Function at 0x406f24
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x88
mov rax, qword [0x0040f278]
mov qword [rsp + 0x78], rax
mov ecx, 0x46
call fcn.00404ab0
mov ecx, 0x47
mov rdi, rax
call fcn.00404ab0
mov rbx, rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov r9d, 0x40023
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40715a
call fcn.004069bc
mov r11, qword [section..data]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], r11
mov byte [rsp + 0x48], 0x3f
mov byte [rsp + 0x49], 0x73
mov byte [rsp + 0x4a], 0x65
mov byte [rsp + 0x4b], 0x69
mov byte [rsp + 0x4c], 0x74
mov byte [rsp + 0x4d], 0x65
mov byte [rsp + 0x4e], 0x3d
mov byte [rsp + 0x4f], 0x4d
mov byte [rsp + 0x50], 0x69
mov byte [rsp + 0x51], 0x63
mov byte [rsp + 0x52], 0x72
mov byte [rsp + 0x53], 0x6f
mov byte [rsp + 0x54], 0x73
mov byte [rsp + 0x55], 0x6f
mov byte [rsp + 0x56], 0x66
mov byte [rsp + 0x57], 0x74
mov byte [rsp + 0x58], 0x2f
mov byte [rsp + 0x59], 0x49
mov byte [rsp + 0x5a], 0x73
mov byte [rsp + 0x5b], 0x4d
mov byte [rsp + 0x5c], 0x79
mov byte [rsp + 0x5d], 0x54
mov byte [rsp + 0x5e], 0x6f
mov byte [rsp + 0x5f], 0x75
mov byte [rsp + 0x60], 0x63
mov byte [rsp + 0x61], 0x68
mov byte [rsp + 0x62], 0x53
mov byte [rsp + 0x63], 0x63
mov byte [rsp + 0x64], 0x72
mov byte [rsp + 0x65], 0x65
mov byte [rsp + 0x66], 0x65
mov byte [rsp + 0x67], 0x6e
mov byte [rsp + 0x68], 0x4f
mov byte [rsp + 0x69], 0x4b
mov byte [rsp + 0x6a], 0x2f
mov byte [rsp + 0x6b], 0x55
mov byte [rsp + 0x6c], 0x6e
mov byte [rsp + 0x6d], 0x69
mov byte [rsp + 0x6e], 0x6e
mov byte [rsp + 0x6f], 0x73
mov byte [rsp + 0x70], 0x74
mov byte [rsp + 0x71], 0x61
mov byte [rsp + 0x72], 0x6c
mov byte [rsp + 0x73], 0x6c
mov byte [rsp + 0x74], 0
call fcn.004027b0
lea rcx, [rsp + 0x40]
call fcn.00406d50
mov rcx, qword [section..data]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rax]
mov rax, qword [rsp + 0x30]
mov edx, dword [rcx - 8]
mov r9d, dword [rax - 8]
mov r8, rcx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call fcn.00401690
mov rbx, qword [rsp + 0x38]
mov rcx, qword [0x005b3c88]
lea rdx, str.open
mov r8, rbx
xor r9d, r9d
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbx - 0xc]
mov ebx, 0xffffffff
cmp rcx, qword [0x0040f008]
je 0x407103
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x407103
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x0040f008]
je 0x40712f
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x40712f
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff4
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov rcx, qword [rsp + 0x30]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x0040f008]
je 0x40715a
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x40715a
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x78]
call fcn.0040b190
add rsp, 0x88
pop rdi
pop rbx
ret