Function at 0x140078ac0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov r11, rsp
mov dword [r11 + 0x18], r8d
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x880
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x1400bdbf0]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov r13, rcx
mov rdi, rdx
mov r15d, r8d
call fcn.140077e90
test eax, eax
jne 0x140078b1d
mov r12d, 0x426
jmp 0x140079168
xor r14d, r14d
mov word [rsp + 0x70], r14w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x72]
call sub.MSVCR90.dll_memset
mov dword [rsp + 0x60], CDHtmlElementEventSink::AddRef
mov eax, r14d
test rdi, rdi
setne al
test eax, eax
jne 0x140078b58
mov ecx, 0x80004005
call fcn.140001340
int3
mov dword [rsp + 0x20], 0xc0
mov r9d, CDHtmlElementEventSink::AddRef
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.140006400
test eax, eax
jne 0x140078b8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x140079168
mov word [rsp + 0x30], r14w
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.140077ff0
mov r12d, eax
test eax, eax
jne 0x140079168
lea rcx, str.__a_t_
mov rax, qword [str.__a_t_]
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x38], rsi
lea rcx, str.__a_t_
mov rax, qword [str.__a_t_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rdx, qword [r13 + 8]
lea rcx, [rdx - 0x18]
lea rdi, [rsi - 0x18]
or rbp, 0xffffffffffffffff
cmp rcx, rdi
je 0x140078c3e
cmp dword [rdi + 0x10], r12d
jl 0x140078c2b
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140078c2b
call fcn.1400020e0
mov rsi, rax
mov ecx, ebp
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140078c20
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
add rsi, 0x18
mov qword [rsp + 0x38], rsi
jmp 0x140078c3e
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140001f70
mov rsi, qword [rsp + 0x38]
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x140078c66
mov edx, 0x104
lea rcx, [rsp + 0x38]
call fcn.140002070
mov rsi, qword [rsp + 0x38]
lea rdx, str.AnalysisRpt.exe
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
movsxd rdx, dword [rsi - 0xc]
mov rcx, rsi
call qword [sym.imp.MSVCR90.dll_wcsnlen]
test eax, eax
js 0x14007915d
cmp eax, dword [rsi - 0xc]
jg 0x14007915d
mov dword [rsi - 0x10], eax
cdqe
mov word [rsi + rax*2], r14w
mov rdi, qword [r13 + 0x10]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x140078ccb
cmp rax, qword [rdi - 0x18]
jne 0x140078ccb
lea rbx, [rdi - 0x18]
lock add dword [rdi - 8], 1
mov rsi, qword [rsp + 0x38]
jmp 0x140078d09
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x140078ce7
call fcn.140002240
int3
mov eax, dword [rdi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rdi - 0x10]
inc eax
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rbx + 0x18]
call qword [sym.imp.MSVCR90.dll_memcpy_s]
add rbx, 0x18
mov qword [rsp + 0x48], rbx
lea rcx, str.__a_t_
mov rax, qword [str.__a_t_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov r9, qword [r13 + 0x10]
mov r8, qword [r13 + 8]
lea rdx, str._sHtmlDoc_s
lea rcx, [rsp + 0x50]
call fcn.140002360
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140078e74
xor eax, eax
mov rcx, rbp
lea rdi, str.en_us
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x140078dd8
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140078e74
cmp dword [rdx + 0x10], eax
jge 0x140078da6
cmp dword [rbx - 0xc], eax
jge 0x140078d99
mov ecx, 0x80070057
call fcn.140001340
int3
mov dword [rbx - 0x10], r14d
mov word [rbx], r14w
jmp 0x140078e74
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140078dbc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov rsi, qword [rsp + 0x38]
jmp 0x140078e74
mov r14d, dword [rbx - 0x10]
lea r13, str.en_us
sub r13, rbx
sar r13, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140078e0b
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.140002070
mov rbx, qword [rsp + 0x48]
cmp r13, r14
ja 0x140078e30
movsxd rax, edi
lea r14, [rax + rax]
lea r8, [rbx + r13*2]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r14
mov rcx, rbx
call qword [sym.imp.MSVCR90.dll_memmove_s]
jmp 0x140078e51
movsxd rax, edi
lea r14, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r14
lea r8, str.en_us
mov rcx, rbx
call qword [sym.imp.MSVCR90.dll_memcpy_s]
test edi, edi
js 0x140078e69
cmp edi, dword [rbx - 0xc]
jg 0x140078e69
mov dword [rbx - 0x10], edi
xor eax, eax
mov word [r14 + rbx], ax
xor r14d, r14d
jmp 0x140078e74
mov ecx, 0x80070057
call fcn.140001340
int3
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140078eaf
movzx r8d, word [rsp + 0x30]
mov dword [rsp + 0x28], r15d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea rdx, str.http:__localhost:_u__s_file_report.htm_fpath_ssid_u
lea rcx, [rsp + 0x40]
call fcn.140002360
jmp 0x14007901d
lea rcx, str.__a_t_
mov rax, qword [str.__a_t_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
movzx r8d, word [rsp + 0x30]
mov dword [rsp + 0x28], r15d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea rdx, str.http:__localhost:_u__s_file_report.htm_fpath_ssid_u
lea rcx, [rsp + 0x58]
call fcn.140002360
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xa]
call fcn.140050000
cmp eax, 1
jne 0x140078f9a
xor eax, eax
mov rcx, rbp
lea rdi, str.iexplore
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.iexplore
lea rcx, [rsp + 0x38]
call fcn.140001f70
mov rdx, qword [rsp + 0x58]
lea rdi, [rdx - 0x18]
mov rbx, qword [rsp + 0x40]
add rbx, 0xffffffffffffffe8
cmp rdi, rbx
je 0x140078ff8
cmp dword [rbx + 0x10], 0
jl 0x140078f8a
mov rax, qword [rbx]
cmp qword [rdi], rax
jne 0x140078f8a
mov rcx, rdi
call fcn.1400020e0
mov rsi, rax
mov ecx, ebp
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140078f7f
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x40], rax
jmp 0x140078ff8
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140001f70
jmp 0x140078ff8
mov rdx, qword [rsp + 0x58]
lea rdi, [rdx - 0x18]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x140078ff8
cmp dword [rsi + 0x10], 0
jl 0x140078fe9
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x140078fe9
mov rcx, rdi
call fcn.1400020e0
mov rbx, rax
mov ecx, ebp
lock xadd dword [rsi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140078fde
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140078ff8
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140001f70
nop
mov eax, ebp
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x140079018
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
mov rsi, qword [rsp + 0x38]
jmp 0x14007901d
mov rsi, qword [rsp + 0x38]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
mov r9, qword [rsp + 0x40]
mov r8, rsi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x1400790de
mov r12d, eax
mov ecx, 8
test eax, eax
cmove r12d, ecx
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140079078
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140079098
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400790b8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
dec ebp
test ebp, ebp
jg 0x140079168
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140079168
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400790fe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007911e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007913e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
dec ebp
test ebp, ebp
jg 0x140079168
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140079168
mov ecx, 0x80070057
call fcn.140001340
nop
mov eax, r12d
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.14004d770
mov rbx, qword [rsp + 0x8d8]
add rsp, 0x880
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret