Function at 0x1400174e0
Capabilities:
Create process on windows
Create thread

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x320
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x358], rbx
mov rax, qword [0x140056b28]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov r12d, r8d
mov rdi, rcx
mov esi, 3
mov rcx, qword [rcx + 0x1b0]
call qword [sym.imp.USER32.dll_GetMenuItemCount]
cmp eax, esi
jle 0x140017a6c
nop word [rax + rax]
mov r8d, esi
lea rdx, [rsp + 0x38]
lea rcx, [rdi + 0x1b0]
call fcn.140013f80
mov rbx, qword [rax]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], 0x50
xor edx, edx
lea r8d, [rdx + 0x4c]
lea rcx, [rsp + 0x54]
call fcn.140024c30
mov dword [rsp + 0x54], 0x20
lea r9, [rsp + 0x50]
xor r8d, r8d
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetMenuItemInfoW]
test eax, eax
jne 0x1400175ac
inc esi
mov rcx, qword [rdi + 0x1b0]
call qword [sym.imp.USER32.dll_GetMenuItemCount]
cmp esi, eax
jl 0x140017540
jmp 0x140017a6c
mov r12, qword [rsp + 0x80]
xor edx, edx
lea r8d, [rdx + 0x50]
lea rcx, [rsp + 0x50]
call fcn.140024c30
mov dword [rsp + 0x50], 0x50
mov dword [rsp + 0x54], 0x20
lea r9, [rsp + 0x50]
mov r8d, 1
mov edx, esi
mov rcx, qword [rdi + 0x1b0]
call qword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov rbx, qword [rsp + 0x80]
test rbx, rbx
je 0x140017a6c
test r12, r12
je 0x140017a6c
xor r13d, r13d
mov word [rsp + 0xf0], r13w
xor eax, eax
mov dword [rsp + 0xf2], eax
mov word [rsp + 0xf6], ax
mov word [rsp + 0x30], r13w
mov rax, qword [rbx]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x18]
movzx r11d, word [rsp + 0x30]
cmp r11w, 0x5c
jne 0x14001765d
lea rdx, [0x140044cb4]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x140017689
mov word [rsp + 0xf0], r11w
mov eax, 0x3a
mov word [rsp + 0xf2], ax
mov eax, 0x5c
mov word [rsp + 0xf4], ax
mov word [rsp + 0xf6], r13w
mov eax, r12d
sub eax, 0x88
je 0x140017a42
sub eax, 5
je 0x1400179f8
sub eax, 1
je 0x1400177ed
sub eax, 1
je 0x1400177cc
cmp eax, 1
je 0x140017767
mov dword [rdi + 0x88], 1
mov qword [rsp + 0x38], r13
mov rax, qword [r12]
lea rdx, [rsp + 0x38]
mov rcx, r12
call qword [rax + 0x20]
mov r11, qword [rbx]
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call qword [r11 + 0x78]
test eax, eax
je 0x140017743
mov dword [rdi + 0x88], 1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
mov dword [rdi + 0x88], r13d
cmp eax, 0x80004004
je 0x140017750
cmp eax, 1
je 0x140017750
test eax, eax
je 0x140017731
lea r9, [rsp + 0xf0]
mov edx, 0x27dd
lea r8d, [rdx + 0x41]
mov rcx, rdi
call fcn.140013950
jmp 0x140017750
mov rcx, qword [rdi + 0xa0]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x40]
jmp 0x140017750
mov rax, qword [rbx]
mov rdx, r12
mov rcx, rbx
call qword [rax + 0x38]
nop
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [rdi + 0x88], r13d
jmp 0x140017a6a
mov dword [rdi + 0x88], 1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
mov dword [rdi + 0x88], r13d
cmp eax, 0x80004004
je 0x140017a6a
cmp eax, 1
je 0x140017a6a
test eax, eax
je 0x1400177b7
lea r9, [rsp + 0xf0]
mov edx, 0x27dd
lea r8d, [rdx + 0x41]
mov rcx, rdi
call fcn.140013950
jmp 0x140017a6a
mov rcx, qword [rdi + 0xa0]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x40]
jmp 0x140017a6a
mov dword [rdi + 0x88], 1
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax + 0x60]
mov dword [rdi + 0x88], r13d
jmp 0x140017a6a
mov qword [rsp + 0x38], r13
lea r8, str..wmt__.vhd__.vmdk__.vdi
mov edx, 0x27fb
lea rcx, [rsp + 0x38]
call fcn.14001ffc0
mov word [rsp + 0x100], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x102]
call fcn.140024c30
mov dword [rsp + 0x50], 0x98
xor edx, edx
mov r8d, SysAllocStringByteLen
lea rcx, [rsp + 0x58]
call fcn.140024c30
mov r11, qword [rdi + 8]
mov qword [rsp + 0x58], r11
lea rax, [rsp + 0x100]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], 0x104
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0xb0], 0x1800
lea rcx, [rsp + 0x50]
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x1400179eb
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rsi, eax
mov edx, esi
lea rcx, [rdi + 0xb8]
call fcn.140011120
test eax, eax
je 0x140017922
lea rbp, [rsi + rsi]
lea edx, [rsi + 1]
movsxd rdx, edx
add rdx, rdx
mov r9, rbp
lea r8, [rsp + 0x100]
mov rcx, qword [rdi + 0xb8]
call fcn.140024ea8
test eax, eax
je 0x14001790c
cmp eax, 0xc
je 0x140017901
cmp eax, 0x16
je 0x1400178f6
cmp eax, 0x22
je 0x1400178f6
cmp eax, 0x50
je 0x14001790c
mov ecx, 0x80004005
call fcn.14000e4f0
int3
mov ecx, 0x80070057
call fcn.14000e4f0
int3
mov ecx, 0x8007000e
call fcn.14000e4f0
int3
mov rax, qword [rdi + 0xb8]
mov dword [rax - 8], esi
mov rax, qword [rdi + 0xb8]
mov word [rax + rbp], r13w
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rsi, eax
mov edx, esi
lea rcx, [rdi + 0xc0]
call fcn.140011120
test eax, eax
je 0x1400179b8
lea rbp, [rsi + rsi]
lea edx, [rsi + 1]
movsxd rdx, edx
add rdx, rdx
mov r9, rbp
lea r8, [rsp + 0xf0]
mov rcx, qword [rdi + 0xc0]
call fcn.140024ea8
test eax, eax
je 0x1400179a2
cmp eax, 0xc
je 0x140017997
cmp eax, 0x16
je 0x14001798c
cmp eax, 0x22
je 0x14001798c
cmp eax, 0x50
je 0x1400179a2
mov ecx, 0x80004005
call fcn.14000e4f0
int3
mov ecx, 0x80070057
call fcn.14000e4f0
int3
mov ecx, 0x8007000e
call fcn.14000e4f0
int3
mov rax, qword [rdi + 0xc0]
mov dword [rax - 8], esi
mov rax, qword [rdi + 0xc0]
mov word [rax + rbp], r13w
mov byte [rdi + 0xc8], 0
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
mov r9, rdi
lea r8, [0x1400173e0]
xor edx, edx
xor ecx, ecx
call fcn.1400262d4
test rax, rax
je 0x1400179eb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x140017a6a
mov qword [rsp + 0x38], r13
lea r9, str..nrg_.bin_.ccd_.cue_.iso_.isz_.vcd_.ape_.flac_.wv_.mds_.mdf_.img_
mov r8d, 0x2793
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.1400158e0
mov rbx, qword [rsp + 0x38]
test eax, eax
je 0x140017a37
xor r9d, r9d
lea r8, [rsp + 0xf0]
mov rdx, rbx
mov rcx, rdi
call fcn.140017410
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x140017a6a
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rsp + 0xf0]
lea rdx, [0x140045038]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
jmp 0x140017a6c
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.140025960
mov rbx, qword [rsp + 0x358]
add rsp, 0x320
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret