Function at 0x10002ae34
Capabilities:
Create process on windows

Disassembly:
push rdi
mov eax, 0x10e0
call fcn.100092660
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x10f8], rbx
mov rax, qword [0x1000a1140]
xor rax, rsp
mov qword [rsp + 0x10d0], rax
mov eax, 0x9c54
cmp edx, eax
jg 0x10002b1d8
cmp edx, eax
je 0x10002b17f
mov eax, 0x9c45
cmp edx, eax
jg 0x10002b0a5
cmp edx, eax
je 0x10002b08e
sub edx, 0x9c40
je 0x10002b055
sub edx, 1
je 0x10002af80
sub edx, 1
je 0x10002af66
sub edx, 1
je 0x10002aefe
cmp edx, 1
jne 0x10002b3ef
mov al, byte [0x1000acbbe]
neg al
sbb rcx, rcx
and ecx, 0x28
add rcx, 0x69
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x45c
mov byte [rsp + 0x20], dl
mov r9d, 0x3f2
lea r8, [0x1000370b0]
mov rdx, qword [0x1000acba0]
call fcn.1000665ac
jmp 0x10002b3ef
cmp byte [0x1000acbbe], 0
jne 0x10002b3ef
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
mov r9d, 2
lea r8, [0x100037c3c]
mov rdx, qword [0x1000acba0]
lea ecx, [r9 + 0x6a]
call fcn.1000665ac
cmp byte [0x1000acbbe], 0
je 0x10002b3ef
cmp byte [0x1000acbbf], 0
jne 0x10002b3ef
mov byte [0x1000acbbf], 1
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowCursor]
jmp 0x10002b3ef
mov rcx, qword [0x1000aca08]
test rcx, rcx
je 0x10002b3ef
call fcn.10002a490
jmp 0x10002b3ef
mov rax, qword [0x1000aca08]
test rax, rax
je 0x10002b3ef
mov rbx, qword [rax + 0x18]
cmp dword [rax + 0xc], 0
je 0x10002b017
cmp dword [rbx + 0xaa80], 0
jbe 0x10002b017
mov ecx, dword [rbx + 0xaa80]
dec ecx
mov rax, qword [rbx + 0xaa90]
mov rdi, qword [rax + rcx*8]
mov eax, dword [rbx + 0xaa80]
test eax, eax
je 0x10002afc8
dec eax
mov dword [rbx + 0xaa80], eax
mov rdx, rdi
mov rcx, rbx
call fcn.10003372c
mov rcx, rdi
call sub.msvcrt.dll_free
mov edx, dword [rbx + 0xa9f8]
cmp edx, 0xffffffff
je 0x10002affc
or dword [rbx + 0xa9f8], 0xffffffff
mov byte [rbx + 0xaaf0], 1
mov rcx, rbx
call fcn.1000345f8
mov rcx, rbx
call fcn.1000345bc
mov dl, 1
mov rcx, qword [0x1000acb80]
call fcn.10003eca0
jmp 0x10002b3ef
cmp byte [rax + 0x8e], 0
je 0x10002b3ef
cmp dword [0x1000a8c08], 6
jbe 0x10002b3ef
mov rax, qword [0x1000a8c18]
mov rcx, qword [rax + 0x30]
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rcx]
mov rcx, qword [0x1000acbe8]
call fcn.100042714
jmp 0x10002b3ef
mov rcx, qword [0x1000aca08]
cmp dword [rcx + 0xc], 3
je 0x10002b082
mov rax, qword [rcx + 0x18]
cmp byte [rax + 0xa8], 0
je 0x10002b078
cmp byte [rax + 0xa9], 0
je 0x10002b082
call fcn.100038c18
jmp 0x10002b3ef
mov dl, 1
call fcn.1000287b8
jmp 0x10002b3ef
cmp byte [0x1000acbbe], 0
jne 0x10002b3ef
call fcn.100037320
jmp 0x10002b3ef
sub edx, 0x9c46
je 0x10002b16a
sub edx, 1
je 0x10002b159
sub edx, 1
je 0x10002b148
sub edx, 7
je 0x10002b13e
cmp edx, 1
jne 0x10002b3ef
mov edx, 0x66
mov rcx, qword [0x1000acab0]
call qword [sym.imp.USER32.dll_LoadIconW]
mov rdi, rax
mov edx, 0x398
lea rcx, [rsp + 0x60]
call fcn.10005fb28
mov rbx, rax
mov edx, 0xad83
lea rcx, [rsp + 0x48]
call fcn.10005fb28
mov r9, rdi
mov r8, qword [rbx + 0x10]
mov rdx, qword [rax + 0x10]
mov rcx, qword [0x1000acba0]
call qword [sym.imp.SHELL32.dll_ShellAboutW]
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x70]
call sub.msvcrt.dll_free
call fcn.100041064
jmp 0x10002b3ef
call fcn.100041208
jmp 0x10002b3ef
mov rcx, qword [0x1000aca08]
call fcn.100028f8c
jmp 0x10002b3ef
mov rcx, qword [0x1000aca08]
call fcn.100029130
jmp 0x10002b3ef
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x10002b3ef
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r9d, 0x824
lea r8, [rsp + 0x80]
mov edx, 0x99
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jle 0x10002b3ef
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x80]
lea rdx, [0x1000151c0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10002b3ef
sub edx, 0x9c70
je 0x10002b3cb
sub edx, 1
je 0x10002b3a2
sub edx, 1
je 0x10002b36c
sub edx, 1
je 0x10002b330
sub edx, 1
je 0x10002b2f4
sub edx, 1
je 0x10002b2b8
sub edx, 2
je 0x10002b27c
sub edx, 2
je 0x10002b250
cmp edx, 1
jne 0x10002b3ef
mov rbx, qword [0x1000aca08]
mov dword [rbx + 0x80], 3
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x10002b243
call fcn.1000348d4
mov rcx, rbx
call fcn.10002978c
jmp 0x10002b3ef
mov rbx, qword [0x1000aca08]
mov dword [rbx + 0x80], 2
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x10002b26f
call fcn.1000348d4
mov rcx, rbx
call fcn.10002978c
jmp 0x10002b3ef
mov rcx, qword [0x1000aca08]
mov dword [rcx + 0x84], 4
cmp qword [rcx + 0x18], 0
je 0x10002b2ae
cmp dword [rcx + 0xc], 0
setne dl
xor r8d, r8d
mov rcx, qword [rcx + 0x18]
call fcn.1000349dc
mov rcx, qword [0x1000aca08]
call fcn.10002978c
jmp 0x10002b3ef
mov rcx, qword [0x1000aca08]
mov dword [rcx + 0x84], 3
cmp qword [rcx + 0x18], 0
je 0x10002b2ea
cmp dword [rcx + 0xc], 0
setne dl
xor r8d, r8d
mov rcx, qword [rcx + 0x18]
call fcn.1000349dc
mov rcx, qword [0x1000aca08]
call fcn.10002978c
jmp 0x10002b3ef
mov rcx, qword [0x1000aca08]
mov dword [rcx + 0x84], 2
cmp qword [rcx + 0x18], 0
je 0x10002b326
cmp dword [rcx + 0xc], 0
setne dl
xor r8d, r8d
mov rcx, qword [rcx + 0x18]
call fcn.1000349dc
mov rcx, qword [0x1000aca08]
call fcn.10002978c
jmp 0x10002b3ef
mov rcx, qword [0x1000aca08]
mov dword [rcx + 0x84], 1
cmp qword [rcx + 0x18], 0
je 0x10002b362
cmp dword [rcx + 0xc], 0
setne dl
xor r8d, r8d
mov rcx, qword [rcx + 0x18]
call fcn.1000349dc
mov rcx, qword [0x1000aca08]
call fcn.10002978c
jmp 0x10002b3ef
mov rcx, qword [0x1000aca08]
and dword [rcx + 0x84], 0
cmp qword [rcx + 0x18], 0
je 0x10002b39b
cmp dword [rcx + 0xc], 0
setne dl
xor r8d, r8d
mov rcx, qword [rcx + 0x18]
call fcn.1000349dc
mov rcx, qword [0x1000aca08]
call fcn.10002978c
jmp 0x10002b3ef
mov rbx, qword [0x1000aca08]
mov dword [rbx + 0x80], 1
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x10002b3c1
call fcn.1000348d4
mov rcx, rbx
call fcn.10002978c
jmp 0x10002b3ef
mov rbx, qword [0x1000aca08]
and dword [rbx + 0x80], 0
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x10002b3e7
call fcn.1000348d4
mov rcx, rbx
call fcn.10002978c
mov rcx, qword [rsp + 0x10d0]
xor rcx, rsp
call fcn.1000915c0
mov rbx, qword [rsp + 0x10f8]
add rsp, 0x10e0
pop rdi
ret