Function at 0x1400448b0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov rsi, rdx
mov r14, rcx
cmp word [rdx], 0x48
jne 0x1400448e1
call fcn.140009170
jmp 0x140044b09
mov dword [rbp - 0x39], 0x68
xor edi, edi
mov qword [rbp - 0x31], rdi
xor edx, edx
lea r8d, [rdi + 0x58]
lea rcx, [rbp - 0x29]
call fcn.1400a8b00
mov qword [rbp - 0x59], rdi
xor eax, eax
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x49], rax
call fcn.1400450d0
mov rdx, rax
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
jne 0x14004492a
mov ecx, 0x80004005
call fcn.140044890
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp + 0x6f], rax
lea rdx, str.explorer__select_
test rdx, 0xffffffffffff0000
jne 0x14004496d
movzx ebx, dx
xor edx, edx
mov ecx, ebx
call fcn.1400447e0
test rax, rax
je 0x14004497d
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp + 0x6f]
call fcn.1400451c0
jmp 0x14004497d
mov r8d, reloc.COMCTL32.dll_InitCommonControls
lea rcx, [rbp + 0x6f]
call fcn.140045ab0
nop
mov r8, rsi
lea rdx, [rbp + 0x6f]
lea rcx, [rbp + 0x7f]
call fcn.1400445e0
nop
mov rdx, qword [rbp + 0x6f]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400449a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea rax, [rbp - 0x59]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x7f]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140044adc
call fcn.1400450d0
mov rcx, rax
test rax, rax
setne dil
test edi, edi
jne 0x140044a02
mov ecx, 0x80004005
call fcn.140044890
int3
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp + 0x77], rax
lea rdx, str.Explorer_could_not_open
test rdx, 0xffffffffffff0000
jne 0x140044a42
movzx edi, dx
xor edx, edx
mov ecx, edi
call fcn.1400447e0
test rax, rax
je 0x140044a52
mov r8d, edi
mov rdx, rax
lea rcx, [rbp + 0x77]
call fcn.1400451c0
jmp 0x140044a52
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetElement
lea rcx, [rbp + 0x77]
call fcn.140045ab0
nop
mov r8, rsi
lea rdx, [rbp + 0x77]
lea rcx, [rbp - 0x61]
call fcn.1400445e0
nop
lea r8, [0x1400da770]
mov rdx, rax
lea rcx, [rbp - 0x69]
call fcn.1400445e0
nop
mov rdx, qword [rbp - 0x61]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140044a90
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp + 0x77]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140044aa8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov r9d, gethostbyaddr
lea r8, [0x1400d25b0]
mov rdx, qword [rbp - 0x69]
mov rcx, r14
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [rbp - 0x69]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140044af1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x140044af1
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140044b09
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
add rsp, 0xf0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret