Function at 0x1400fbea0
Capabilities:
Accept command line arguments
Create process on windows
Get file system object information

Disassembly:
mov byte [rsp + 0x20], r9b
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov byte [rsp + 8], cl
sub rsp, 0x3e8
mov rax, qword [rsp + 0x3f8]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x410]
mov dword [rsp + 0x38], eax
movzx eax, byte [rsp + 0x408]
mov byte [rsp + 0x30], al
mov eax, dword [rsp + 0x38]
add eax, 0x4383
cmp eax, dword [rsp + 0x410]
jne 0x1400fbf00
mov eax, dword [rsp + 0x410]
sub eax, 0x70b3
mov dword [rsp + 0x38], eax
mov eax, 0x4f8
mov word [rsp + 0x34], ax
movsx eax, byte [rsp + 0x30]
movsx ecx, byte [rsp + 0x408]
and eax, ecx
movsx ecx, byte [rsp + 0x3f0]
cmp eax, ecx
je 0x1400fbfd2
movsx eax, word [rsp + 0x34]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0xd2
je 0x1400fbf66
cmp dword [rsp + 0x50], 0x6b6
je 0x1400fbf48
jmp 0x1400fbf79
movzx r9d, word [rsp + 0x34]
mov r8d, 0x28
mov edx, 0xec
mov rcx, qword [rsp + 0x40]
call fcn.1400fbda0
nop
jmp 0x1400fbf79
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x3c], eax
movabs rax, 0x773b9c24bd6033
mov rcx, qword [rsp + 0x3f8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov r8w, 0xe4
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x3c]
call fcn.1400fb0f0
mov r8d, 0x8a
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.SHELL32.dll_ExtractIconW]
mov qword [rsp + 0x88], rax
movabs rax, 0x75b5fa6afebc09
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x58], rax
movabs rax, 0x7aa79adfa6c0f3
cmp qword [rsp + 0x58], rax
je 0x1400fc11c
movabs rax, 0x7e424e45320376
cmp qword [rsp + 0x58], rax
je 0x1400fc016
jmp 0x1400fc18a
movsx eax, byte [rsp + 0x30]
movsx ecx, byte [rsp + 0x408]
shl eax, cl
movsx ecx, byte [rsp + 0x3f0]
cmp eax, ecx
je 0x1400fc0e4
movzx eax, byte [rsp + 0x400]
cmp eax, 0x4f
je 0x1400fc0bd
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
movabs rax, 0x70006e6d867f7d
cmp qword [rsp + 0x60], rax
je 0x1400fc0a3
movabs rax, 0x75834df82867ca
cmp qword [rsp + 0x60], rax
je 0x1400fc070
jmp 0x1400fc0bb
movsx eax, byte [rsp + 0x408]
movsx ecx, byte [rsp + 0x3f0]
xor eax, ecx
mov byte [rsp + 0x30], al
movzx r9d, word [rsp + 0x34]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.1400fbda0
nop
jmp 0x1400fc0bb
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x90], rax
jmp 0x1400fc0e2
movabs rax, 0x7d408c1d1229cd
cmp qword [rsp + 0x48], rax
jb 0x1400fc0e2
mov eax, dword [rsp + 0x410]
movzx ecx, al
mov eax, dword [rsp + 0x3c]
shr eax, cl
mov dword [rsp + 0x38], eax
jmp 0x1400fc11a
movabs rax, 0x70ee1871683744
cmp qword [rsp + 0x48], rax
jbe 0x1400fc11a
mov r8w, 0x64
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x3c]
call fcn.1400fb0f0
lea rcx, [rsp + 0xb0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rsp + 0x68], eax
jmp 0x1400fc18a
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x3f0], al
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x20], eax
movzx r9d, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x400]
mov rdx, qword [rsp + 0x40]
movzx ecx, byte [rsp + 0x30]
call fcn.1400fbea0
movsx eax, word [rsp + 0x34]
sub eax, 0x25e
mov word [rsp + 0x34], ax
mov dword [rsp + 0x20], 0xc2
mov r9d, 0xad
lea r8, [rsp + 0x120]
mov edx, reloc.SHELL32.dll_ILGetNext
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [rsp + 0x6c], eax
lea rax, [rsp + 0x34]
mov qword [rsp + 0xa0], rax
mov eax, 0x91
add rsp, 0x3e8
ret