Function at 0x1400763c0
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov byte [rax + 0x10], dl
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov r12, rcx
mov r13b, r8b
mov edi, 0x68
lea rcx, [rbp - 0x20]
xor edx, edx
mov r8d, edi
movaps xmmword [rax - 0x48], xmm6
mov rbx, r9
call fcn.140014ac0
xor esi, esi
lea eax, [rdi - 0x67]
mov dword [rbp - 0x20], edi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x58], rsi
mov dword [rbp + 0xb0], esi
mov dword [rbp + 0x1c], eax
mov word [rbp + 0x20], ax
mov edi, esi
mov r15d, esi
test r13b, r13b
je 0x140076462
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
call fcn.14000eed0
cmp qword [rbx + 0x10], 7
mov dword [rbp + 0xb0], eax
jbe 0x140076494
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x38]
call fcn.14000eed0
mov edi, eax
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x38]
jmp 0x140076480
cmp qword [rbx + 0x10], 3
jbe 0x1400764aa
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
call fcn.14000eed0
mov edi, eax
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
and edi, 0xffff0000
call fcn.14000eed0
movzx r15d, ax
test r13b, r13b
je 0x1400764aa
cmp qword [rbx + 0x10], 6
jbe 0x1400764a5
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x30]
jmp 0x1400764b9
test r13b, r13b
jne 0x1400764c2
cmp qword [rbx + 0x10], 2
jbe 0x1400764c2
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x10]
call fcn.14000eed0
mov word [rbp + 0x20], ax
mov eax, reloc.WSOCK32.dll_recv
bt edi, 0x10
mov r14d, esi
cmovb r14d, eax
mov rax, qword [rbx + 8]
mov rcx, qword [rax]
call fcn.14005f6d0
mov rcx, rax
call fcn.140013110
test r13b, r13b
je 0x1400765b4
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x60], rax
mov rcx, qword [rcx + 8]
call fcn.14005f6d0
mov rcx, rax
call fcn.140013110
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x68], rax
call fcn.14005f6d0
mov rcx, rax
call fcn.140013110
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x20]
mov qword [rsp + 0x58], rax
call fcn.14005f6d0
mov rcx, rax
call fcn.140013110
cmp qword [rbx + 0x10], 5
mov rdi, rax
mov qword [rsp + 0x50], rax
jbe 0x14007657a
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x28]
call fcn.14005f6d0
mov rcx, rax
call fcn.140013110
mov rsi, rax
test rax, rax
je 0x14007657a
mov rcx, rax
call fcn.140014a44
test rax, rax
jne 0x14007662e
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rcx, 0xffffffffffffffff
lea edx, [rax + 1]
mov edi, eax
mov eax, 2
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.140014c1c
mov edx, edi
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x140076629
mov rdi, rax
mov qword [rsp + 0x50], rax
mov eax, 1
cmp qword [rbx + 0x10], rax
jbe 0x1400765f1
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 8]
call fcn.14005f6d0
mov rcx, rax
call fcn.140013110
mov rsi, rax
test rax, rax
je 0x1400765f1
mov rcx, rax
call fcn.140014a44
test rax, rax
jne 0x14007666e
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, 0xffffffffffffffff
lea edx, [rax + 1]
mov edi, eax
mov eax, 2
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.140014c1c
mov ecx, edi
mov rdx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rdi, qword [rsp + 0x50]
test r13b, r13b
je 0x14007666e
mov rcx, qword [rbx + 8]
lea rdx, [0x140097d60]
mov rcx, qword [rcx]
call fcn.140010b80
mov rcx, qword [rbx + 8]
lea rdx, [0x140097d60]
mov rcx, qword [rcx + 8]
call fcn.140010b80
mov rcx, qword [rbx + 8]
lea rdx, [0x140097d60]
mov rcx, qword [rcx + 0x10]
call fcn.140010b80
lea rcx, [rbp - 0x70]
mov edx, r15d
call fcn.140039c70
test r15d, r15d
je 0x1400766e3
lea rcx, [rbp - 0x70]
call fcn.14004cd10
mov ecx, 1
or rbx, 0xffffffffffffffff
lea r15d, [rcx - 1]
movzx edi, cl
cmp rax, rbx
lea rcx, [rbp - 0x70]
cmove edi, r15d
mov qword [rbp + 0x38], rax
call fcn.14004ccb0
lea rcx, [rbp - 0x70]
cmp rax, rbx
mov qword [rbp + 0x40], rax
cmove edi, r15d
call fcn.14004cca0
or rcx, 0xffffffffffffffff
movzx ebx, dil
mov rdi, qword [rsp + 0x50]
cmp rax, rcx
cmove ebx, r15d
mov qword [rbp + 0x30], rax
test bl, bl
je 0x1400766e9
bts dword [rbp + 0x1c], 8
jmp 0x1400766e9
xor r15d, r15d
mov bl, r15b
test r13b, r13b
je 0x140076794
mov r15, qword [rsp + 0x68]
mov r9d, dword [rbp + 0xb0]
mov r8, qword [rsp + 0x58]
lea rax, [rsp + 0x70]
mov rdx, r15
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], r14d
mov r14, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdi
mov rcx, r14
call fcn.1400615a0
mov rcx, r14
mov r13b, al
call fcn.140014a44
mov rdi, r14
mov rcx, rax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, r15
call fcn.140014a44
mov rdi, r15
mov rcx, rax
xor eax, eax
rep stosb byte [rdi], al
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
call fcn.140014a44
mov rcx, rax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, r14
call fcn.14001460c
mov rcx, r15
call fcn.14001460c
mov rcx, qword [rsp + 0x58]
call fcn.14001460c
mov rdi, qword [rsp + 0x50]
xor r15d, r15d
jmp 0x1400767d4
lea rcx, [rsp + 0x70]
movzx eax, bl
xor r9d, r9d
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x20]
xor r8d, r8d
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r15
mov rdx, rdi
xor ecx, ecx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne r13b
mov rcx, rdi
call fcn.14001460c
mov rcx, rsi
call fcn.14001460c
test r13b, r13b
jne 0x140076837
mov rax, qword [r12]
xor r8d, r8d
movsxd rcx, dword [rax + 4]
lea ebx, [r8 + 1]
add rcx, r12
mov edx, ebx
call fcn.1400032e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r8d, r8d
mov edx, eax
mov rax, qword [r12]
movsxd rcx, dword [rax + 4]
add rcx, r12
call fcn.140003330
mov rdi, qword [rbp + 0xc0]
mov rcx, rdi
call fcn.140009a80
mov dword [rdi + 8], ebx
mov dword [rdi], r15d
jmp 0x1400768b8
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14007686f
lea rcx, [rbp - 0x70]
call fcn.14004cc20
mov edx, dword [rbp - 0x80]
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x6c], edx
call fcn.1400564f0
lea rcx, [r12 + 0x7d8]
lea rdx, [rbp - 0x70]
call fcn.140054f30
cmp byte [rbp + 0xa8], r15b
je 0x140076887
mov rax, qword [rsp + 0x70]
mov qword [r12 + 0x7a8], rax
jmp 0x1400768b8
mov eax, dword [rbp - 0x80]
mov rdi, qword [rbp + 0xc0]
pxor xmm6, xmm6
mov rcx, rdi
cvtsi2sd xmm6, rax
call fcn.140009a80
mov rcx, qword [rsp + 0x70]
movsd qword [rdi], xmm6
mov dword [rdi + 8], 3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x70]
call fcn.1400565e0
lea r11, [rsp + 0x160]
xor eax, eax
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret