Function at 0x140001000
Capabilities:
Create process on windows
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd68]
sub rsp, 0xe68
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0xd50], rax
xor r13d, r13d
mov qword [rbp + 0x80], 0x10001f
mov rdi, r8
mov qword [rsp + 0x70], r13
mov r14, rdx
mov qword [rbp - 0x38], r13
mov r12, rcx
mov qword [rbp + 0x50], r13
xor edx, edx
mov qword [rbp + 0x58], r13
mov r8d, 0x380
mov qword [rbp + 0x60], r13
lea rcx, [rbp + 0x170]
mov qword [rbp + 0x68], r13
mov r15d, r13d
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], r13
mov rbx, r9
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], r13
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xb0], r13
mov qword [rbp + 0xb8], r13
mov qword [rbp + 0xc0], r13
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], r13
mov qword [rbp + 0xe0], r13
mov qword [rbp + 0xe8], r13
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], r13
mov qword [rbp + 0x100], r13
mov qword [rbp + 0x108], r13
mov qword [rbp + 0x110], r13
mov qword [rbp + 0x118], r13
mov qword [rbp + 0x120], r13
mov qword [rbp + 0x128], r13
mov qword [rbp + 0x130], r13
mov qword [rbp + 0x138], r13
mov qword [rbp + 0x140], r13
mov qword [rbp + 0x148], r13
mov dword [rbp + 0x150], r13d
mov qword [rbp + 0x154], r13
mov qword [rbp + 0x15c], r13
mov qword [rbp + 0x164], r13
mov dword [rbp + 0x16c], r13d
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov qword [rbp + 0x4f0], r13
xor eax, eax
mov qword [rbp + 0x4f8], r13
xor edx, edx
mov qword [rbp + 0x40], rax
mov r8d, 0x208
mov qword [rbp + 0x500], r13
lea rcx, [rbp + 0x520]
mov qword [rbp + 0x508], r13
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp + 0x510], r13
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp + 0x518], r13
movups xmmword [rbp], xmm0
mov dword [rbp - 0x4c], r13d
movups xmmword [rbp + 0x10], xmm0
mov dword [rsp + 0x7c], r13d
movups xmmword [rbp + 0x20], xmm0
mov dword [rbp - 0x6c], r13d
movups xmmword [rbp + 0x30], xmm0
mov byte [rbp - 0x58], 1
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x40], r13
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x730]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x940]
mov r8d, 0x410
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
test r12, r12
je 0x140001746
test r14, r14
je 0x140001746
test rdi, rdi
je 0x140001746
test rbx, rbx
je 0x140001746
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
mov rsi, rax
test rax, rax
je 0x140001746
lea edx, [r13 + 0x5c]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
test rax, rax
je 0x14000124a
mov word [rax], r13w
lea rdx, [rbp + 0x520]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140001746
lea r9, [rbp + 0x730]
xor r8d, r8d
lea rdx, [0x140003300]
lea rcx, [rbp + 0x520]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x140001746
lea rax, [rbp + 0x940]
mov qword [rbp - 0x48], rax
lea rcx, [rbp + 0x940]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r13w
jne 0x1400012a3
add eax, eax
mov dword [rsp + 0x78], 0x30
mov ecx, 0xfffc
mov qword [rbp - 0x80], r13
cmp eax, ecx
mov dword [rbp - 0x70], 0x40
xorps xmm0, xmm0
lea r9, [rsp + 0x78]
cmova eax, ecx
lea rdx, [rsp + 0x60]
mov word [rbp - 0x50], ax
mov r8d, 0xc0110000
add ax, 2
mov ecx, 0x1ab98307
mov word [rbp - 0x4e], ax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x78], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
movdqu xmmword [rbp - 0x68], xmm0
call fcn.140001d90
test eax, eax
je 0x14000173f
mov qword [rsp + 0x50], r13
xor r9d, r9d
mov qword [rsp + 0x48], r13
xor r8d, r8d
mov qword [rsp + 0x40], r13
xor edx, edx
mov qword [rsp + 0x38], r13
xor ecx, ecx
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], 3
call qword [0x140005630]
test eax, eax
jne 0x14000173f
mov rdx, qword [rsp + 0x60]
lea r9, [rbp - 0x58]
lea r8, [rbp - 0x30]
mov qword [rsp + 0x20], 1
mov ecx, 0x7cd58168
call fcn.140001d90
test eax, eax
je 0x14000173f
mov qword [rsp + 0x50], r13
xor r9d, r9d
mov qword [rsp + 0x48], r13
xor r8d, r8d
mov qword [rsp + 0x40], r13
xor edx, edx
mov qword [rsp + 0x38], r13
xor ecx, ecx
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], 0xd
call qword [0x140005630]
test eax, eax
jne 0x14000173f
mov rdx, qword [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov ecx, 0xe84d69f9
call fcn.140001d90
test eax, eax
je 0x14000173f
mov qword [rsp + 0x50], r13
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], r13
xor r9d, r9d
mov qword [rsp + 0x40], r13
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x30], rdi
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], r14
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [0x140005630]
test eax, eax
jne 0x14000173f
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov r8d, 0xf001f
lea rdx, [rsp + 0x68]
mov ecx, 0x4a23a81b
call fcn.140001d90
test eax, eax
je 0x14000173f
mov rax, qword [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x50], r13
xor r8d, r8d
mov qword [rsp + 0x48], r13
xor edx, edx
mov qword [rsp + 0x40], r13
xor ecx, ecx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0x1000000
mov qword [rsp + 0x20], 2
call qword [0x140005630]
test eax, eax
jne 0x14000173f
cmp qword [rsp + 0x68], r13
je 0x140001746
mov rcx, qword [rsp + 0x60]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400014b4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x48], rbx
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rsi
xor r8d, r8d
mov qword [rsp + 0x30], r13
mov rdx, r12
mov dword [rsp + 0x28], 0x14
xor ecx, ecx
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140001702
mov r8, qword [rbx]
lea r9, [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov ecx, 0xc5d6775b
mov qword [rsp + 0x20], r13
call fcn.140001d90
test eax, eax
je 0x14000173f
mov qword [rsp + 0x50], r13
lea rax, [rbp - 0x38]
mov qword [rsp + 0x48], 2
xor r9d, r9d
mov qword [rsp + 0x40], r13
xor r8d, r8d
mov qword [rsp + 0x38], 2
xor edx, edx
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [0x140005630]
test eax, eax
jne 0x14000173f
movsxd rdi, dword [r14 + 0x3c]
cmp dword [rdi + r14], 0x4550
jne 0x140001702
mov rdx, qword [rbx + 8]
lea r8, [rbp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov ecx, 0xb2930066
call fcn.140001d90
test eax, eax
je 0x14000173f
mov qword [rsp + 0x50], r13
xor r9d, r9d
mov qword [rsp + 0x48], r13
xor r8d, r8d
mov qword [rsp + 0x40], r13
xor edx, edx
mov qword [rsp + 0x38], r13
xor ecx, ecx
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [0x140005630]
test eax, eax
jne 0x14000173f
mov eax, dword [rdi + r14 + 0x28]
lea r8, [rbp + 0x50]
add rax, qword [rsp + 0x70]
xor r9d, r9d
mov rdx, qword [rbx + 8]
mov ecx, 0x8085727f
mov qword [rbp + 0xd0], rax
mov qword [rsp + 0x20], r13
call fcn.140001d90
test eax, eax
je 0x14000173f
mov qword [rsp + 0x50], r13
xor r9d, r9d
mov qword [rsp + 0x48], r13
xor r8d, r8d
mov qword [rsp + 0x40], r13
xor edx, edx
mov qword [rsp + 0x38], r13
xor ecx, ecx
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [0x140005630]
test eax, eax
jne 0x14000173f
mov r8, qword [rbp + 0xd8]
lea r9, [rsp + 0x70]
mov rdx, qword [rbx]
add r8, 0x10
mov ecx, 0xfab864e6
mov qword [rsp + 0x20], 8
call fcn.140001d90
test eax, eax
je 0x14000173f
mov qword [rsp + 0x50], r13
xor r9d, r9d
mov qword [rsp + 0x48], r13
xor r8d, r8d
mov qword [rsp + 0x40], r13
xor edx, edx
mov qword [rsp + 0x38], r13
xor ecx, ecx
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [0x140005630]
test eax, eax
jne 0x14000173f
mov rdx, qword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov ecx, 0x14a0cc11
call fcn.140001d90
test eax, eax
je 0x14000173f
mov qword [rsp + 0x50], r13
xor r9d, r9d
mov qword [rsp + 0x48], r13
xor r8d, r8d
mov qword [rsp + 0x40], r13
xor edx, edx
mov qword [rsp + 0x38], r13
xor ecx, ecx
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [0x140005630]
test eax, eax
jne 0x14000173f
lea r15d, [rax + 1]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x60]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001725
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x60], r13
mov rcx, qword [rsp + 0x68]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x14000173a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r15d
jmp 0x140001748
mov eax, 0xffffffff
jmp 0x140001748
xor eax, eax
mov rcx, qword [rbp + 0xd50]
xor rcx, rsp
call fcn.1400021a0
add rsp, 0xe68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret