Function at 0x140095dac
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov byte [rax + 0x10], dl
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov r15, rcx
mov r14b, r8b
mov edi, 0x68
lea rcx, [rbp - 0x10]
xor edx, edx
mov r8d, edi
movaps xmmword [rax - 0x48], xmm6
mov rbx, r9
call fcn.1400278d0
xor esi, esi
lea eax, [rdi - 0x67]
mov dword [rbp - 0x10], edi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x68], rsi
mov dword [rbp + 0xc0], esi
mov dword [rbp + 0x2c], eax
mov word [rbp + 0x30], ax
mov edi, esi
mov r13d, esi
test r14b, r14b
je 0x140095e4e
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
call fcn.140006ad4
cmp qword [rbx + 0x10], 7
mov dword [rbp + 0xc0], eax
jbe 0x140095e80
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x38]
call fcn.140006ad4
mov edi, eax
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x38]
jmp 0x140095e6c
cmp qword [rbx + 0x10], 3
jbe 0x140095e96
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
call fcn.140006ad4
mov edi, eax
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
and edi, 0xffff0000
call fcn.140006ad4
movzx r13d, ax
test r14b, r14b
je 0x140095e96
cmp qword [rbx + 0x10], 6
jbe 0x140095e91
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x30]
jmp 0x140095ea5
test r14b, r14b
jne 0x140095eae
cmp qword [rbx + 0x10], 2
jbe 0x140095eae
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x10]
call fcn.140006ad4
mov word [rbp + 0x30], ax
mov eax, reloc.WSOCK32.dll_recv
bt edi, 0x10
mov r12d, esi
cmovb r12d, eax
mov rax, qword [rbx + 8]
mov rcx, qword [rax]
call fcn.140006c14
mov rcx, rax
call fcn.14001bc44
test r14b, r14b
je 0x140095fa0
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x70], rax
mov rcx, qword [rcx + 8]
call fcn.140006c14
mov rcx, rax
call fcn.14001bc44
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x78], rax
call fcn.140006c14
mov rcx, rax
call fcn.14001bc44
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x20]
mov qword [rsp + 0x68], rax
call fcn.140006c14
mov rcx, rax
call fcn.14001bc44
cmp qword [rbx + 0x10], 5
mov rdi, rax
mov qword [rsp + 0x60], rax
jbe 0x140095f66
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x28]
call fcn.140006c14
mov rcx, rax
call fcn.14001bc44
mov rsi, rax
test rax, rax
je 0x140095f66
mov rcx, rax
call fcn.1400276a8
test rax, rax
jne 0x14009601a
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rcx, 0xffffffffffffffff
lea edx, [rax + 1]
mov edi, eax
mov eax, 2
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.140026f9c
mov edx, edi
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x140096015
mov rdi, rax
mov qword [rsp + 0x60], rax
mov eax, 1
cmp qword [rbx + 0x10], rax
jbe 0x140095fdd
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 8]
call fcn.140006c14
mov rcx, rax
call fcn.14001bc44
mov rsi, rax
test rax, rax
je 0x140095fdd
mov rcx, rax
call fcn.1400276a8
test rax, rax
jne 0x14009605a
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, 0xffffffffffffffff
lea edx, [rax + 1]
mov edi, eax
mov eax, 2
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.140026f9c
mov ecx, edi
mov rdx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rdi, qword [rsp + 0x60]
test r14b, r14b
je 0x14009605a
mov rcx, qword [rbx + 8]
lea rdx, [0x1400ab2d0]
mov rcx, qword [rcx]
call fcn.1400068b8
mov rcx, qword [rbx + 8]
lea rdx, [0x1400ab2d0]
mov rcx, qword [rcx + 8]
call fcn.1400068b8
mov rcx, qword [rbx + 8]
lea rdx, [0x1400ab2d0]
mov rcx, qword [rcx + 0x10]
call fcn.1400068b8
lea rcx, [rbp - 0x60]
mov edx, r13d
call fcn.1400774a0
test r13d, r13d
je 0x1400960cf
lea rcx, [rbp - 0x60]
call fcn.140077e1c
mov ecx, 1
or rbx, 0xffffffffffffffff
lea r13d, [rcx - 1]
movzx edi, cl
cmp rax, rbx
lea rcx, [rbp - 0x60]
cmove edi, r13d
mov qword [rbp + 0x48], rax
call fcn.140077cc4
lea rcx, [rbp - 0x60]
cmp rax, rbx
mov qword [rbp + 0x50], rax
cmove edi, r13d
call fcn.140077d70
or rcx, 0xffffffffffffffff
movzx ebx, dil
mov rdi, qword [rsp + 0x60]
cmp rax, rcx
cmove ebx, r13d
mov qword [rbp + 0x40], rax
test bl, bl
je 0x1400960d5
bts dword [rbp + 0x2c], 8
jmp 0x1400960d5
xor r13d, r13d
mov bl, r13b
test r14b, r14b
je 0x140096182
mov r13, qword [rsp + 0x78]
mov r9, qword [rsp + 0x68]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x10]
mov r8, r13
mov qword [rsp + 0x48], rax
mov eax, dword [rbp + 0xc0]
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], r12d
mov r12, qword [rsp + 0x70]
mov qword [rsp + 0x30], rdi
mov rdx, r12
mov dword [rsp + 0x20], eax
call fcn.14006636c
mov rcx, r12
mov r14b, al
call fcn.1400276a8
mov rdi, r12
mov rcx, rax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, r13
call fcn.1400276a8
mov rdi, r13
mov rcx, rax
xor eax, eax
rep stosb byte [rdi], al
mov rdi, qword [rsp + 0x68]
mov rcx, rdi
call fcn.1400276a8
mov rcx, rax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, r12
call fcn.140025700
mov rcx, r13
call fcn.140025700
mov rcx, qword [rsp + 0x68]
call fcn.140025700
mov rdi, qword [rsp + 0x60]
xor r13d, r13d
jmp 0x1400961c1
lea rcx, [rbp - 0x80]
movzx eax, bl
xor r9d, r9d
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x10]
xor r8d, r8d
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r13
mov rdx, rdi
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne r14b
mov rcx, rdi
call fcn.140025700
mov rcx, rsi
call fcn.140025700
test r14b, r14b
jne 0x140096232
mov rax, qword [r15]
lea rcx, [r15 + 8]
movsxd rdi, dword [rax + 4]
add rcx, rdi
call fcn.140004c10
lea rcx, [r15 + 8]
mov ebx, 1
add rcx, rdi
mov dword [rax + 0x1c], ebx
call fcn.140004c10
mov byte [rax + 0x20], r13b
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r8d, r8d
mov edx, eax
mov rax, qword [r15]
movsxd rcx, dword [rax + 4]
add rcx, r15
call fcn.140025b5c
mov rdi, qword [rbp + 0xd0]
mov rcx, rdi
call fcn.1400065d0
mov dword [rdi + 0x10], ebx
mov dword [rdi], r13d
jmp 0x1400962ad
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x140096268
lea rcx, [rbp - 0x60]
call fcn.1400777f4
mov eax, dword [rbp - 0x70]
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x5c], eax
call fcn.1400780a8
lea rcx, [r15 + 0x7c0]
lea rdx, [rbp - 0x60]
call fcn.1400962d8
cmp byte [rbp + 0xb8], r13b
je 0x14009627e
mov rax, qword [rbp - 0x80]
mov qword [r15 + 0x790], rax
jmp 0x1400962ad
mov eax, dword [rbp - 0x70]
mov rdi, qword [rbp + 0xd0]
xorps xmm6, xmm6
mov rcx, rdi
cvtsi2sd xmm6, rax
call fcn.1400065d0
mov rcx, qword [rbp - 0x80]
movsd qword [rdi], xmm6
mov dword [rdi + 0x10], 3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x60]
call fcn.140077554
lea r11, [rsp + 0x170]
xor eax, eax
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret