Function at 0x1400ae7f0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov qword [rbp - 0x59], 0xfffffffffffffffe
mov rax, qword [0x1401c7ef8]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rdi, r8
mov r12, rdx
mov rbx, rcx
mov qword [rbp - 0x29], rdx
mov qword [rbp - 0x21], r8
lea rcx, str._h_r_
mov rax, qword [str._h_r_]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x71], rax
lea rcx, str._h_r_
mov rax, qword [str._h_r_]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x79], rax
lea rcx, str._h_r_
mov rax, qword [str._h_r_]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x69], rax
lea rcx, [rbp - 0x19]
call fcn.1400a6890
nop
mov qword [rbp - 0x39], reloc.OLEAUT32.dll_SafeArrayDestroy
xor r14d, r14d
mov qword [rbp - 0x41], r14
mov byte [rbp - 0x51], r14b
or rsi, 0xffffffffffffffff
mov r9, rsi
xor r8d, r8d
mov rdx, r12
lea rcx, [rbp - 0x51]
call fcn.140006a40
lea r11, [rbp - 0x19]
mov qword [rsp + 0x28], r11
lea rax, [rbp - 0x69]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x79]
lea r8, [rbp - 0x71]
lea rdx, [rbp - 0x51]
mov rcx, rbx
call fcn.1400ae340
test al, al
je 0x1400ae9eb
cmp qword [rdi + 0x18], 8
jb 0x1400ae8e6
mov r9, qword [rdi]
jmp 0x1400ae8e9
mov r9, rdi
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
mov r8, qword [rbp - 0x79]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
setg r13b
mov rbx, qword [rbp + 0xf]
mov qword [rbp - 0x61], rbx
test rbx, rbx
je 0x1400ae934
lea rcx, [rbx + 0x11]
call fcn.140009190
nop
mov rcx, qword [rbx + 8]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rbx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
nop
cmp qword [rbp - 1], 0x10
jb 0x1400ae944
mov rcx, qword [rbp - 0x19]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rbp - 1], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp - 9], r14
mov byte [rbp - 0x19], 0
mov rdx, qword [rbp - 0x69]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400ae973
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x79]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400ae992
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rbp - 0x71]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1400ae9af
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [r12 + 0x18], 0x10
jb 0x1400ae9c0
mov rcx, qword [r12]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [r12 + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [r12 + 0x10], r14
mov byte [r12], 0
cmp qword [rdi + 0x18], 8
jb 0x1400ae9e2
mov rcx, qword [rdi]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
movzx eax, r13b
jmp 0x1400aeac4
mov rbx, qword [rbp + 0xf]
mov qword [rbp - 0x61], rbx
test rbx, rbx
je 0x1400aea14
lea rcx, [rbx + 0x11]
call fcn.140009190
nop
mov rcx, qword [rbx + 8]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rbx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
nop
cmp qword [rbp - 1], 0x10
jb 0x1400aea24
mov rcx, qword [rbp - 0x19]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rbp - 1], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp - 9], r14
mov byte [rbp - 0x19], 0
mov rdx, qword [rbp - 0x69]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400aea53
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x79]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400aea72
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rbp - 0x71]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1400aea8f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [r12 + 0x18], 0x10
jb 0x1400aeaa0
mov rcx, qword [r12]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [r12 + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [r12 + 0x10], r14
mov byte [r12], 0
cmp qword [rdi + 0x18], 8
jb 0x1400aeac2
mov rcx, qword [rdi]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
xor al, al
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r14
mov word [rdi], r14w
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400d6f80
add rsp, 0xd0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret