Function at 0x140063de0
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Set current directory

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1710
call fcn.1400e19f0
sub rsp, rax
lea rbp, [rsp + 0x60]
mov rsi, rcx
mov qword [rbp + 0x1700], rbx
mov rcx, qword [rbp + 0x1720]
lea rax, [rbp + 0xc0]
test rcx, rcx
mov rdi, r9
mov r13, r8
mov rbx, rdx
cmovne rax, rcx
xor r14d, r14d
mov qword [rbp + 0x20], rax
mov qword [rax], r14
test rdx, rdx
je 0x140064488
cmp word [rdx], r14w
je 0x140064488
test r9, r9
je 0x140063ea6
cmp word [r9], r14w
je 0x140063e9f
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140063e69
test al, 0x10
jne 0x140063ea6
cmp byte [rbp + 0x1710], r14b
je 0x140063e97
mov qword [rsp + 0x28], r14
lea rdx, str.Parameter_2_invalid.
mov r9d, 9
mov qword [rsp + 0x20], r14
mov r8, rdi
mov rcx, rsi
call fcn.14000fec0
mov r14d, eax
mov eax, r14d
jmp 0x14006448d
mov qword [rbp + 0x1708], r14
mov qword [rbp + 0x18], r14
mov r10, r14
mov qword [rbp + 8], rbx
mov r9, rbx
mov qword [rbp + 0x10], r14
mov eax, SafeArrayAllocDescriptor
movabs r11, 0xffffffffffffff0
test r13, r13
je 0x140063f61
lea rdx, str.find
mov rcx, rbx
call fcn.1400c8244
test eax, eax
je 0x140063f4e
lea rdx, str.explore
mov rcx, rbx
call fcn.1400c8244
test eax, eax
je 0x140063f4e
lea rdx, str.open
mov rcx, rbx
call fcn.1400c8244
test eax, eax
je 0x140063f4e
lea rdx, [0x1401058b8]
mov rcx, rbx
call fcn.1400c8244
test eax, eax
je 0x140063f4e
lea rdx, str.print
mov rcx, rbx
call fcn.1400c8244
test eax, eax
je 0x140063f4e
lea rdx, str.properties
mov rcx, rbx
call fcn.1400c8244
test eax, eax
je 0x140063f4e
mov qword [rbp + 0x10], r13
mov r10, r14
jmp 0x140064094
mov r10, rbx
mov qword [rbp + 0x18], rbx
mov r9, r13
mov qword [rbp + 8], r13
jmp 0x140064097
movzx edx, word [rbx]
mov r8, rbx
test dx, dx
je 0x140064097
lea rcx, [0x14010ad94]
cmp dx, ax
je 0x140063fa2
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x140063f77
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
je 0x140064097
mov eax, SafeArrayAllocDescriptor
jmp 0x140063f70
test r8, r8
je 0x140064097
sub r8, rbx
sar r8, 1
lea rsi, [r8 + r8]
lea rax, [rsi + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140063fc5
mov rcx, r11
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400e19f0
sub rsp, rcx
mov r8, rsi
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1400e5b10
mov rdi, rax
mov word [rsi + rax], r14w
cmp word [rax], 0x2a
jne 0x140063ff8
lea r10, [rax + 2]
jmp 0x14006406d
lea rdx, str.find
mov rcx, rdi
call fcn.1400c8244
test eax, eax
je 0x14006406a
lea rdx, str.explore
mov rcx, rdi
call fcn.1400c8244
test eax, eax
je 0x14006406a
lea rdx, str.open
mov rcx, rdi
call fcn.1400c8244
test eax, eax
je 0x14006406a
lea rdx, [0x1401058b8]
mov rcx, rdi
call fcn.1400c8244
test eax, eax
je 0x14006406a
lea rdx, str.print
mov rcx, rdi
call fcn.1400c8244
test eax, eax
je 0x14006406a
lea rdx, str.properties
mov rcx, rdi
call fcn.1400c8244
test eax, eax
jne 0x14006408a
mov r10, rdi
mov qword [rbp + 0x18], r10
test r10, r10
je 0x14006408d
lea r9, [rbx + 2]
add r9, rsi
mov rsi, qword [rbp + 0x16f0]
mov qword [rbp + 8], r9
jmp 0x140064097
mov r10, r14
mov rsi, qword [rbp + 0x16f0]
mov r9, rbx
mov ecx, r14d
mov byte [rbp], r14b
cmp byte [rbp + 0x1730], r14b
je 0x140064120
mov rax, qword [rsi + 0x7b8]
test rax, rax
je 0x1400640b9
cmp qword [rax + 0x10], rcx
jne 0x1400640dd
mov rax, qword [rsi + 0x7d0]
test rax, rax
je 0x1400640cb
cmp qword [rax + 0x10], rcx
jne 0x1400640dd
mov rax, qword [rsi + 0x7e8]
test rax, rax
je 0x140064120
cmp qword [rax + 0x10], rcx
je 0x140064120
mov byte [rbp + 0x16f8], 1
test r10, r10
je 0x140064126
cmp byte [rbp + 0x1710], cl
je 0x140064910
mov qword [rsp + 0x28], r14
lea r8, [0x140104c70]
mov r9d, 9
mov qword [rsp + 0x20], r14
lea rdx, str.System_verbs_unsupported_with_RunAs.
mov rcx, rsi
call fcn.14000fec0
jmp 0x14006448d
mov byte [rbp + 0x16f8], cl
mov r12, 0xffffffffffffffff
mov rdi, r12
inc rdi
cmp word [r9 + rdi*2], cx
jne 0x140064130
cmp rdi, 0x4001
jb 0x14006417a
cmp byte [rbp + 0x1710], cl
je 0x140064910
mov qword [rsp + 0x28], r14
lea r8, [0x140104c70]
mov r9d, 9
mov qword [rsp + 0x20], r14
lea rdx, str.String_too_long.
mov rcx, rsi
call fcn.14000fec0
jmp 0x14006448d
mov rsi, qword [rbp + 0x1718]
mov r15d, 6
test r10, r10
jne 0x14006450c
xorps xmm0, xmm0
xor eax, eax
mov qword [rbp + 0x130], rax
mov eax, 1
movups xmmword [rbp + 0xd0], xmm0
mov dword [rbp + 0xd0], WSAGetLastError
movups xmmword [rbp + 0x100], xmm0
mov dword [rbp + 0x10c], eax
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
test rsi, rsi
je 0x14006424a
cmp word [rsi], cx
je 0x14006424a
lea rdx, [0x14010c3f0]
mov rcx, rsi
call fcn.1400c8244
test eax, eax
jne 0x140064205
movzx ecx, r15w
mov word [rbp + 0x110], cx
jmp 0x140064251
lea rdx, [0x14010b608]
mov rcx, rsi
call fcn.1400c8244
test eax, eax
jne 0x140064226
mov ecx, 3
mov word [rbp + 0x110], cx
jmp 0x140064251
lea rdx, str.Hide
mov rcx, rsi
call fcn.1400c8244
test eax, eax
mov ecx, 1
cmove cx, r14w
mov word [rbp + 0x110], cx
jmp 0x140064251
mov word [rbp + 0x110], ax
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x40], rax
movups xmmword [rbp + 0x30], xmm0
test r13, r13
je 0x1400642c4
cmp word [r13], ax
je 0x1400642c4
mov rax, r12
nop dword [rax]
inc rax
cmp word [r13 + rax*2], r14w
jne 0x140064270
add rax, rdi
lea rax, [rax*2 + 0x14]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140064299
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400e19f0
sub rsp, rcx
lea rdx, str.__s___s
mov r9, r13
mov r8, rbx
lea r15, [rsp + 0x60]
mov rcx, r15
call fcn.140006e40
jmp 0x140064310
lea rax, [rdi*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400642df
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400e19f0
sub rsp, rcx
lea r15, [rsp + 0x60]
mov rcx, r15
sub rcx, rbx
nop dword [rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x140064300
movzx ebx, byte [rbp + 0x16f8]
mov r13, qword [rbp + 0x1708]
test bl, bl
je 0x1400644a7
xorps xmm0, xmm0
xor eax, eax
mov qword [rbp + 0x1a0], rax
mov r11d, 1
movzx eax, word [rbp + 0x110]
movups xmmword [rbp + 0x140], xmm0
mov dword [rbp + 0x140], WSAGetLastError
movups xmmword [rbp + 0x170], xmm0
mov dword [rbp + 0x17c], r11d
movups xmmword [rbp + 0x180], xmm0
mov word [rbp + 0x180], ax
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x190], xmm0
test r13, r13
je 0x140064390
mov r9, r13
cmp word [r13], r14w
jne 0x140064393
mov r9, r14
mov r10, qword [rbp + 0x16f0]
lea rcx, [0x140104c70]
mov r8, rcx
mov rax, qword [r10 + 0x7d0]
test rax, rax
je 0x1400643ba
mov rax, qword [rax]
test rax, rax
cmovne r8, rax
mov rax, qword [r10 + 0x7e8]
mov rdx, rcx
test rax, rax
je 0x1400643d3
mov rax, qword [rax]
test rax, rax
cmovne rdx, rax
mov rax, qword [r10 + 0x7b8]
test rax, rax
je 0x1400643e9
mov rax, qword [rax]
test rax, rax
cmovne rcx, rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x140]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r9
mov r9d, r11d
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
je 0x140064447
mov rcx, qword [rbp + 0x38]
mov byte [rbp], 1
test rcx, rcx
je 0x140064437
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x30]
mov qword [rcx], rax
mov ecx, r14d
jmp 0x14006444f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp byte [rbp], r14b
je 0x14006451a
mov rcx, qword [rbp + 0x20]
cmp byte [rbp + 0x1728], r14b
je 0x140064471
mov rax, qword [0x140129398]
mov dword [rax + 0x64], r14d
cmp qword [rbp + 0x1720], r14
jne 0x140064488
mov rcx, qword [rcx]
test rcx, rcx
je 0x140064488
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rbp + 0x1700]
lea rsp, [rbp + 0x16b0]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [rbp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp + 0xd0]
mov rdx, r15
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140064504
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x1400644f4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x30]
mov qword [rcx], rax
jmp 0x14006445d
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140064522
mov r13, qword [rbp + 0x1708]
movzx ebx, byte [rbp + 0x16f8]
test bl, bl
jne 0x1400647cd
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x50], reloc.WSOCK32.dll_WSASetLastError
mov dword [rbp + 0x54], 0x440
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x78], r13
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
test rsi, rsi
je 0x1400645c9
cmp word [rsi], r14w
je 0x1400645c9
lea rdx, [0x14010c3f0]
mov rcx, rsi
call fcn.1400c8244
test eax, eax
jne 0x14006458a
mov ecx, 6
mov dword [rbp + 0x80], ecx
jmp 0x1400645d4
lea rdx, [0x14010b608]
mov rcx, rsi
call fcn.1400c8244
test eax, eax
jne 0x1400645aa
mov ecx, 3
mov dword [rbp + 0x80], ecx
jmp 0x1400645d4
lea rdx, str.Hide
mov rcx, rsi
call fcn.1400c8244
mov ecx, r14d
test eax, eax
setne cl
mov dword [rbp + 0x80], ecx
jmp 0x1400645d4
mov eax, 1
mov dword [rbp + 0x80], eax
mov rax, qword [rbp + 0x18]
test rax, rax
je 0x1400645f8
lea rdx, str.properties
mov qword [rbp + 0x60], rax
mov rcx, rax
call fcn.1400c8244
test eax, eax
jne 0x1400645f8
or dword [rbp + 0x54], 0xc
cmp qword [rbp + 0x10], r14
jne 0x140064785
lea rax, [rdi*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14006461d
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400e19f0
mov r15, qword [rbp + 8]
sub rsp, rcx
mov rcx, r15
lea rdi, [rsp + 0x60]
mov rdx, rdi
sub rdx, r15
nop
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140064640
cmp word [rdi], 0x22
jne 0x14006469c
mov edx, SafeArrayAllocDescriptor
lea rcx, [rdi + 2]
call fcn.1400c42b8
test rax, rax
je 0x14006469c
mov word [rax], r14w
lea r15, [rdi + 2]
movzx ecx, word [rax + 2]
test cx, cx
je 0x14006478f
movzx ebx, byte [rbp + 0x16f8]
lea rdi, [rax + 2]
cmp cx, 0x20
jne 0x14006479a
add rdi, 2
jmp 0x14006479a
test r13, r13
je 0x1400646aa
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edx, SafeArrayAllocDescriptor
lea rcx, [rdi + 2]
call fcn.1400c42b8
mov rsi, rax
test rax, rax
je 0x14006474e
lea rbx, [rsi - 2]
cmp rbx, rdi
jbe 0x1400646ed
nop dword [rax]
movzx edx, word [rbx]
lea rcx, [0x140110228]
call fcn.1400c42b8
test rax, rax
jne 0x1400646ed
sub rbx, 2
cmp rbx, rdi
ja 0x1400646d0
cmp word [rbx], 0x2e
jne 0x140064732
mov rax, rsi
mov word [rsi], r14w
sub rax, rbx
and rax, 0xfffffffffffffffe
cmp rax, 8
jne 0x14006471b
mov rdx, rbx
lea rcx, str..exe.bat.com.cmd.hta
call fcn.1400a5030
test rax, rax
jne 0x14006477c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x14006477c
mov eax, SafeArrayAllocDescriptor
mov word [rsi], ax
jmp 0x140064737
mov eax, SafeArrayAllocDescriptor
mov edx, eax
lea rcx, [rsi + 2]
call fcn.1400c42b8
mov rsi, rax
test rax, rax
jne 0x1400646c4
mov rdi, qword [rbp + 0x10]
test r13, r13
je 0x140064793
mov rax, qword [0x14012bd90]
lea rcx, [0x140104c70]
test rax, rax
je 0x140064774
mov rax, qword [rax]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x140064793
mov r15, rdi
lea rdi, [rsi + 2]
jmp 0x140064752
mov r15, qword [rbp + 8]
mov rdi, qword [rbp + 0x10]
jmp 0x14006479a
mov rdi, qword [rbp + 0x10]
movzx ebx, byte [rbp + 0x16f8]
lea rcx, [rbp + 0x50]
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x70], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1400647c3
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp + 0xb8]
mov qword [rcx], rax
jmp 0x14006445d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1400647d5
mov r15, qword [rbp + 8]
mov rdi, qword [rbp + 0x10]
cmp byte [rbp + 0x1728], r14b
je 0x1400647e8
mov rax, qword [0x140129398]
mov dword [rax + 0x64], ecx
cmp byte [rbp + 0x1710], r14b
je 0x140064910
mov qword [rsp + 0x30], r14
lea rax, [rbp + 0x2b0]
mov r8d, ecx
mov dword [rsp + 0x28], 0x1ff
mov ecx, 0x1200
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r9, qword [rbp + 0x18]
test r9, r9
je 0x140064844
lea r8, str._nVerb:___s_
mov edx, 0x80
lea rcx, [rbp + 0x1b0]
call fcn.1400a4cd0
jmp 0x14006484c
mov word [rbp + 0x1b0], r14w
lea rcx, [0x140104c70]
test rdi, rdi
mov rdx, rcx
mov rax, r12
cmovne rdx, rdi
inc rax
cmp word [rdx + rax*2], r14w
jne 0x140064860
cmp rax, 0x190
lea r9, [0x14010c3b0]
mov r8, rcx
cmova r8, r9
nop
inc r12
cmp word [r15 + r12*2], r14w
jne 0x140064880
mov qword [rsp + 0x40], r8
lea rax, str.Launch_Error__possibly_related_to_RunAs_:
mov qword [rsp + 0x38], rdx
lea r8, str._s_nAction:____0.400s_s__s_nParams:____0.400s_s_
cmp r12, 0x190
mov edx, 0x800
cmova rcx, r9
test bl, bl
lea r9, str.Failed_attempt_to_launch_program_or_document:
cmovne r9, rax
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x6b0]
mov qword [rsp + 0x20], r15
call fcn.1400a4cd0
mov rcx, qword [rbp + 0x16f0]
lea r8, [rbp + 0x2b0]
mov r9d, 9
mov qword [rsp + 0x28], r14
lea rdx, [rbp + 0x6b0]
mov qword [rsp + 0x20], r14
call fcn.14000fec0
jmp 0x14006448d
xor eax, eax
jmp 0x14006448d