Function at 0x14001b740
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xdb0]
sub rsp, 0xeb0
mov edi, r8d
mov r13, rcx
mov rbx, qword [0x14017cbb0]
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x14001beaf
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xe08], rax
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x5b0]
call fcn.14012ce40
mov r15, qword [0x14017ae30]
lea eax, [rdi + 5]
mov rsi, 0xffffffffffffffff
test eax, 0xfffffffd
jne 0x14001be6b
lea edx, [rsi + 0x67]
mov rcx, r15
call qword [sym.imp.USER32.dll_LoadMenuW]
mov r14, rax
test rax, rax
je 0x14001be6b
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetSubMenu]
mov rdi, rax
test rax, rax
je 0x14001be6b
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1032
mov rcx, qword [rbx + 0x748]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x9c42
mov rcx, r14
cmp eax, 1
jbe 0x14001b839
lea r8d, [rsi + 3]
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov edx, 0x8568
lea r8d, [rsi + 3]
mov rcx, r14
call qword [sym.imp.USER32.dll_EnableMenuItem]
lea r8d, [rsi + 3]
jmp 0x14001b856
xor r8d, r8d
call qword [sym.imp.USER32.dll_EnableMenuItem]
xor r8d, r8d
mov edx, 0x8568
mov rcx, r14
call qword [sym.imp.USER32.dll_EnableMenuItem]
xor r8d, r8d
mov edx, 0x876a
mov rcx, r14
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov r9d, 2
mov r8, rsi
mov edx, 0x100c
mov rcx, qword [rbx + 0x748]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r12, rax
test eax, eax
js 0x14001be6b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x60], 0x400
lea rax, [rbp + 0x5b0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x44], r12d
mov dword [rsp + 0x48], 5
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x104b
mov rcx, qword [rbx + 0x748]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14001b922
lea rcx, [rbx + 0xdb0]
lea rdx, [rbp + 0x5b0]
call fcn.1400a4fa0
mov edx, 0x8568
mov rcx, rdi
test al, al
je 0x14001b919
mov r8d, 8
jmp 0x14001b91c
xor r8d, r8d
call qword [sym.imp.USER32.dll_CheckMenuItem]
lea rdx, str._system_
lea rcx, [rbp + 0x5b0]
call fcn.140100b40
test rax, rax
je 0x14001b976
mov edx, 0x9c42
mov r8d, 2
mov rcx, r14
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov edx, 0x8568
mov r8d, 2
mov rcx, r14
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov edx, 0x876a
mov r8d, 2
mov rcx, r14
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov rcx, r13
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea rcx, [rbp - 0x60]
call qword [sym.imp.USER32.dll_GetCursorPos]
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp - 0x5c]
mov r8d, dword [rbp - 0x60]
mov edx, 0x102
mov rcx, rdi
call qword [sym.imp.USER32.dll_TrackPopupMenu]
sub eax, 0x8568
je 0x14001bce3
sub eax, 0x202
je 0x14001bc1d
sub eax, 0x14d8
je 0x14001bb42
sub eax, 6
je 0x14001bb30
cmp eax, 0x1df
jne 0x14001be50
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x14001beba
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xdf8], rax
lea rdx, [rbp + 0xdf8]
lea rcx, [0x14017c550]
call fcn.1400094b0
mov rax, qword [rbp + 0xdf8]
mov edi, dword [rax - 0x10]
test edi, edi
je 0x14001ba45
lea ecx, [rdi - 1]
test ecx, ecx
js 0x14001bea4
cmp ecx, edi
jg 0x14001bea4
movsxd rcx, edi
cmp word [rax + rcx*2 - 2], 0x5c
je 0x14001ba91
lea ebx, [rdi + 1]
test ebx, ebx
js 0x14001bea4
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, ebx
or ecx, edx
jge 0x14001ba76
mov edx, ebx
lea rcx, [rbp + 0xdf8]
call fcn.140005a20
mov rax, qword [rbp + 0xdf8]
mov word [rax + rdi*2], 0x5c
cmp ebx, dword [rax - 0xc]
jg 0x14001bea4
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
xor edx, edx
mov word [rax + rcx*2], dx
lea rdx, str.processlasso.log
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14001baa0
lea rcx, [rbp + 0xdf8]
call fcn.140005c50
mov rbx, qword [rbp + 0xdf8]
cmp dword [rbx - 8], 1
jle 0x14001bada
mov edx, dword [rbx - 0x10]
lea rcx, [rbp + 0xdf8]
call fcn.140005760
mov rbx, qword [rbp + 0xdf8]
mov r8, rbx
lea rdx, str._select__s
lea rcx, [rbp + 0x5b0]
call fcn.140041f30
mov dword [rsp + 0x28], 1
lea r9, [rbp + 0x5b0]
lea r8, str.explorer.exe
xor edx, edx
call fcn.14007ef60
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001be50
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14001be50
mov rcx, qword [rbx + 0xd98]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x14001be50
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
xor edi, edi
mov word [rbp + 0x5b0], di
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x60], 0x400
lea rax, [rbp + 0x5b0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x44], r12d
mov dword [rsp + 0x48], 5
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x104b
mov rcx, qword [rbx + 0x748]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14001bdc8
cmp word [rbp + 0x5b0], di
je 0x14001bdc8
lea r8, [rbp + 0x5b0]
lea rdx, str.https:__www.google.com_search_q_s
lea rcx, [rbp + 0xe08]
call fcn.140005d70
mov rdx, qword [rbp + 0xe08]
cmp dword [rdx - 8], 1
jle 0x14001bbfa
mov edx, dword [rdx - 0x10]
lea rcx, [rbp + 0xe08]
call fcn.140005760
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov r8, qword [rbp + 0xe08]
lea rdx, str.open
call fcn.14007ef60
jmp 0x14001be50
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
xor edi, edi
mov word [rbp + 0x5b0], di
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x60], 0x400
lea rax, [rbp + 0x5b0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x44], r12d
mov dword [rsp + 0x48], 8
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x104b
mov rcx, qword [rbx + 0x748]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14001bdc8
cmp word [rbp + 0x5b0], di
je 0x14001bdc8
lea r8, [rbp + 0x5b0]
lea rdx, str._select__s
lea rcx, [rbp + 0xe08]
call fcn.140005d70
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdi
mov r9, qword [rbp + 0xe08]
lea r8, str.explorer.exe
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x14001be50
lea rcx, [rbx + 0xdb0]
call fcn.1400938a0
test al, al
je 0x14001be50
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
xor edx, edx
mov word [rbp + 0x5b0], dx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x60], 0x400
lea rax, [rbp + 0x5b0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x44], r12d
mov dword [rsp + 0x48], 5
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x104b
mov rcx, qword [rbx + 0x748]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14001bdc6
lea r8, [rbp + 0xdf8]
xor edx, edx
lea rcx, [rbx + 0xdb0]
call fcn.14009c730
lea rdx, [rbp + 0x5b0]
lea rcx, [rbx + 0xdb0]
call fcn.1400a4fa0
lea rdx, [rbp + 0x5b0]
lea rcx, [rbx + 0xdb0]
test al, al
je 0x14001bdb4
call fcn.1400a5e80
mov rcx, rbx
call fcn.14003b870
jmp 0x14001be50
call fcn.1400a6990
mov rcx, rbx
call fcn.14003b870
jmp 0x14001be50
xor edi, edi
mov word [rbp - 0x50], di
mov r9d, 0x2ff
lea r8, [rbp - 0x50]
mov edx, 0x220
mov rcx, r15
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14001be32
cmp byte [0x1401776f0], dil
je 0x14001be05
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x1401776f0], dil
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, 0x2ff
lea r8, [rbp - 0x50]
mov edx, 0x220
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14001be32
mov word [rbp - 0x50], di
mov r9d, InitCommonControls
lea r8, str.Process_Lasso
lea rdx, [rbp - 0x50]
mov rcx, qword [rbx + 0x728]
call qword [sym.imp.USER32.dll_MessageBoxW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, r14
call qword [sym.imp.USER32.dll_DestroyMenu]
nop
mov rdx, qword [rbp + 0xe08]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14001be89
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0xef0]
add rsp, 0xeb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.140002b00
nop
mov ecx, 0x80004005
call fcn.140002b00
nop
mov ecx, 0x80004005
call fcn.140002b00
int3