Function at 0x180022b30
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
push rbp
lea rbp, [r11 - 0xc08]
sub rsp, 0xd00
lea eax, [rcx - 0xf]
cmp ecx, eax
jbe 0x1800237ab
mov qword [r11 - 0x10], rbx
lea r9, [0x180000000]
mov ebx, dword [rbp + 0xc10]
xor edx, edx
mov qword [r11 - 0x18], rsi
mov esi, 0xf
mov qword [r11 - 0x20], rdi
lea edi, [rcx - 0xf9]
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r14
lea r10d, [rsi - 0xe]
mov r14d, dword [rbp + 0xc10]
mov dword [rbp + 0xc28], edi
mov r13, qword [rbp + 0xc28]
mov r12, qword [rbp + 0xc28]
mov qword [r11 - 0x40], r15
lea r11d, [rsi + 0x4d]
mov r15, qword [rbp + 0xc28]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rbx
nop
cmp edi, 0xf
ja case.0x180022bd4.1
mov ecx, dword [r9 + rdi*4 + 0x237b4]
add rcx, r9
jmp rcx
xor r9d, r9d
mov dword [rsp + 0x20], 0x73
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180042c60
jmp 0x180023740
mov rax, qword [r8]
lea r9, [rbp + 0xc28]
mov r15, rdx
mov qword [rbp + 0xc28], rax
lea r8, [rbp + 0xc10]
mov word [rbp + 0xc10], r10w
mov edx, 0xc2
lea rcx, [rbp + 0x80]
call fcn.180010500
lea rcx, [rbp + 0x2a0]
mov edx, 2
lea rax, [rbp + 0x80]
nop dword [rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x180022c40
mov eax, dword [rax]
mov r8d, 0xff
mov dword [rcx], eax
lea rcx, [rbp + 0xc10]
mov dword [rbp + 0xc10], edx
lea rdx, [rbp + 0x2a0]
call fcn.180020da0
mov eax, 2
mov qword [rsp + 0x20], 0
mov word [rbp + 0xc10], ax
lea r9, [rbp + 0xc10]
mov rax, qword [rbp + 0xc20]
lea rcx, [rbp + 0xc28]
xor edx, edx
mov rax, qword [rax]
lea r8d, [rdx + 0x28]
mov qword [rbp + 0xc28], rax
call fcn.180068730
jmp 0x180023740
movzx eax, word [0x1800a08dc]
mov word [rsp + 0x60], ax
movzx eax, byte [0x1800a08de]
mov byte [rsp + 0x62], al
xor eax, eax
mov qword [rsp + 0x63], rax
mov dword [rsp + 0x6b], eax
mov byte [rsp + 0x6f], al
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
jmp case.0x180022bd4.1
xor edx, edx
lea rcx, [rbp + 0x80]
mov r8d, 0x104
call fcn.180070440
lea rcx, [rbp + 0x3b0]
mov edx, 2
lea rax, [rbp + 0x80]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x180022d60
mov eax, dword [rax]
mov dword [rcx], eax
jmp 0x180023740
xor edx, edx
lea rcx, [rbp + 0x80]
mov r8d, 0x104
call fcn.180070440
lea rcx, [rbp + 0x190]
mov edx, 2
lea rax, [rbp + 0x80]
nop dword [rax]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x180022df0
mov eax, dword [rax]
mov dword [rcx], eax
jmp 0x180023740
mov edx, r11d
lea rcx, [rbp + 0x3b0]
call fcn.18006f960
mov edx, 0x5c
lea rcx, [rbp + 0x3b0]
mov byte [rax], 0
call fcn.18006f960
mov r11d, 0x5c
mov r15, rax
mov word [rax], r11w
jmp 0x180023746
lea rax, str.5_3_wavelet__only_used_in_snow
test ebx, ebx
lea r8, str.D3DXVECTOR4_D3DXVec4Transform__
mov edx, 0x104
cmove r8, rax
mov rcx, r15
call fcn.180073290
lea rdx, [rbp + 0x190]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x180023740
mov rax, qword [r8]
lea rdx, [rbp + 0xc10]
mov r8d, 0x92
mov qword [rbp + 0xc28], rax
lea rcx, [rbp + 0xc28]
mov dword [rbp + 0xc10], r13d
call fcn.18004ff10
jmp 0x180023740
lea r8, str.GstBaseTransform
mov edx, 0x104
lea rcx, [rbp + 0x190]
call fcn.1800732f0
jmp 0x180023740
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0xc10]
xor edx, edx
lea rcx, [rbp + 0xc28]
mov eax, 3
mov word [rbp + 0xc10], ax
mov rax, qword [r8]
lea r8d, [rdx + 0x28]
mov qword [rbp + 0xc28], rax
call fcn.180068730
lea r8, [0x1800c54a0]
mov qword [rsp + 0x50], rax
mov edx, 0x104
lea rcx, [rbp + 0x3b0]
mov rbx, rax
mov r13d, 1
call fcn.180073290
mov r10d, r13d
lea r11d, [r13 + 0x5b]
jmp 0x18002374c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18002356b
mov eax, 0x114
mov dword [rbp + 0xc10], eax
sub eax, 0x114
je 0x180023532
sub eax, 0x48
je 0x180023532
sub eax, 0x48
je 0x180023500
sub eax, 0x48
je 0x1800234e8
cmp eax, 0x48
jne 0x180023541
test r12, r12
je 0x1800234df
mov ebx, 0x11d
mov eax, ebx
sub eax, 0x11d
je 0x1800232ee
sub eax, 1
je 0x1800232a9
sub eax, 1
je 0x18002328d
cmp eax, 1
jne 0x1800234cf
mov rcx, qword [0x1800c56b0]
lea r9, [rsp + 0x70]
xor edi, edi
lea r8, [rbp + 0x3b0]
mov dword [rsp + 0x28], edi
lea rdx, [0x18009f134]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x180023281
mov esi, 0x80
nop word [rax + rax]
mov eax, esi
sub eax, 0x80
je 0x180023241
sub eax, 1
je 0x18002305d
cmp eax, 1
jne 0x18002326e
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x18002326e
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rdi
lea edx, [r9 + 0x4a]
call fcn.18002e300
lea rdx, [0x1800a0368]
lea rcx, [rbp + 0x190]
call fcn.180075fc0
mov r12, rax
test rax, rax
je 0x18002326e
mov r8, rax
lea rcx, [rbp - 0x80]
mov edx, 0x100
call fcn.180075ee8
test rax, rax
je 0x180023234
cmp byte [rbp - 0x80], 0
je 0x180023218
mov edi, 0x91
nop word [rax + rax]
mov eax, edi
sub eax, 0x91
je 0x1800231f9
sub eax, 1
je 0x1800231ce
sub eax, 1
je 0x1800230fc
cmp eax, 1
jne 0x18002320a
inc r14d
jmp 0x18002320a
mov r8d, 0xff
mov dword [rsp + 0x40], r14d
lea rdx, [rbp + 0x2a0]
lea rcx, [rsp + 0x40]
call fcn.180020da0
lea rcx, [rbp + 0x80]
mov edx, 2
lea rax, [rbp + 0x2a0]
nop dword [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x180023130
mov eax, dword [rax]
mov dword [rcx], eax
lea rcx, [rbp - 0x80]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x180023192
mov qword [rsp + 0x40], rax
lea r9, [rsp + 0x48]
mov eax, r14d
lea r8, [rbp + 0x80]
mov qword [rsp + 0x48], rax
lea rcx, [rbp - 0x80]
lea rax, [rsp + 0x40]
mov edx, 0xeb
mov qword [rsp + 0x20], rax
call fcn.180032ba0
jmp 0x18002320a
lea r8, [0x1800a08e0]
mov edx, 0x100
mov rcx, r15
call fcn.180073290
lea r8, str._WIA
mov edx, 0x100
lea rcx, [rbp - 0x80]
call fcn.1800732f0
jmp 0x18002320a
mov edx, 0xa
lea rcx, [rbp - 0x80]
call fcn.18006f960
mov r15, rax
inc edi
cmp edi, 0x95
jb 0x1800230d0
mov r8, r12
lea rcx, [rbp - 0x80]
mov edx, 0x100
call fcn.180075ee8
test rax, rax
jne 0x1800230b6
xor edi, edi
mov rcx, r12
call fcn.180075d14
mov r12, rdi
jmp 0x18002326e
xor edx, edx
xor ecx, ecx
mov r8d, 0x106
call fcn.180035080
xor edx, edx
xor ecx, ecx
mov r8d, 0x106
call fcn.180035080
xor edx, edx
xor ecx, ecx
mov r8d, 0x106
call fcn.180035080
inc esi
cmp esi, 0x83
jb 0x180023030
jmp 0x1800234cf
mov r13, 0xffffffffffffffff
jmp 0x1800234cf
xor r9d, r9d
mov dword [rsp + 0x20], 0x73
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180042c60
jmp 0x1800234cf
lea rdx, [rbp + 0x190]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, str.AppCacheLookup
mov edx, 0x104
lea rcx, [rbp + 0x190]
call fcn.1800732f0
lea r8, [0x1800a0960]
mov edx, 0x10
lea rcx, [rsp + 0x70]
call fcn.180073290
jmp 0x1800234cf
mov r8, r12
lea rcx, [rbp - 0x80]
mov edx, 0x100
call fcn.180075ee8
test rax, rax
je 0x1800234b7
nop dword [rax + rax]
movzx eax, byte [rbp - 0x80]
movzx edx, byte [rbp - 0x7e]
movzx ecx, byte [rbp - 0x7f]
cmp al, 0x2d
jne 0x18002334e
cmp cl, 0x31
jne 0x180023335
test dl, dl
jne 0x180023335
mov r13, 0xffffffffffffffff
jmp 0x18002349d
cmp al, 0x2d
jne 0x18002334e
cmp cl, 0x32
jne 0x18002334e
test dl, dl
jne 0x18002334e
mov r13, 0xfffffffffffffffe
jmp 0x18002349d
test al, al
je 0x18002349d
mov edi, 0x129
nop dword [rax + rax]
mov eax, edi
sub eax, 0x129
je 0x18002347e
sub eax, 1
je 0x180023383
cmp eax, 1
jne 0x18002348f
inc r14d
jmp 0x18002348f
lea r8, [0x1800a08e0]
mov edx, 0x100
mov rcx, r15
call fcn.180073290
lea r8, str._TWAIN
mov edx, 0x100
lea rcx, [rbp - 0x80]
call fcn.1800732f0
mov r8d, 0xff
mov dword [rsp + 0x40], r14d
lea rdx, [rbp + 0x2a0]
lea rcx, [rsp + 0x40]
call fcn.180020da0
lea rcx, [rbp + 0x80]
mov edx, 2
lea rax, [rbp + 0x2a0]
nop dword [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x1800233e0
mov eax, dword [rax]
mov dword [rcx], eax
lea rcx, [rbp - 0x80]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x180023442
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x40]
mov eax, r14d
lea r8, [rbp + 0x80]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x80]
lea rax, [rsp + 0x48]
mov edx, 0xeb
mov qword [rsp + 0x20], rax
call fcn.180032ba0
jmp 0x18002348f
mov edx, 0xa
lea rcx, [rbp - 0x80]
call fcn.18006f960
mov r15, rax
inc edi
cmp edi, 0x12c
jb 0x180023360
mov r8, r12
lea rcx, [rbp - 0x80]
mov edx, 0x100
call fcn.180075ee8
test rax, rax
jne 0x180023310
mov rcx, r12
call fcn.180075d14
lea rcx, [rbp + 0x190]
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
inc ebx
cmp ebx, 0x121
jb 0x180022fc1
jmp 0x180023541
mov r13, 0xfffffffffffffffe
jmp 0x180023541
lea rdx, [0x1800a0368]
lea rcx, [rbp + 0x190]
call fcn.180075fc0
mov r12, rax
jmp 0x180023541
xor edx, edx
xor ecx, ecx
mov r8d, 0x106
call fcn.180035080
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea edx, [rax + 0x4a]
call fcn.18002e300
jmp 0x180023541
mov r8d, 0x106
xor edx, edx
xor ecx, ecx
call fcn.180035080
mov eax, dword [rbp + 0xc10]
add eax, 0x48
mov dword [rbp + 0xc10], eax
cmp eax, 0x27c
jb 0x180022f84
mov rbx, qword [rsp + 0x50]
mov edi, dword [rbp + 0xc28]
mov rsi, qword [rsp + 0x58]
lea rcx, [rbp + 0x4c0]
mov edx, 2
lea rax, [rbp + 0x2a0]
nop
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x180023580
mov eax, dword [rax]
lea r8d, [rdx + 0x1d]
mov dword [rcx], eax
lea r9, [rbp + 0xc28]
mov eax, 1
mov byte [rbp + 0xc10], dl
mov word [rbp + 0xc28], ax
lea rdx, [rbp + 0xc10]
mov rax, qword [rbp + 0xc20]
lea rcx, [rbp + 0x4c0]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.180012d20
jmp 0x180023740
mov ebx, edx
lea rcx, [rbp + 0x80]
mov r12, rdx
mov qword [rsp + 0x50], rbx
xor edx, edx
mov r8d, 0x100
call fcn.180070440
lea rax, [rbp - 0x80]
mov edx, 2
lea rcx, [rbp + 0x80]
nop dword [rax]
nop word [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x180023660
jmp 0x180023740
mov r14d, r10d
jmp case.0x180022bd4.1
mov ecx, 0xffffff52
lea rdx, [rbp + 0x5d0]
call qword [0x1800d5910]
mov r8, qword [rbp + 0xc20]
xor eax, eax
mov word [0x1800d5918], ax
test r8, r8
je 0x1800236f0
mov eax, dword [rbp + 0xb30]
mov dword [r8], eax
mov rdx, qword [rbp + 0xc18]
lea r9, [0x180000000]
mov r10d, 1
lea r11d, [r10 + 0x5b]
test rdx, rdx
je 0x18002375a
mov eax, dword [rbp + 0xb2c]
mov dword [rdx], eax
jmp 0x18002375a
mov rcx, qword [0x1800c56b0]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x28], edx
lea r8, [rbp + 0x3b0]
mov qword [rsp + 0x20], rdx
lea rdx, [0x18009f134]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov r11d, 0x5c
mov r10d, 1
mov r8, qword [rbp + 0xc20]
lea r9, [0x180000000]
xor edx, edx
dec edi
sub rsi, 1
mov dword [rbp + 0xc28], edi
mov qword [rsp + 0x58], rsi
jne 0x180022bc0
mov r15, qword [rsp + 0xcc8]
mov r14, qword [rsp + 0xcd0]
mov r13, qword [rsp + 0xcd8]
mov r12, qword [rsp + 0xce0]
mov rdi, qword [rsp + 0xce8]
mov rsi, qword [rsp + 0xcf0]
mov rbx, qword [rsp + 0xcf8]
add rsp, 0xd00
pop rbp
ret