Function at 0x14009c490
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xa68]
sub rsp, 0xb40
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r12, r9
mov rbx, r8
mov r14, rdx
mov r13, rcx
test rdx, rdx
jne 0x14009c4e9
mov r8d, 0x6ca
lea rdx, str...SynTPEnhCSynTPEnh.cpp
lea rcx, str.hwMain
call fcn.1400be660
test rbx, rbx
jne 0x14009c507
mov r8d, 0x6cc
lea rdx, str...SynTPEnhCSynTPEnh.cpp
lea rcx, str.pszCmdLine
call fcn.1400be660
call fcn.140004e20
mov rdx, rax
xor edi, edi
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
jne 0x14009c528
mov ecx, 0x80004005
call fcn.140007d40
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xa78], rax
or r15, 0xffffffffffffffff
test rbx, rbx
je 0x14009c582
test rbx, 0xffffffffffff0000
jne 0x14009c573
movzx ebx, bx
xor edx, edx
mov ecx, ebx
call fcn.140007c90
test rax, rax
je 0x14009c597
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp + 0xa78]
call fcn.140008550
jmp 0x14009c597
mov rax, r15
inc rax
cmp word [rbx + rax*2], 0
jne 0x14009c576
jmp 0x14009c584
mov eax, edi
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0xa78]
call fcn.140008830
nop
lea r8, [0x1401654cc]
lea rdx, [0x140161ef0]
lea rcx, [rbp + 0xa78]
call fcn.1400a7490
lea r8, [0x1401654d0]
lea rdx, [0x1401654d8]
lea rcx, [rbp + 0xa78]
call fcn.1400a7490
mov rbx, qword [rbp + 0xa78]
cmp dword [rbx - 0x10], 0
jge 0x14009c5e1
mov dword [r12], edi
jmp 0x14009c822
lea rdx, [0x1401654d0]
mov rcx, rbx
call fcn.14010e42c
mov dword [r12], edi
test rax, rax
je 0x14009c822
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jle 0x14009c822
mov r14d, edi
movsxd rdi, eax
add rdi, 2
lea rdi, [rbx + rdi*2]
mov esi, 1
nop
movzx ecx, word [rdi]
call fcn.1401132bc
cmp eax, 0x53
je 0x14009c63a
movzx ecx, word [rdi]
call fcn.1401132bc
cmp eax, 0x52
jne 0x14009c64f
movzx ecx, word [rdi]
call fcn.1401132bc
cmp eax, 0x53
cmove r14d, esi
add rdi, 2
jmp 0x14009c620
mov qword [rsp + 0x48], 7
xor eax, eax
mov qword [rsp + 0x40], rax
mov word [rsp + 0x30], ax
xor r8d, r8d
lea rdx, [0x140150af4]
lea rcx, [rsp + 0x30]
call fcn.140009080
nop
cmp word [rdi], 0x5b
jne 0x14009c73a
cmp word [rdi + 2], 0
jne 0x14009c68f
xor r8d, r8d
jmp 0x14009c69e
mov r8, r15
inc r8
cmp word [rdi + r8*2 + 2], 0
jne 0x14009c692
lea rdx, [rdi + 2]
lea rcx, [rsp + 0x30]
call fcn.140009080
mov edx, 0x5d
xor r8d, r8d
lea rcx, [rsp + 0x30]
call fcn.140014f10
xor r8d, r8d
lea rcx, [rsp + 0x30]
cmp rax, 0xffffffffffffffff
je 0x14009c72e
mov r9, rax
lea rdx, [rsp + 0x58]
call fcn.14008e730
mov rdi, rax
lea rax, [rsp + 0x30]
cmp rax, rdi
je 0x14009c71a
cmp qword [rsp + 0x48], 8
jb 0x14009c6f8
mov rcx, qword [rsp + 0x30]
call fcn.14010a7dc
mov qword [rsp + 0x48], 7
xor eax, eax
mov qword [rsp + 0x40], rax
mov word [rsp + 0x30], ax
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140008930
cmp qword [rsp + 0x70], 8
jb 0x14009c73a
mov rcx, qword [rsp + 0x58]
call fcn.14010a7dc
jmp 0x14009c73a
lea rdx, [0x140150af4]
call fcn.140009080
mov rcx, qword [0x1402aef60]
test rcx, rcx
jne 0x14009c74d
lea rcx, [0x1402aef68]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x14009c75b
mov edi, esi
jmp 0x14009c75f
xor eax, eax
mov edi, eax
xor edx, edx
lea rcx, str.SynTPEnhWndClass
call qword [sym.imp.USER32.dll_FindWindowW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8023
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
test edi, edi
je 0x14009c7a3
mov rdx, qword [r13 + 0x16c0]
test rdx, rdx
je 0x14009c797
xor r13d, r13d
jmp 0x14009c7a9
lea rdx, [r13 + 0x16c8]
xor r13d, r13d
jmp 0x14009c7a9
xor r13d, r13d
mov edx, r13d
xor r8d, r8d
lea rcx, [rbp - 0x80]
call fcn.1400eda90
nop
mov dword [rbp + 0x3fc], r14d
lea rcx, [rbp - 0x80]
cmp qword [rsp + 0x40], 0
jne 0x14009c7d8
xor r9d, r9d
mov r8d, esi
xor edx, edx
call fcn.1400ef280
jmp 0x14009c7f9
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
call fcn.1400edda0
mov dword [r12], esi
lea rcx, [rbp - 0x80]
call fcn.1400edd20
nop
cmp qword [rsp + 0x48], 8
jb 0x14009ca9b
mov rcx, qword [rsp + 0x30]
call fcn.14010a7dc
jmp 0x14009ca9b
movsxd rdi, dword [rbx - 0x10]
test edi, edi
jns 0x14009c835
mov ecx, 0x80070057
call fcn.140007d40
int3
mov esi, 1
mov ecx, esi
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14009c85d
mov edx, edi
lea rcx, [rbp + 0xa78]
call fcn.140008630
mov rbx, qword [rbp + 0xa78]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.14011393c
cmp edi, dword [rbx - 0xc]
jg 0x14009cab4
mov dword [rbx - 0x10], edi
mov rax, rdi
xor edi, edi
mov word [rbx + rax*2], di
lea rdx, [0x1401654e0]
mov rcx, rbx
call fcn.14010e42c
test rax, rax
je 0x14009c8bd
xor r8d, r8d
mov edx, 0x1b1a
mov rcx, r13
call fcn.14009d210
xor r9d, r9d
xor r8d, r8d
mov edx, 0x47c
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14009ca99
lea rdx, [0x1401654e8]
mov rcx, rbx
call fcn.14010e42c
test rax, rax
je 0x14009c900
lea rdx, [rax + 6]
mov rcx, r13
call fcn.140098f10
cmp eax, 0xffffffff
je 0x14009ca99
lea r8, str.1Multifinger_Gestures
mov edx, eax
lea rcx, [0x1402ad8a0]
call fcn.1400998e0
jmp 0x14009ca99
lea rdx, [0x1401654f0]
mov rcx, rbx
call fcn.14010e42c
test rax, rax
je 0x14009c92d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800b
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14009ca99
lea rdx, [0x1401654f8]
mov rcx, rbx
call fcn.14010e42c
test rax, rax
je 0x14009c94d
mov dword [r13 + 0x808], edi
jmp 0x14009ca99
lea rdx, [0x140165500]
mov rcx, rbx
call fcn.14010e42c
test rax, rax
je 0x14009c97a
xor r9d, r9d
xor r8d, r8d
mov edx, 0x47d
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14009ca99
lea rdx, [0x140165508]
mov rcx, rbx
call fcn.14010e42c
test rax, rax
je 0x14009c9a7
xor r9d, r9d
xor r8d, r8d
mov edx, 0x47e
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14009ca99
lea rdx, str._REGPLUGIN
mov rcx, rbx
call fcn.14010e42c
test rax, rax
je 0x14009c9d4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800a
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14009ca99
lea rdx, str._PROFILES
mov rcx, rbx
call fcn.14010e42c
test rax, rax
je 0x14009ca01
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8028
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14009ca99
lea rdx, str._INFORMATION
mov rcx, rbx
call fcn.14010e42c
test rax, rax
je 0x14009ca2b
xor r9d, r9d
xor r8d, r8d
mov edx, 0x802b
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14009ca99
lea rdx, str._SHELLEXEC
mov rcx, rbx
call fcn.14010e42c
test rax, rax
je 0x14009ca78
add rax, 0x14
mov rcx, r15
inc rcx
cmp word [rax + rcx*2], di
jne 0x14009ca46
test rcx, rcx
je 0x14009ca58
add rax, 2
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x14009ca99
lea rdx, str._PROMO
mov rcx, rbx
call fcn.14010e42c
test rax, rax
je 0x14009ca99
mov edx, 0x8000
mov rcx, r14
call fcn.140105e00
mov edi, esi
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14009cab0
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, edi
jmp 0x14009cabf
mov ecx, 0x80070057
call fcn.140007d40
nop
lea r11, [rsp + 0xb40]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret