Function at 0x14017f2e0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rbx, rdx
mov r14, rcx
mov rsi, qword [rcx]
mov rdi, qword [rsi + 0x2e8]
cmp dword [rdx + 0x48], 0xf
je 0x14017f35b
mov dword [rdx + 0x48], 0xf
movzx eax, byte [rdx + 0x40]
shr al, 4
test al, 1
jne 0x14017f33a
mov rcx, rdx
call fcn.1400d95a0
mov dl, 1
mov rcx, rax
call fcn.1400e37a0
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], 4
lea rcx, [rsi + 0x388]
lea r8, [rsp + 0x48]
mov rdx, rsi
call fcn.1401188e0
lea r15, [0x140346ce0]
mov qword [rsp + 0x58], r15
xor ebp, ebp
mov qword [rsp + 0x60], rbp
lea r8, [rsp + 0x58]
mov rdx, rbx
mov rcx, r14
call fcn.14017f590
mov esi, eax
lea edx, [rax + 2]
cmp edx, 1
jbe 0x14017f4bc
test eax, eax
jne 0x14017f400
cmp qword [rdi + 8], rbp
je 0x14017f3c3
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov rcx, rax
mov dword [rsp + 0x30], 0x13
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 2]
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x14017f3ca
mov byte [rdi + 0xaf], 0
mov r8, qword [r14]
xor edx, edx
mov rcx, rbx
call fcn.1400d9f00
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov r8, qword [rsp + 0x58]
lea rdx, [0x14034b9b8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x14017f559
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], rbp
lea r8, [rsp + 0x48]
mov rdx, rbx
mov rcx, r14
call fcn.14017fe10
mov esi, eax
test eax, eax
jne 0x14017f4ab
cmp qword [rdi + 8], 0
je 0x14017f458
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov rcx, rax
mov dword [rsp + 0x30], 0x13
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
lea rdx, [r9 - 2]
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x14017f45f
mov byte [rdi + 0xaf], 0
mov r8, qword [r14]
xor edx, edx
mov rcx, rbx
call fcn.1400d9f00
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov r8, qword [rsp + 0x48]
lea rdx, [0x14034b9b8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
cmp dword [rsp + 0x50], 0
jle 0x14017f559
mov rcx, qword [rsp + 0x48]
call fcn.1402b7350
jmp 0x14017f559
cmp dword [rsp + 0x50], 0
jle 0x14017f4bc
mov rcx, qword [rsp + 0x48]
call fcn.1402b7350
mov rdi, qword [r14]
cmp dword [rbx + 0x48], 6
je 0x14017f50a
mov dword [rbx + 0x48], 6
movzx eax, byte [rbx + 0x40]
shr al, 4
test al, 1
jne 0x14017f4e9
mov rcx, rbx
call fcn.1400d95a0
mov dl, 1
mov rcx, rax
call fcn.1400e37a0
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], 4
lea rcx, [rdi + 0x388]
lea r8, [rsp + 0x48]
mov rdx, rdi
call fcn.1401188e0
cmp esi, 0xffffffff
jne 0x14017f527
mov rax, qword [r14]
mov rcx, qword [rax + 0x2e8]
mov rax, qword [rcx]
call qword [rax]
lea rdx, str.API_key_invalid__result__1_
jmp 0x14017f542
cmp esi, 0xfffffffe
jne 0x14017f559
mov rax, qword [r14]
mov rcx, qword [rax + 0x2e8]
mov rax, qword [rcx]
call qword [rax]
lea rdx, str.Quota_exceeded__result__2__r_n_r_nVirusTotal_allows_20_requests_of_any_nature_in_a_given_5_minutes_time_frame._r_n_r_nTry_again_in_a_few_minutes.
mov r9d, 0x30
lea r8, str.VirusTotal
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
cmp dword [rsp + 0x60], 0
jle 0x14017f56a
mov rcx, qword [rsp + 0x58]
call fcn.1402b7350
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret