Function at 0x1400ac300
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xa68]
sub rsp, 0xb40
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r12, r9
mov rbx, r8
mov r14, rdx
mov r13, rcx
test rdx, rdx
jne 0x1400ac359
mov r8d, 0x6ac
lea rdx, str.CSynTPEnh.cpp
lea rcx, str.hwMain
call fcn.14000cb10
test rbx, rbx
jne 0x1400ac377
mov r8d, 0x6ae
lea rdx, str.CSynTPEnh.cpp
lea rcx, str.pszCmdLine
call fcn.14000cb10
test byte [0x1402d741c], 2
je 0x1400ac39b
mov r9, rbx
lea r8, [0x140173d4c]
mov edx, 2
lea rcx, str.CSynTPEnh::ParseCommandLine
call fcn.14011a590
call fcn.140004fc0
mov rdx, rax
xor edi, edi
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
jne 0x1400ac3bc
mov ecx, 0x80004005
call fcn.140004f70
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xa78], rax
or r15, 0xffffffffffffffff
test rbx, rbx
je 0x1400ac41c
test rbx, 0xffffffffffff0000
jne 0x1400ac407
movzx ebx, bx
xor edx, edx
mov ecx, ebx
call fcn.140011240
test rax, rax
je 0x1400ac431
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp + 0xa78]
call fcn.140011590
jmp 0x1400ac431
mov rax, r15
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400ac410
jmp 0x1400ac41e
mov eax, edi
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0xa78]
call fcn.140011790
nop
lea r8, [0x14018b3ac]
lea rdx, [0x140187368]
lea rcx, [rbp + 0xa78]
call fcn.1400b7d20
lea r8, [0x14018b3b0]
lea rdx, [0x14018b3b8]
lea rcx, [rbp + 0xa78]
call fcn.1400b7d20
mov rbx, qword [rbp + 0xa78]
cmp dword [rbx - 0x10], 0
jge 0x1400ac47b
mov dword [r12], edi
jmp 0x1400ac6e0
lea rdx, [0x14018b3b0]
mov rcx, rbx
call fcn.140122ad0
mov dword [r12], edi
test rax, rax
je 0x1400ac6e0
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jle 0x1400ac6e0
mov r14d, edi
movsxd rdi, eax
add rdi, 2
lea rdi, [rbx + rdi*2]
mov esi, 1
nop dword [rax]
movzx ecx, word [rdi]
call fcn.140127a74
cmp eax, 0x53
je 0x1400ac4da
movzx ecx, word [rdi]
call fcn.140127a74
cmp eax, 0x52
jne 0x1400ac4ef
movzx ecx, word [rdi]
call fcn.140127a74
cmp eax, 0x53
cmove r14d, esi
add rdi, 2
jmp 0x1400ac4c0
mov qword [rsp + 0x48], 7
xor eax, eax
mov qword [rsp + 0x40], rax
mov word [rsp + 0x30], ax
xor r8d, r8d
lea rdx, [0x140165848]
lea rcx, [rsp + 0x30]
call fcn.14000d340
nop
cmp word [rdi], 0x5b
jne 0x1400ac5da
cmp word [rdi + 2], 0
jne 0x1400ac52f
xor r8d, r8d
jmp 0x1400ac53e
mov r8, r15
inc r8
cmp word [rdi + r8*2 + 2], 0
jne 0x1400ac532
lea rdx, [rdi + 2]
lea rcx, [rsp + 0x30]
call fcn.14000d340
mov edx, 0x5d
xor r8d, r8d
lea rcx, [rsp + 0x30]
call fcn.14000d6e0
xor r8d, r8d
lea rcx, [rsp + 0x30]
cmp rax, 0xffffffffffffffff
je 0x1400ac5ce
mov r9, rax
lea rdx, [rsp + 0x58]
call fcn.14009d7c0
mov rdi, rax
lea rax, [rsp + 0x30]
cmp rax, rdi
je 0x1400ac5ba
cmp qword [rsp + 0x48], 8
jb 0x1400ac598
mov rcx, qword [rsp + 0x30]
call fcn.14011f898
mov qword [rsp + 0x48], 7
xor eax, eax
mov qword [rsp + 0x40], rax
mov word [rsp + 0x30], ax
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140040ff0
cmp qword [rsp + 0x70], 8
jb 0x1400ac5da
mov rcx, qword [rsp + 0x58]
call fcn.14011f898
jmp 0x1400ac5da
lea rdx, [0x140165848]
call fcn.14000d340
mov rcx, qword [0x1402ddef0]
test rcx, rcx
jne 0x1400ac5ed
lea rcx, [0x1402ddef8]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x1400ac5fb
mov edi, esi
jmp 0x1400ac61d
xor eax, eax
mov edi, eax
test byte [0x1402d741c], 1
je 0x1400ac61d
lea r8, str.SynAPI_Initialize_error._n
mov edx, esi
lea rcx, str.CSynTPEnh::ParseCommandLine
call fcn.14011a490
xor edx, edx
lea rcx, str.SynTPEnhWndClass
call qword [sym.imp.USER32.dll_FindWindowW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8023
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
test edi, edi
je 0x1400ac661
mov rdx, qword [r13 + 0x16b0]
test rdx, rdx
je 0x1400ac655
xor r13d, r13d
jmp 0x1400ac667
lea rdx, [r13 + 0x16b8]
xor r13d, r13d
jmp 0x1400ac667
xor r13d, r13d
mov edx, r13d
xor r8d, r8d
lea rcx, [rbp - 0x80]
call fcn.1400f9110
nop
mov dword [rbp + 0x3fc], r14d
lea rcx, [rbp - 0x80]
cmp qword [rsp + 0x40], 0
jne 0x1400ac696
xor r9d, r9d
mov r8d, esi
xor edx, edx
call fcn.1400fa810
jmp 0x1400ac6b7
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
call fcn.1400f9420
mov dword [r12], esi
lea rcx, [rbp - 0x80]
call fcn.1400f93a0
nop
cmp qword [rsp + 0x48], 8
jb 0x1400ac994
mov rcx, qword [rsp + 0x30]
call fcn.14011f898
jmp 0x1400ac994
movsxd rdi, dword [rbx - 0x10]
test edi, edi
jns 0x1400ac6f3
mov ecx, 0x80070057
call fcn.140004f70
int3
mov esi, 1
mov ecx, esi
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400ac71b
mov edx, edi
lea rcx, [rbp + 0xa78]
call fcn.14000f050
mov rbx, qword [rbp + 0xa78]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.1401282d4
cmp edi, dword [rbx - 0xc]
jg 0x1400ac9ad
mov dword [rbx - 0x10], edi
xor r12d, r12d
mov word [rbx + rdi*2], r12w
lea rdx, [0x14018b3dc]
mov rcx, rbx
call fcn.140122ad0
test rax, rax
je 0x1400ac77a
xor r8d, r8d
mov edx, 0x1b1a
mov rcx, r13
call fcn.1400ad170
xor r9d, r9d
xor r8d, r8d
mov edx, 0x47c
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400ac992
lea rdx, [0x14018b3e8]
mov rcx, rbx
call fcn.140122ad0
test rax, rax
je 0x1400ac7bd
lea rdx, [rax + 6]
mov rcx, r13
call fcn.1400a8e40
cmp eax, 0xffffffff
je 0x1400ac992
lea r8, str.1Multifinger_Gestures
mov edx, eax
lea rcx, [0x1402dc840]
call fcn.1400a9600
jmp 0x1400ac992
lea rdx, [0x14018b3f0]
mov rcx, rbx
call fcn.140122ad0
test rax, rax
je 0x1400ac7ea
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800b
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400ac992
lea rdx, [0x14018b3f8]
mov rcx, rbx
call fcn.140122ad0
test rax, rax
je 0x1400ac80a
mov dword [r13 + 0x800], r12d
jmp 0x1400ac992
lea rdx, [0x14018b400]
mov rcx, rbx
call fcn.140122ad0
test rax, rax
je 0x1400ac837
xor r9d, r9d
xor r8d, r8d
mov edx, 0x47d
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400ac992
lea rdx, [0x14018b408]
mov rcx, rbx
call fcn.140122ad0
test rax, rax
je 0x1400ac864
xor r9d, r9d
xor r8d, r8d
mov edx, 0x47e
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400ac992
lea rdx, str._REGPLUGIN
mov rcx, rbx
call fcn.140122ad0
test rax, rax
je 0x1400ac891
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800a
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400ac992
lea rdx, str._PROFILES
mov rcx, rbx
call fcn.140122ad0
test rax, rax
je 0x1400ac8be
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8028
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400ac992
lea rdx, str._INFORMATION
mov rcx, rbx
call fcn.140122ad0
test rax, rax
je 0x1400ac8eb
xor r9d, r9d
xor r8d, r8d
mov edx, 0x802b
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400ac992
lea rdx, str._SHELLEXEC
mov rcx, rbx
call fcn.140122ad0
mov rdi, rax
test rax, rax
je 0x1400ac971
add rdi, 0x14
mov rcx, r15
nop dword [rax]
inc rcx
cmp word [rdi + rcx*2], r12w
jne 0x1400ac910
test rcx, rcx
je 0x1400ac923
add rdi, 2
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rdi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x1400ac992
test byte [0x1402d741c], 2
je 0x1400ac992
mov qword [rsp + 0x20], rdi
mov r9, rax
lea r8, str.Failed__Error__d__to_open__ws_n
mov edx, 2
lea rcx, str.CSynTPEnh::ParseCommandLine
call fcn.14011a490
jmp 0x1400ac992
lea rdx, str._PROMO
mov rcx, rbx
call fcn.140122ad0
test rax, rax
je 0x1400ac992
mov edx, 0x8000
mov rcx, r14
call fcn.140119f10
mov edi, esi
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400ac9a9
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, edi
jmp 0x1400ac9b8
mov ecx, 0x80070057
call fcn.140004f70
nop
lea r11, [rsp + 0xb40]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret