Function at 0x14015b570
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x68], rcx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
mov r8, qword [rcx + 8]
lea rcx, [rbp - 0x38]
call fcn.14002a170
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x78], rax
call fcn.14012bfe0
lea rcx, [0x1402670d8]
lea rbx, [0x1402670e0]
cmp dword [rax + 0x88], r12d
cmovne rbx, rcx
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x14015c071
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140018bb0
lea rsi, [r12 - 1]
test al, al
jne 0x14015b64c
mov r8, rsi
inc r8
cmp word [rbx + r8*2], 0
jne 0x14015b633
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140018f50
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.140017b80
mov rcx, qword [rbp - 0x10]
cmp dword [rcx - 8], 1
jle 0x14015b67e
mov edx, dword [rcx - 0x10]
lea rcx, [rbp - 0x10]
call fcn.140018d60
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x38]
mov qword [rax + 0x58], rcx
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015b6ab
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_OPENDLG_ARCHIVEFILES
call fcn.140048480
mov rbx, rax
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x14015c07c
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140018bb0
test al, al
jne 0x14015b729
test rbx, rbx
jne 0x14015b70b
mov r8d, r12d
jmp 0x14015b71b
mov r8, rsi
nop
inc r8
cmp word [rbx + r8*2], 0
jne 0x14015b710
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140018f50
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.140017850
mov r13, rax
mov qword [rsp + 0x50], r12
mov rcx, qword [rax]
mov rdx, qword [rcx - 0x18]
test rdx, rdx
je 0x14015b764
mov rcx, qword [rdx]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140038ca6.0]
mov rcx, rax
test rax, rax
jne 0x14015b788
call fcn.140019590
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140038ca6.0]
mov rcx, rax
test rax, rax
je 0x14015c087
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x30], 2
lea rcx, str..zip_.zipx_.rar_.7z_.alz_.egg_.cab_.bh_.001_.arj_.lha_.lzh_.pma_.ace_.arc_.aes_.zpaq_.zst_.zstd_.br_.pea_.tar_.gz_.tgz_.bz_.bz2_.tbz_.tbz2_.xz_.txz_.lzma_.tlz_.lz_.uu_.uue_.xxe_.z_.jar_.war_.apk_.ipa_.xpi_.deb_.j2j_.wgt_.hv3_.isz_.i00_.msi
mov rdi, rsi
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x14015b7b0
mov r13, qword [r13]
movsxd r15, dword [r13 - 0x10]
lea r14d, [r15 + rdi]
test r14d, r14d
js 0x14015c066
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, r14d
or eax, ecx
jge 0x14015b7f3
mov edx, r14d
lea rcx, [rsp + 0x50]
call fcn.140018ea0
mov rbx, qword [rsp + 0x50]
add r15, r15
je 0x14015b829
test rbx, rbx
je 0x14015b819
mov r8, r15
mov rcx, rbx
test r13, r13
je 0x14015b812
mov rdx, r13
call fcn.14022e460
jmp 0x14015b829
xor edx, edx
call fcn.14022eb00
call fcn.1401fed34
mov dword [rax], 0x16
call fcn.1401feb94
movsxd r8, edi
add r8, r8
lea rcx, [r15 + rbx]
je 0x14015b858
test rcx, rcx
jne 0x14015b84c
call fcn.1401fed34
mov dword [rax], 0x16
call fcn.1401feb94
jmp 0x14015b858
lea rdx, str..zip_.zipx_.rar_.7z_.alz_.egg_.cab_.bh_.001_.arj_.lha_.lzh_.pma_.ace_.arc_.aes_.zpaq_.zst_.zstd_.br_.pea_.tar_.gz_.tgz_.bz_.bz2_.tbz_.tbz2_.xz_.txz_.lzma_.tlz_.lz_.uu_.uue_.xxe_.z_.jar_.war_.apk_.ipa_.xpi_.deb_.j2j_.wgt_.hv3_.isz_.i00_.msi
call fcn.14022e460
cmp r14d, dword [rbx - 0xc]
jg 0x14015c066
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
mov word [rbx + rax*2], r12w
mov qword [rsp + 0x48], r12
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x14015b891
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140038ca6.0]
mov rcx, rax
test rax, rax
jne 0x14015b8b5
call fcn.140019590
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140038ca6.0]
mov rcx, rax
test rax, rax
je 0x14015c092
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x30], 6
lea r13, str..iso_.img_.isz_.udf_.wim_.bin_.i00_
mov r14, rsi
nop dword [rax]
inc r14
cmp word [r13 + r14*2], 0
jne 0x14015b8e0
movsxd r12, dword [rbx - 0x10]
lea r15d, [r12 + r14]
test r15d, r15d
js 0x14015c05b
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, r15d
or eax, ecx
jge 0x14015b921
mov edx, r15d
lea rcx, [rsp + 0x48]
call fcn.140018ea0
mov rdi, qword [rsp + 0x48]
add r12, r12
je 0x14015b94b
test rdi, rdi
jne 0x14015b93d
call fcn.1401fed34
mov dword [rax], 0x16
call fcn.1401feb94
jmp 0x14015b94b
mov r8, r12
mov rdx, rbx
mov rcx, rdi
call fcn.14022e460
movsxd r8, r14d
add r8, r8
lea rcx, [r12 + rdi]
je 0x14015b976
test rcx, rcx
jne 0x14015b96e
call fcn.1401fed34
mov dword [rax], 0x16
call fcn.1401feb94
jmp 0x14015b976
mov rdx, r13
call fcn.14022e460
cmp r15d, dword [rdi - 0xc]
jg 0x14015c05b
mov dword [rdi - 0x10], r15d
movsxd rax, r15d
xor r14d, r14d
mov word [rdi + rax*2], r14w
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x40]
call fcn.140017850
mov rbx, rax
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_OPENDLG_ALLFILES
call fcn.140048480
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x48]
call fcn.1400179b0
nop
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140017850
mov r13, rax
mov qword [rsp + 0x40], r14
mov rcx, qword [rax]
mov rdx, qword [rcx - 0x18]
test rdx, rdx
je 0x14015ba03
mov rcx, qword [rdx]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140038ca6.0]
mov rcx, rax
test rax, rax
jne 0x14015ba27
call fcn.140019590
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140038ca6.0]
mov rcx, rax
test rax, rax
je 0x14015c09d
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov r12d, 7
mov dword [rsp + 0x30], r12d
lea rcx, [0x140267090]
mov rdi, rsi
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x14015ba52
mov r13, qword [r13]
movsxd r15, dword [r13 - 0x10]
lea r14d, [r15 + rdi]
test r14d, r14d
js 0x14015c0be
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, r14d
or eax, ecx
jge 0x14015ba95
mov edx, r14d
lea rcx, [rsp + 0x40]
call fcn.140018ea0
mov rbx, qword [rsp + 0x40]
add r15, r15
je 0x14015bacb
test rbx, rbx
je 0x14015babb
mov r8, r15
mov rcx, rbx
test r13, r13
je 0x14015bab4
mov rdx, r13
call fcn.14022e460
jmp 0x14015bacb
xor edx, edx
call fcn.14022eb00
call fcn.1401fed34
mov dword [rax], 0x16
call fcn.1401feb94
movsxd r8, edi
add r8, r8
lea rcx, [r15 + rbx]
je 0x14015bafa
test rcx, rcx
jne 0x14015baee
call fcn.1401fed34
mov dword [rax], 0x16
call fcn.1401feb94
jmp 0x14015bafa
lea rdx, [0x140267090]
call fcn.14022e460
cmp r14d, dword [rbx - 0xc]
jg 0x14015c0be
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
xor edi, edi
mov word [rbx + rax*2], di
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x58]
call fcn.140017850
nop
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.140017850
mov rbx, rax
mov qword [rsp + 0x70], rax
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140017b80
xor r8d, r8d
lea edx, [rdi + 0x7c]
lea rcx, [rbp - 0x28]
call fcn.140017aa0
mov rcx, qword [rbp - 0x28]
cmp dword [rcx - 8], 1
jle 0x14015bb69
mov edx, dword [rcx - 0x10]
lea rcx, [rbp - 0x28]
call fcn.140018d60
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x38]
mov qword [rax + 0x18], rcx
mov rax, qword [rbp - 0x38]
mov dword [rax + 0x2c], 1
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015bba0
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015bbc4
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
and r12d, 0xfffffffe
mov dword [rsp + 0x30], r12d
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015bbf3
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015bc18
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015bc3d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015bc61
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
and dword [rsp + 0x30], 0xfffffffb
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015bc8b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
and dword [rsp + 0x30], 0xfffffffd
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015bcb6
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015bcdc
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015bd01
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov rax, qword [rbp - 0x38]
or dword [rax + 0x60], 0x200
mov rax, qword [rbp - 0x38]
mov dword [rax + 0x38], 0xc800
mov ecx, 1
mov r8, qword [rbp - 0x20]
sub ecx, dword [r8 - 8]
mov eax, dword [r8 - 0xc]
sub eax, 0xc800
or eax, ecx
jge 0x14015bd43
mov edx, 0xc800
lea rcx, [rbp - 0x20]
call fcn.140018ea0
mov r8, qword [rbp - 0x20]
mov rax, qword [rbp - 0x38]
mov qword [rax + 0x30], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x70], rax
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x14015c0a8
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rbx, str.opendlg
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140018bb0
test al, al
jne 0x14015bdb9
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x14015bda0
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140018f50
nop
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x34]
call fcn.1400f70e0
nop
mov dword [0x14030c210], 1
mov dword [0x14030c204], 1
lea rcx, [rbp - 0x38]
call fcn.14002a420
nop
mov dword [0x14030c204], edi
mov dword [0x14030c210], edi
lea rdx, [0x140267540]
test eax, eax
jne 0x14015be1e
nop
inc rsi
cmp word [rdx + rsi*2], 0
jne 0x14015be00
mov r8d, esi
lea rcx, [0x140315390]
call fcn.140018f50
jmp 0x14015c025
mov r8, rsi
inc r8
cmp word [rdx + r8*2], 0
jne 0x14015be21
lea rcx, [0x140315390]
call fcn.140018f50
mov rax, qword [rbp - 0x38]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x68], rcx
mov qword [rbp + 0x10], rdi
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x38]
call fcn.14002a4f0
nop
mov qword [rbp + 8], rdi
lea rcx, [rbp + 8]
call fcn.140022dc0
nop
cmp qword [rsp + 0x68], 0
je 0x14015bf3b
nop word [rax + rax]
mov dword [0x14030c210], 1
mov qword [rbp], rdi
lea r8, [rsp + 0x68]
lea rdx, [rbp]
lea rcx, [rbp - 0x38]
call fcn.14002a4f0
nop
mov qword [rbp - 8], rdi
mov r8, qword [rbp]
lea rdx, str._open___s_
lea rcx, [rbp - 8]
call fcn.140028500
nop
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rdi
mov r9, qword [rbp - 8]
mov r8, qword [rbp + 8]
lea rdx, [0x14026ad70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rbp - 8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015bf04
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbp]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015bf29
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov dword [0x14030c210], edi
cmp qword [rsp + 0x68], 0
jne 0x14015be80
mov dword [rbp - 0x80], esi
lea rax, [rbp - 0x78]
mov qword [rsp + 0x70], rax
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x14015c0b3
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbp - 0x78], rax
mov dword [rbp - 0x80], esi
lea rcx, [rbp - 0x78]
call fcn.140018cc0
nop
lea rax, [rbp - 0x70]
mov qword [rsp + 0x70], rax
mov rcx, qword [rbp + 0x10]
add rcx, 0xffffffffffffffe8
call fcn.140019180
add rax, 0x18
mov qword [rbp - 0x70], rax
mov r9d, 1
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp - 0x68]
call fcn.14015a7e0
nop
lea rax, [rbp - 0x78]
mov qword [rbp - 0x68], rax
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015bfdd
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbp + 8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14015c002
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbp + 0x10]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14015c025
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
lea rcx, [rbp - 0x38]
call fcn.14002a330
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1401f74b0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80070057
call fcn.140019300
nop
mov ecx, 0x80070057
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
int3
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80070057
call fcn.140019300
int3