Function at 0x1400e2890
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0xa0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rbp, rdx
mov r12, rcx
mov rdx, qword [rdx]
xor eax, eax
lea rdi, [0x140275388]
mov rsi, rdx
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x1400e28cf
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
jne 0x1400e28fc
add rdx, 0xffffffffffffffe8
or rsi, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x1400e28f5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x1400e2b2b
call fcn.1401ff164
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x1400e291b
mov ecx, 0x80004005
call fcn.140002bc0
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xe0], rax
lea rdx, [0x1402752ec]
or rsi, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x1400e2965
movzx edi, dx
mov ecx, edi
call fcn.140200fbc
test rax, rax
je 0x1400e2985
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xe0]
call fcn.1401bacf0
jmp 0x1400e2985
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0xe0]
call fcn.14000b770
nop
mov rdi, qword [rbp]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x1400e29ad
cmp rax, qword [rdi - 0x18]
jne 0x1400e29ad
lea rbx, [rdi - 0x18]
lock add dword [rdi - 8], 1
jmp 0x1400e29eb
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x1400e29c9
call fcn.1400e7510
int3
mov eax, dword [rdi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rdi - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rbx + 0x18]
call fcn.14022ba40
lea rax, [rbx + 0x18]
mov qword [rsp + 0xe8], rax
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x20]
call fcn.140040740
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0xe0]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x1400e2a72
cmp dword [rdi + 0x10], 0
jl 0x1400e2a60
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400e2a60
call fcn.140002dd0
mov rbx, rax
mov eax, esi
lock xadd dword [rdi + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400e2a52
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0xe0], rax
jmp 0x1400e2a72
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0xe0]
call fcn.14000b770
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400e2a92
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0x34]
call fcn.14022ec70
mov dword [rsp + 0x30], 0x70
test r12, r12
jne 0x1400e2ab6
mov qword [rsp + 0x38], r12
jmp 0x1400e2ac0
mov rax, qword [r12 + 0x40]
mov qword [rsp + 0x38], rax
lea rax, str.open
mov qword [rsp + 0x40], rax
mov rdi, qword [rsp + 0xe0]
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x60], 1
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400e2b09
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x1400e2b26
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
add rsp, 0xa0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret