Function at 0x140119960
Capabilities:
Create process on windows
Get common file path
Log keystrokes

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8e8]
sub rsp, 0x9e8
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov rbx, rcx
test rcx, rcx
je 0x140119ed4
lea r8, [rsp + 0x70]
lea rdx, [0x1401796a8]
call fcn.140126508
cmp eax, 0xffffffff
je 0x140119ed4
mov edx, 2
mov ecx, 0x104
call fcn.14012aad0
mov rdi, rax
mov qword [rsp + 0x68], 7
xor r15d, r15d
mov qword [rsp + 0x60], r15
mov word [rsp + 0x50], r15w
cmp word [rbx], r15w
jne 0x1401199eb
mov r8d, r15d
jmp 0x1401199fa
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rbx + r8*2], r15w
jne 0x1401199f0
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14000d340
nop
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], r15
mov word [rbp - 0x68], r15w
mov r8d, 4
lea rdx, str.__t_n_r
lea rcx, [rbp - 0x68]
call fcn.14000d340
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x78]
call fcn.14011bea0
nop
cmp qword [rsp + 0x68], 8
jb 0x140119a55
mov rcx, qword [rsp + 0x50]
call fcn.14011f898
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r15
mov word [rsp + 0x50], r15w
test rdi, rdi
je 0x140119e9b
lea r8, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae r8, qword [rsp + 0x78]
lea r9, [0x1401a3ef4]
mov edx, 0x104
mov rcx, rdi
call fcn.140119520
mov rcx, rdi
test eax, eax
je 0x140119e84
lea r12, [rbp + 0xc0]
mov dword [rbp + 0x930], 1
mov r13d, r15d
mov edx, 0x2e
call fcn.1401229dc
test rax, rax
je 0x140119b51
lea rdx, str..lnk
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140119b51
mov dword [rsp + 0x40], 1
lea rax, [rbp + 0x930]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x104
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rbp + 0xc0]
mov r8d, 0x200
mov rdx, rdi
mov rcx, rdi
call fcn.140114ad0
test eax, eax
je 0x140119b30
mov r13d, 1
jmp 0x140119b51
test byte [0x1402d741c], 1
je 0x140119b51
lea r8, str.cannot_dereference_the_shell_link._n
mov edx, 1
lea rcx, str.RunAppOrURL
call fcn.14011a490
mov rsi, r15
mov edx, SafeArrayAllocDescriptor
mov rcx, rdi
call fcn.1401229dc
mov r14, rax
lea r8, [rbp + 0x4e0]
test rax, rax
je 0x140119bd1
mov edx, r15d
mov rcx, rdi
cmp word [rdi], dx
je 0x140119ba7
test dl, 1
jne 0x140119b86
cmp word [rcx], 0x20
je 0x140119ba4
movzx eax, word [rcx]
cmp ax, 0x22
jne 0x140119b93
inc edx
jmp 0x140119b9b
mov word [r8], ax
add r8, 2
add rcx, 2
cmp word [rcx], si
jmp 0x140119b79
mov rsi, rcx
mov word [r8], r15w
lea r15, [rbp + 0x4e0]
test rsi, rsi
je 0x140119bd4
xor ebx, ebx
mov word [rsi], bx
lea edx, [rbx + 0x5c]
mov rcx, rdi
call fcn.140122818
mov ecx, SafeArrayAllocDescriptor
mov word [rsi], cx
jmp 0x140119be3
mov r15, rdi
mov edx, 0x5c
mov rcx, rdi
call fcn.140122818
xor ebx, ebx
test rax, rax
je 0x140119c27
test r14, r14
je 0x140119bff
cmp r14, rax
jae 0x140119bff
sub rax, r14
sub rax, 2
lea rdx, [r14 + 2]
jmp 0x140119c05
sub rax, rdi
mov rdx, rdi
sar rax, 1
mov r8d, eax
mov ebx, eax
lea rcx, [rbp + 0xc0]
call fcn.14012628c
xor eax, eax
mov word [rbp + rbx*2 + 0xc0], ax
xor ebx, ebx
jmp 0x140119c49
lea rdx, [rbp + 0xc0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140119c46
mov word [rbp + 0xc6], bx
jmp 0x140119c49
mov r12, rbx
mov r14, rbx
test rsi, rsi
je 0x140119c57
add rsi, 2
jmp 0x140119c5a
mov rsi, rbx
cmp qword [rbp + 0x940], 0
je 0x140119cb2
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r14, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
mov r8d, 1
mov ecx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, qword [rbp + 0x940]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
xor r8d, r8d
mov ecx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor ebx, ebx
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rbp - 0x20]
call fcn.14011fa60
mov dword [rbp - 0x20], 0x70
mov dword [rbp - 0x1c], 0x440
mov qword [rbp - 0x18], rbx
lea rax, str.open
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], r15
mov rax, qword [rbp + 0x948]
test rax, rax
cmovne rsi, rax
mov qword [rbp], rsi
mov qword [rbp + 8], r12
mov dword [rbp + 0x10], 1
test byte [0x1402d741c], 4
je 0x140119d23
mov r9, r15
lea r8, str.Trying_to_ShellExecute:__s_n
mov edx, 3
lea rcx, str.RunAppOrURL
call fcn.14011a490
lea rcx, [rbp - 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebx, eax
test eax, eax
je 0x140119d3c
mov rsi, qword [rbp + 0x48]
jmp 0x140119e3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
je 0x140119e6b
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp + 0x50]
call fcn.14011fa60
mov dword [rbp + 0x50], 0x68
test r13d, r13d
je 0x140119d7d
or dword [rbp + 0x8c], 1
movzx eax, word [rbp + 0x930]
mov word [rbp + 0x90], ax
lea rdx, [rbp + 0xc0]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ebx, ebx
test eax, eax
je 0x140119d9e
mov word [rbp + 0xc6], bx
jmp 0x140119da1
mov r12, rbx
test byte [0x1402d741c], 4
je 0x140119dc5
mov r9, rdi
lea r8, str.Trying_to_CreateProcess_with:__s_n
mov edx, 3
lea rcx, str.RunAppOrURL
call fcn.14011a490
lea rax, [rbp - 0x48]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
mov rsi, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x140119e34
test byte [0x1402d741c], 1
je 0x140119e3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.Couldnt_launch_program__error__0x_08X_n
lea edx, [rbx + 1]
lea rcx, str.RunAppOrURL
call fcn.14011a490
jmp 0x140119e3e
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x140119e67
cmp dword [rbp + 0x938], 0
je 0x140119e5e
test ebx, ebx
je 0x140119e5e
mov edx, 0x1388
mov rcx, rsi
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140119e7a
test r14, r14
je 0x140119e7a
xor edx, edx
mov rcx, r14
call fcn.140115960
mov rcx, rdi
call fcn.1401217ac
jmp 0x140119ebf
call fcn.1401217ac
test byte [0x1402d741c], 1
je 0x140119ebc
lea r8, str._Expanded__App_or_URL_string_is_too_long_n
jmp 0x140119eab
test byte [0x1402d741c], 1
je 0x140119ebc
lea r8, str.Fail_to_allocate_memory_for_expanded_string_n
mov edx, 1
lea rcx, str.RunAppOrURL
call fcn.14011a490
mov ebx, r15d
cmp qword [rbp - 0x70], 8
jb 0x140119ed0
mov rcx, qword [rsp + 0x78]
call fcn.14011f898
mov eax, ebx
jmp 0x140119ef7
test byte [0x1402d741c], 1
je 0x140119ef5
lea r8, str.App_or_URL_not_specified._n
mov edx, 1
lea rcx, str.RunAppOrURL
call fcn.14011a490
xor eax, eax
add rsp, 0x9e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret