Function at 0x14000b5f0
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x14005f100]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rdi, rdx
mov ebx, ecx
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
cmp ebx, 1
jne 0x14000b882
lea rdx, [rbp + 0xc0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x14000bb06
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
lea rax, [rbp + 0xc0]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], r14b
jne 0x14000b680
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x30]
call fcn.140003a90
nop
mov r8d, 0xd
lea rdx, str.wallpaper.png
lea rcx, [rsp + 0x30]
call fcn.1400034c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000b71c
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b717
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bb45
call fcn.14000f790
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
lea rbx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rbx, qword [rbp - 0x80]
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x50]
call fcn.1400307d0
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.14000ca70
nop
cmp qword [rbp + 0x38], 0
je 0x14000b7a9
lea rcx, [rbp - 0x50]
call fcn.14000cd30
lea rcx, [rbp - 0x48]
call fcn.14000d390
test rax, rax
jne 0x14000b7a9
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
mov eax, 6
mov edx, 2
cmp qword [rbp + rcx - 8], 0
cmovne eax, edx
or eax, dword [rbp + rcx - 0x40]
and eax, 0x17
mov dword [rbp + rcx - 0x40], eax
and eax, dword [rbp + rcx - 0x3c]
jne 0x14000bb4b
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x50], rax
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x54], edx
lea rcx, [rbp - 0x48]
call fcn.14000c7a0
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x50], rax
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx - 0x54], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x58], rax
lea rcx, [rbp + 0x58]
call fcn.14000ec64
nop
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova r8, qword [rbp - 0x80]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14000bb06
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b878
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bb9d
call fcn.14000f790
jmp 0x14000bb06
mov rdx, qword [rdi + 8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], r14b
jne 0x14000b8a0
lea rcx, [rbp - 0x80]
call fcn.140003a90
lea rcx, [rbp - 0x80]
mov rbx, qword [rbp - 0x80]
mov rdi, qword [rbp - 0x68]
cmp rdi, 0xf
cmova rcx, rbx
mov r8, qword [rbp - 0x70]
cmp r8, 3
jne 0x14000b8e5
lea rdx, [0x140058298]
call fcn.1400306d0
test eax, eax
jne 0x14000b8e5
xor sil, sil
jmp 0x14000b8e8
mov sil, 1
cmp rdi, 0xf
jbe 0x14000b91f
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000b917
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bbca
mov rcx, rbx
call fcn.14000f790
test sil, sil
jne 0x14000bb06
mov ecx, 0x50
call fcn.14000f798
mov rbx, rax
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax], xmm0
lea rcx, [rax + 0x10]
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], r14
xor r8d, r8d
lea rdx, [0x14003d740]
call fcn.140003a90
nop
mov byte [rbx + 0x30], sil
mov qword [rbx + 0x38], r14
mov qword [rbx + 0x40], r14
mov qword [rbx + 0x48], r14
mov rcx, rbx
call fcn.1400026b0
mov ecx, 0x10
call fcn.14000f798
mov qword [rax], rbx
lea rcx, [0x140002a60]
mov qword [rax + 8], rcx
mov qword [rbp - 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x1400059c0]
xor edx, edx
xor ecx, ecx
call fcn.140015550
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000bb35
cmp dword [rbx + 8], 0
jne 0x14000bb2f
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmmword [rbx], xmm1
mov qword [0x1400621f0], rbx
cmp dword [rbx + 8], 0
je 0x14000bba3
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbx + 8], eax
je 0x14000bbae
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x30], xmm0
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14000ee1c
test eax, eax
jne 0x14000bbb9
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov rbx, qword [0x1400621f0]
test rbx, rbx
je 0x14000baeb
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x14000ba89
mov rdx, qword [rbx + 0x48]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14000ba78
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000bbca
mov rcx, r8
call fcn.14000f790
mov qword [rbx + 0x38], r14
mov qword [rbx + 0x40], r14
mov qword [rbx + 0x48], r14
mov rdx, qword [rbx + 0x28]
cmp rdx, 0xf
jbe 0x14000bac4
inc rdx
mov rcx, qword [rbx + 0x10]
cmp rdx, 0x1000
jb 0x14000babf
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000bbca
mov rcx, r8
call fcn.14000f790
mov qword [rbx + 0x20], r14
mov qword [rbx + 0x28], 0xf
mov byte [rbx + 0x10], 0
cmp dword [rbx + 8], 0
jne 0x14000bbc4
mov edx, 0x50
mov rcx, rbx
call fcn.14000f790
lea rdx, str.done
lea rcx, [0x140060be0]
call fcn.140003690
mov rcx, rax
call fcn.140003940
xor eax, eax
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14000f770
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140017714
nop
mov dword [rsp + 0x38], r14d
mov ecx, 6
call fcn.14000de10
nop
call fcn.140017af8
nop
test al, 4
je 0x14000bb58
lea rbx, str.ios_base::badbit_set
jmp 0x14000bb6c
test dl, al
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.140001510
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140001e40
lea rdx, [0x14005d930]
lea rcx, [rsp + 0x58]
call fcn.1400116b0
nop
call fcn.140017af8
int3
mov ecx, 1
call fcn.14000de10
int3
mov ecx, 5
call fcn.14000de10
int3
mov ecx, 2
call fcn.14000de10
int3
call fcn.140017714
int3
call fcn.140017af8
int3