Function at 0x489f10
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov r11, rsp
sub rsp, 0x9d8
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x980], rax
test rcx, rcx
mov qword [r11 - 8], rbx
mov qword [r11 - 0x40], r15
mov r15d, edx
mov rbx, rcx
je 0x48a320
lea r8, [rsp + 0x54]
lea rdx, [0x004d5d88]
call fcn.00493c10
cmp eax, 0xffffffff
je 0x48a320
mov edx, 2
mov ecx, 0x104
mov qword [rsp + 0x9b8], rdi
call fcn.00499470
test rax, rax
mov rdi, rax
je 0x48a31c
lea r9, [0x004e00f4]
mov r8, rbx
mov edx, 0x104
mov rcx, rax
call fcn.00489820
test eax, eax
je 0x48a314
mov qword [rsp + 0x9a8], r13
mov ebx, 1
mov dx, 0x2e
mov rcx, rdi
mov qword [rsp + 0x9a0], r14
lea r13, [rsp + 0x160]
mov dword [rsp + 0x50], ebx
xor r14d, r14d
call fcn.00493ae0
test rax, rax
je 0x48a032
lea rdx, str..lnk
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x48a032
mov dword [rsp + 0x40], ebx
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x160]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x370]
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x28], rax
mov r8d, 0x200
mov rdx, rdi
mov rcx, rdi
mov dword [rsp + 0x20], 0x104
call fcn.00489580
test eax, eax
cmovne r14d, ebx
mov qword [rsp + 0x9c8], rbp
mov qword [rsp + 0x9c0], rsi
mov dx, SafeArrayAllocDescriptor
mov rcx, rdi
mov qword [rsp + 0x9b0], r12
xor esi, esi
call fcn.00493ae0
lea r8, [rsp + 0x580]
test rax, rax
mov r12, rax
je 0x48a0ca
xor edx, edx
mov rcx, rdi
cmp word [rdi], dx
je 0x48a09f
test bl, dl
jne 0x48a07c
cmp word [rcx], 0x20
je 0x48a09c
movzx eax, word [rcx]
cmp ax, 0x22
jne 0x48a089
add edx, ebx
jmp 0x48a091
mov word [r8], ax
add r8, 2
add rcx, 2
cmp word [rcx], si
jne 0x48a072
jmp 0x48a09f
mov rsi, rcx
test rsi, rsi
mov word [r8], 0
lea rbp, [rsp + 0x580]
je 0x48a0cd
mov dx, 0x5c
mov rcx, rdi
mov word [rsi], 0
call fcn.00493ab0
mov word [rsi], SafeArrayAllocDescriptor
jmp 0x48a0d9
mov rbp, rdi
mov dx, 0x5c
mov rcx, rdi
call fcn.00493ab0
test rax, rax
je 0x48a13c
test r12, r12
je 0x48a115
cmp r12, rax
jae 0x48a115
sub rax, r12
lea rdx, [r12 + 2]
lea rcx, [rsp + 0x160]
sub rax, 2
sar rax, 1
mov r8d, eax
mov ebx, eax
call fcn.00493d90
mov word [rsp + rbx*2 + 0x160], 0
jmp 0x48a162
sub rax, rdi
lea rcx, [rsp + 0x160]
mov rdx, rdi
sar rax, 1
mov r8d, eax
mov ebx, eax
call fcn.00493d90
mov word [rsp + rbx*2 + 0x160], 0
jmp 0x48a162
lea rdx, [rsp + 0x160]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x48a15f
mov word [rsp + 0x166], 0
jmp 0x48a162
xor r13d, r13d
test rsi, rsi
je 0x48a16d
lea rbx, [rsi + 2]
jmp 0x48a16f
xor ebx, ebx
xor edx, edx
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 0x70]
call fcn.00491ae0
lea rax, str.open
lea rcx, [rsp + 0x60]
xor r12d, r12d
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], 0x70
mov dword [rsp + 0x64], 0x440
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x88], r13
mov dword [rsp + 0x90], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rbp, qword [rsp + 0x9c8]
test eax, eax
mov esi, eax
je 0x48a1e9
mov rbx, qword [rsp + 0xc8]
jmp 0x48a295
xor edx, edx
lea rcx, [rsp + 0xf0]
lea r8d, [rdx + 0x68]
call fcn.00491ae0
test r14d, r14d
mov dword [rsp + 0xf0], 0x68
je 0x48a221
movzx eax, word [rsp + 0x50]
or dword [rsp + 0x12c], 1
mov word [rsp + 0x130], ax
lea rdx, [rsp + 0x160]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x48a243
mov word [rsp + 0x166], r12w
jmp 0x48a246
mov r13, r12
lea rax, [rsp + 0xd0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xf0]
mov rdx, rdi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r12
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rbx, qword [rsp + 0xd0]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbx, rbx
mov r14, qword [rsp + 0x9a0]
mov r13, qword [rsp + 0x9a8]
mov r12, qword [rsp + 0x9b0]
je 0x48a2d2
test r15d, r15d
je 0x48a2c9
test esi, esi
je 0x48a2c9
mov edx, 0x1388
mov rcx, rbx
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.00494180
mov eax, esi
mov rsi, qword [rsp + 0x9c0]
mov rdi, qword [rsp + 0x9b8]
mov r15, qword [rsp + 0x998]
mov rbx, qword [rsp + 0x9d0]
mov rcx, qword [rsp + 0x980]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x9d8
ret
mov rcx, rdi
call fcn.00494180
xor eax, eax
jmp 0x48a2e4
xor eax, eax
jmp 0x48a2ec