Function at 0x1400121f0
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push rsi
sub rsp, 0x470
mov rsi, rdx
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [0x1400c5f20]
mov rdx, rsi
call fcn.1400021d0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14003b420
mov eax, dword [0x1400c5f48]
test eax, eax
je 0x14003b442
mov qword [rsp + 0x480], rbx
mov qword [rsp + 0x488], rdi
xor dil, dil
cmp eax, 1
je 0x14003b45d
movzx r9d, byte [0x1400b5498]
lea rax, [rsp + 0x490]
lea r8, [0x1400c5f48]
lea rdx, [0x1400c5f70]
lea rcx, [0x1400c7ef0]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x490], dil
call fcn.140015150
test al, al
je 0x14003b48e
movzx eax, byte [0x1400c7ef0]
movzx ebx, byte [0x1400c7ef1]
lea r9, [0x1400c5f40]
lea r8, [rsp + 0x260]
lea rcx, [0x1400c5f70]
mov edx, 0x104
mov byte [0x1400c5f4c], al
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
movzx edi, byte [rsp + 0x490]
mov r8d, dword [0x1400c5f48]
lea rdx, [0x1400c5f70]
lea rcx, [0x1400c6180]
call fcn.140001380
test eax, eax
jne 0x14003b49d
cmp bl, 1
je 0x14003b4c3
lea rcx, [0x1400c5f20]
call fcn.140015a40
lea rcx, [0x1400c5f20]
call fcn.140015960
cmp byte [0x1400c5f4c], 0
jne 0x140012327
lea rcx, [0x1400c6b70]
call fcn.1400129a0
lea rcx, [0x1400c6180]
mov edx, 1
call fcn.1400072e0
cmp byte [0x1400c5f4c], 0
jne 0x14001234d
lea rcx, [0x1400c6b70]
call fcn.140012ad0
lea rcx, [0x1400c7ef0]
call fcn.140013ca0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rbx, qword [rsp + 0x480]
mov rdi, qword [rsp + 0x488]
add rsp, 0x470
pop rsi
ret
lea r8, [0x14009b482]
lea rdx, str.This_is_a_compiled_AutoIt_script._AV_researchers_please_email_avsupport_autoitscript.com_for_support.
mov r9d, reloc.WSOCK32.dll_recv
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
jmp 0x140012374
lea rcx, [rsp + 0x50]
mov dword [0x1400b54a4], 0xffffffff
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
nop
jmp 0x140012374
mov r8, qword [0x1400c5f50]
or r9d, 0xffffffff
lea rcx, [0x1400c7ef0]
lea edx, [r9 + 2]
xor bl, bl
call fcn.140002810
movzx r11d, byte [0x1400b5498]
mov byte [0x1400c7ef3], r11b
jmp 0x1400122cf
mov dword [0x1400b54a4], 1
jmp 0x140012359
lea rcx, [0x1400c7ef0]
call fcn.140013ca0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x1400b54a4], 1
jmp 0x140012364
call fcn.1400402b0
test al, al
jne 0x1400122fa
lea rdx, [rsp + 0x260]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test dil, dil
je 0x14003b567
lea rdx, [0x14009b4f8]
lea rcx, [rsp + 0x30]
call fcn.140001d30
lea rdx, [0x1400c5f70]
lea rcx, [rsp + 0x30]
call fcn.140011830
lea rdx, [0x14009b4f8]
lea rcx, [rsp + 0x30]
call fcn.140011830
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r9, qword [rsp + 0x30]
mov rcx, rax
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x260]
lea rdx, str.runas
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x30]
call fcn.140002610
nop
jmp 0x14001234d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea r8, [rsp + 0x260]
lea rdx, str.runas
mov rcx, rax
lea rax, [rsp + 0x50]
mov r9, rsi
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
jmp 0x14001234d