Function at 0x1401cb930
Capabilities:
Create process on windows
Get common file path
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x3a8]
sub rsp, 0x490
mov rax, qword [0x140279780]
xor rax, rsp
mov qword [rbp + 0x380], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov r13d, 1
test eax, eax
jne 0x1401cb9cd
lea rdx, [rbp + 0x50]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rbp + 0x50]
sub rcx, r13
add rcx, r13
cmp byte [rcx], 0
jne 0x1401cb9ae
movsd xmm0, qword [str.Microsoft_]
movsd qword [rcx], xmm0
mov eax, dword [0x14023cb10]
mov dword [rcx + 8], eax
jmp 0x1401cb9d4
mov dword [rbp + 0x50], 0x5c3a43
xor ecx, ecx
mov al, byte [rbp + rcx + 0x50]
mov byte [rbp + rcx + 0x160], al
add rcx, r13
test al, al
jne 0x1401cb9d6
lea rcx, [rbp + 0x160]
sub rcx, r13
add rcx, r13
cmp byte [rcx], 0
jne 0x1401cb9f2
movsd xmm0, qword [str.MSYMDCOM2.dat]
movsd qword [rcx], xmm0
mov eax, dword [0x14023cb20]
mov dword [rcx + 8], eax
movzx eax, word [0x14023cb24]
mov word [rcx + 0xc], ax
lea rdx, [0x14023cb28]
lea rcx, [rbp + 0x160]
call fcn.1401ac480
mov rsi, rax
mov r15d, 2
test rax, rax
je 0x1401cbbe0
mov r8d, r15d
xor edx, edx
mov rcx, rax
call fcn.1401ac694
mov rcx, rsi
call fcn.1401acb90
movsxd rbx, eax
mov rcx, rsi
call fcn.1401acb98
mov r14, rbx
lea rcx, [rbx + 1]
call fcn.1401acc5c
mov rdi, rax
mov r9, rsi
mov r8, rbx
mov rdx, r13
mov rcx, rax
call fcn.1401acef4
mov rcx, rsi
call fcn.1401ad040
movabs rax, 0x4150643973773741
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [str.QAZWSXEDCRFVTGBYHNUJMIKOLPqwertyuiop_asdfghjklzxcvbnm]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [0x14023ca80]
movups xmmword [rsp + 0x68], xmm1
movups xmm0, xmmword [0x14023ca90]
movups xmmword [rsp + 0x78], xmm0
mov eax, dword [0x14023caa0]
mov dword [rbp - 0x78], eax
mov al, byte [0x14023caa4]
mov byte [rbp - 0x74], al
movups xmm0, xmmword [str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNO_PQRSTUVWXYZ]
movups xmmword [rbp - 0x73], xmm0
movups xmm1, xmmword [0x14023cab8]
movups xmmword [rbp - 0x63], xmm1
movups xmm0, xmmword [0x14023cac8]
movups xmmword [rbp - 0x53], xmm0
mov eax, dword [0x14023cad8]
mov dword [rbp - 0x43], eax
mov al, byte [0x14023cadc]
mov byte [rbp - 0x3f], al
xor r8d, r8d
sub ebx, r13d
js 0x1401cbb30
mov rdx, rdi
mov eax, r8d
and eax, 0x80000007
jge 0x1401cbb1d
sub eax, r13d
or eax, 0xfffffff8
add eax, r13d
cdqe
mov cl, byte [rsp + rax + 0x50]
xor byte [rdx], cl
add r8d, r13d
add rdx, r13
cmp r8d, ebx
jle 0x1401cbb0a
mov byte [r14 + rdi], 0
mov rcx, rdi
call fcn.1401addf4
test eax, eax
je 0x1401cbbe0
lea ebx, [rax + 0x1e28500]
xor ecx, ecx
call fcn.1401adeb8
cmp eax, ebx
jl 0x1401cbbe0
cmp dword [0x140286bd0], 0
jne 0x1401cbc3f
xor r9d, r9d
mov r8, qword [0x1402ab660]
lea rdx, str.Your_1_year_Pro_License_has_expired._Please_buy_a_new_one._We_will_open_the_renew_page_for_you_in_browser.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea r8, str._renew.html
lea rdx, [0x1402ab648]
lea rcx, [rsp + 0x40]
call fcn.140002d2c
mov dword [rsp + 0x28], r13d
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rax]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, r13d
jg 0x1401cbbd7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [0x140286bd0], r13d
jmp 0x1401cbc3f
xor ecx, ecx
mov al, byte [rbp + rcx + 0x50]
mov byte [rbp + rcx + 0x270], al
add rcx, r13
test al, al
jne 0x1401cbbe2
lea rcx, [rbp + 0x270]
sub rcx, r13
add rcx, r13
cmp byte [rcx], 0
jne 0x1401cbbfe
movsd xmm0, qword [str.MSYMDCOM.dat]
movsd qword [rcx], xmm0
mov eax, dword [0x14023cbc0]
mov dword [rcx + 8], eax
mov al, byte [0x14023cbc4]
mov byte [rcx + 0xc], al
lea rdx, [0x14023cb28]
lea rcx, [rbp + 0x270]
call fcn.1401ac480
mov rsi, rax
test rax, rax
jne 0x1401cbc46
xor eax, eax
jmp 0x1401cbd9a
mov r8d, r15d
xor edx, edx
mov rcx, rsi
call fcn.1401ac694
mov rcx, rsi
call fcn.1401acb90
movsxd r15, eax
mov rcx, rsi
call fcn.1401acb98
lea rcx, [r15 + 1]
call fcn.1401acc5c
mov rdi, rax
mov r9, rsi
mov r8, r15
mov rdx, r13
mov rcx, rax
call fcn.1401acef4
mov rbx, rax
mov rcx, rsi
call fcn.1401ad040
cmp rbx, r15
je 0x1401cbc9d
mov rcx, rdi
call fcn.1401adef8
jmp 0x1401cbc3f
movabs rax, 0x4150643973773741
mov qword [rbp - 0x30], rax
movups xmm0, xmmword [str.QAZWSXEDCRFVTGBYHNUJMIKOLPqwertyuiop_asdfghjklzxcvbnm]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [0x14023ca80]
movups xmmword [rbp - 0x18], xmm1
movups xmm0, xmmword [0x14023ca90]
movups xmmword [rbp - 8], xmm0
mov eax, dword [0x14023caa0]
mov dword [rbp + 8], eax
mov al, byte [0x14023caa4]
mov byte [rbp + 0xc], al
movups xmm0, xmmword [str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNO_PQRSTUVWXYZ]
movups xmmword [rbp + 0xd], xmm0
movups xmm1, xmmword [0x14023cab8]
movups xmmword [rbp + 0x1d], xmm1
movups xmm0, xmmword [0x14023cac8]
movups xmmword [rbp + 0x2d], xmm0
mov eax, dword [0x14023cad8]
mov dword [rbp + 0x3d], eax
mov al, byte [0x14023cadc]
mov byte [rbp + 0x41], al
lea r9d, [r15 - 1]
xor r8d, r8d
test r9d, r9d
js 0x1401cbd46
mov rdx, rdi
mov eax, r8d
and eax, 0x80000007
jge 0x1401cbd33
sub eax, r13d
or eax, 0xfffffff8
add eax, r13d
cdqe
mov cl, byte [rbp + rax - 0x30]
xor byte [rdx], cl
add r8d, r13d
add rdx, r13
cmp r8d, r9d
jle 0x1401cbd20
mov byte [r15 + rdi], 0
lea rcx, [rsp + 0x38]
call fcn.1401cbddc
nop
test rdi, rdi
je 0x1401cbdca
mov rdx, rdi
mov rcx, qword [rsp + 0x38]
call fcn.1401aed30
xor ebx, ebx
test eax, eax
sete bl
mov rcx, rdi
call fcn.1401adef8
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1401cbd98
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.140197130
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 0x80004005
call fcn.140003930
int3