Function at 0x140005474
Capabilities:
Create process on windows
Enumerate gui resources
Find taskbar
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x5c0
xor esi, esi
mov r12d, 0x104
lea rcx, [rax - 0x337]
mov qword [rax - 0x550], rsi
mov r8, r12
xor edx, edx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov qword [rax - 0x558], rsi
mov dword [rax + 8], esi
mov byte [rax - 0x338], sil
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x191]
mov r8, r12
xor edx, edx
mov byte [rsp + 0x190], sil
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x2a0]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, str.Explorer.exe
call sub.msvcrt.dll_strlen
lea rcx, [rsp + 0x2a0]
mov rbx, rax
call sub.msvcrt.dll_strlen
lea rcx, [rbx + rax + 1]
cmp rcx, r12
jae 0x140005535
lea r8, [rsp + 0x190]
lea rdx, str.Explorer.exe
lea rcx, [rsp + 0x2a0]
call fcn.1400028d8
jmp 0x14000553d
mov byte [rsp + 0x190], sil
call fcn.140002848
xor edx, edx
cmp dword [rax + 4], 6
jb 0x140005789
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowA]
cmp rax, rsi
mov rbx, rax
je 0x140005855
lea rdx, [rsp + 0x5e0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x5e0]
cmp r8d, esi
je 0x140005855
xor edx, edx
mov ecx, 0x400
mov qword [rsp + 0x5e8], rsi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, rsi
mov rdi, rax
je 0x14000562f
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x5f0], rsi
call fcn.140001000
mov rax, qword [rsp + 0x70]
cmp rax, rsi
je 0x1400055da
lea r8, [rsp + 0x5f0]
mov edx, 2
mov rcx, rdi
call rax
jmp 0x1400055dc
mov eax, esi
cmp eax, esi
je 0x140005626
mov rdx, qword [rsp + 0x5f0]
lea rax, [rsp + 0x5e8]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov r8d, 0x2000000
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 2
call fcn.14000107c
mov rcx, qword [rsp + 0x5f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x5e8], rsi
je 0x140005842
xor r9d, r9d
xor r8d, r8d
mov edx, 0x5b4
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [rsp + 0x5e0]
call fcn.1400053d0
call fcn.140002848
cmp dword [rax + 4], 0xa
jb 0x140005690
mov eax, dword [rsp + 0x5e0]
lea rcx, [0x14000541c]
xor edx, edx
mov dword [0x14001c6a4], eax
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [rsp + 0x5e0]
call fcn.1400053d0
mov edi, 0x60
lea rcx, [rsp + 0x128]
xor edx, edx
mov r8, rdi
call sub.msvcrt.dll_memset
xor eax, eax
lea rcx, [rsp + 0x3b2]
xor edx, edx
mov r8d, 0x208
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x120], 0x68
mov word [rsp + 0x3b0], si
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x3b0]
lea r8, [rsp + 0x190]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rbx, qword [rsp + 0x5e8]
lea rcx, [rsp + 0x68]
call fcn.140001000
mov r11, qword [rsp + 0x68]
cmp r11, rsi
je 0x14000576c
lea rax, [rsp + 0x90]
lea r9, [rsp + 0x3b0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x120]
xor edx, edx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call r11
mov ebx, eax
jmp 0x14000576e
mov ebx, esi
mov rcx, qword [rsp + 0x5e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, esi
jne 0x140005842
mov r8, rdi
jmp 0x1400057d8
lea rcx, str.Progman
call qword [sym.imp.USER32.dll_FindWindowA]
cmp rax, rsi
mov rbx, rax
je 0x140005855
lea rdx, [rsp + 0x5e0]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [rsp + 0x5e0]
call fcn.1400053d0
mov r8d, 0x60
lea rcx, [rsp + 0xb8]
xor edx, edx
call sub.msvcrt.dll_memset
xor eax, eax
lea rdx, [rsp + 0x190]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb0]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0xb0], 0x68
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x88]
cmp rcx, rsi
je 0x140005855
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x5f8]
add rsp, 0x5c0
pop r12
pop rdi
pop rsi
ret