Function at 0x140002af0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r13
push r14
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rbx, rcx
mov rsi, r9
mov r12d, r8d
mov r13, rdx
lea rcx, [rbp - 0x20]
xor r14d, r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov edi, 1
mov dword [rsp + 0x20], r14d
call qword [sym.imp.USER32.dll_PeekMessageA]
lea edx, [rdi + 5]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rax, str.runas
lea r8, str.E:_tbox5THypervBox_srcTBoxMain_src_helper_appsTBoxExtPackHelperApp.cpp
lea rdx, [rsp + 0x58]
mov rcx, rbx
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x40
mov qword [rsp + 0x48], r14
call qword [sym.imp.TBoxRT.dll_RTStrToUtf16Tag]
test eax, eax
js 0x140002dcb
lea eax, [r12 + 1]
xor r8d, r8d
movsxd rcx, eax
lea rdx, [r13 + rcx*8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.TBoxRT.dll_RTGetOptArgvToString]
test eax, eax
js 0x140002dbe
mov rcx, qword [rsp + 0x38]
lea r8, str.E:_tbox5THypervBox_srcTBoxMain_src_helper_appsTBoxExtPackHelperApp.cpp
lea rdx, [rsp + 0x60]
call qword [sym.imp.TBoxRT.dll_RTStrToUtf16Tag]
test eax, eax
js 0x140002db3
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x70], 3
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], r14
mov dword [rbp - 0x68], r14d
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], 0xffffffffffffffff
test rsi, rsi
je 0x140002c4c
lea rdx, str.hwnd
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_strstr]
test rax, rax
je 0x140002c43
lea rcx, [rax + 5]
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.TBoxRT.dll_RTStrToUInt64Ex]
test eax, eax
js 0x140002c43
mov rcx, qword [rsp + 0x30]
mov edx, edi
mov qword [rsp + 0x48], rcx
call qword [sym.imp.USER32.dll_MonitorFromWindow]
mov qword [rbp - 0x60], rax
jmp 0x140002c47
mov rax, qword [rbp - 0x60]
test rax, rax
jne 0x140002c65
mov edx, edi
mov rcx, r14
mov qword [rsp + 0x30], r14
call qword [sym.imp.USER32.dll_MonitorFromPoint]
mov qword [rbp - 0x60], rax
test rax, rax
je 0x140002c6d
or dword [rsp + 0x44], 0x200000
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140002d88
cmp qword [rbp - 0x58], 0xffffffffffffffff
je 0x140002d79
lea rdx, [rbp - 0x58]
mov r9d, 0x1388
xor r8d, r8d
mov ecx, edi
mov dword [rsp + 0x20], 0x4bf
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov ebx, eax
test eax, eax
je 0x140002d4e
cmp ebx, 0x102
je 0x140002cbe
cmp ebx, edi
jne 0x140002d33
lea rcx, [rbp - 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140002d0e
nop dword [rax + rax]
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rbp - 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140002ce0
lea rdx, [rbp - 0x58]
mov r9d, 0x1388
xor r8d, r8d
mov ecx, edi
mov dword [rsp + 0x20], 0x4bf
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov ebx, eax
test eax, eax
jne 0x140002cb2
jmp 0x140002d4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.MsgWaitForMultipleObjects_returned:__x___d___err_u
mov r8d, ebx
mov r9d, eax
mov edx, ebx
call qword [sym.imp.TBoxRT.dll_RTMsgError]
mov rcx, qword [rbp - 0x58]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140002d6d
mov eax, dword [rsp + 0x30]
cmp eax, 0x80
cmovb edi, eax
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002da8
lea rcx, str.ShellExecuteExW_return_INVALID_HANDLE_VALUE_as_Info.hProcess
call qword [sym.imp.TBoxRT.dll_RTMsgError]
jmp 0x140002da8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ShellExecuteExW_failed:__u___x_
mov edx, eax
mov r8d, ebx
call qword [sym.imp.TBoxRT.dll_RTMsgError]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.TBoxRT.dll_RTUtf16Free]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.TBoxRT.dll_RTStrFree]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.TBoxRT.dll_RTUtf16Free]
jmp 0x140002dda
lea rcx, str.RTStrToUtf16_failed:__Rc
mov edx, eax
call qword [sym.imp.TBoxRT.dll_RTMsgError]
lea r11, [rsp + 0x110]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret