14008d32d
mov esi, dword [rsp + 0x50]
mov rdx, qword [rbp + 0x80]
add rdx, 0x60
cmp qword [rdx + 0x18], 8
jb 0x14008d1af
mov rdx, qword [rdx]
lea rcx, [rsp + 0x58]
call fcn.140006110
nop
mov edx, 0x5c
mov rcx, qword [rsp + 0x58]
call fcn.14009eee8
test rax, rax
je 0x14008d298
sub rax, qword [rsp + 0x58]
sar rax, 1
test eax, eax
js 0x14008d298
lea r8d, [rax + 1]
mov rax, qword [rsp + 0x58]
mov r9d, dword [rax - 0x10]
sub r9d, r8d
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x58]
call fcn.14000a580
or esi, 1
mov dword [rsp + 0x50], esi
mov rdx, qword [rbp + 0x90]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x58]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14008d270
cmp dword [rdi + 0x10], 0
jl 0x14008d262
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14008d262
call fcn.140006780
mov rsi, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x14008d253
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rVariantCopy + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x58], rax
mov esi, dword [rsp + 0x50]
jmp 0x14008d270
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.1400068f0
and esi, 0xfffffffe
mov dword [rsp + 0x50], esi
mov rdx, qword [rbp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008d298
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x68]
call fcn.140022aa0
nop
mov rax, qword [rsp + 0x68]
cmp dword [rax - 8], 1
jle 0x14008d2c5
mov edx, dword [rax - 0x10]
lea rcx, [rsp + 0x68]
call fcn.140023010
mov rax, qword [rsp + 0x68]
mov qword [rbp - 0x50], rax
mov ecx, dword [rax - 0x10]
inc ecx
mov dword [rbp - 0x58], ecx
lea r9, [rbp - 0x60]
xor r8d, r8d
lea edx, [r8 + 0x4a]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
setne bl
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008d30b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x14008d32a
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rVariantCopy + 8]
movzx eax, bl
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80070057
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80070057
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
int3