Function at 0x1400461b8
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], dl
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rbx, rcx
mov r13b, r8b
mov edi, 0x68
lea rcx, [rbp - 0x20]
xor edx, edx
mov r8d, edi
mov rsi, r9
call fcn.14006fdf0
xor r12d, r12d
lea eax, [rdi - 0x67]
mov dword [rbp - 0x20], edi
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x50], r12d
mov dword [rbp + 0x1c], eax
mov word [rbp + 0x20], ax
mov edi, r12d
mov dword [rbp + 0xa0], r12d
test r13b, r13b
je 0x140046258
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 0x18]
call fcn.1400178dc
cmp qword [rsi + 0x10], 7
mov dword [rsp + 0x50], eax
jbe 0x14004628f
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 0x38]
call fcn.1400178dc
mov edi, eax
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 0x38]
jmp 0x140046276
cmp qword [rsi + 0x10], 3
jbe 0x1400462a5
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 0x18]
call fcn.1400178dc
mov edi, eax
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 0x18]
and edi, 0xffff0000
call fcn.1400178dc
movzx eax, ax
mov dword [rbp + 0xa0], eax
test r13b, r13b
je 0x1400462a5
cmp qword [rsi + 0x10], 6
jbe 0x1400462a0
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 0x30]
jmp 0x1400462b4
test r13b, r13b
jne 0x1400462bd
cmp qword [rsi + 0x10], 2
jbe 0x1400462bd
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 0x10]
call fcn.1400178dc
mov word [rbp + 0x20], ax
bt edi, 0x10
mov eax, reloc.WSOCK32.dll_recv
mov rdi, r12
mov r14d, edi
cmovb r14d, eax
mov rax, qword [rsi + 8]
mov rcx, qword [rax]
call fcn.140017790
mov rcx, rax
call fcn.1400131b4
test r13b, r13b
je 0x1400463ad
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x68], rax
mov rcx, qword [rcx + 8]
call fcn.140017790
mov rcx, rax
call fcn.1400131b4
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x58], rax
call fcn.140017790
mov rcx, rax
call fcn.1400131b4
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx + 0x20]
mov qword [rsp + 0x60], rax
call fcn.140017790
mov rcx, rax
call fcn.1400131b4
cmp qword [rsi + 0x10], 5
mov r15, rax
jbe 0x140046373
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx + 0x28]
call fcn.140017790
mov rcx, rax
call fcn.1400131b4
mov r12, rax
test rax, rax
je 0x140046373
mov rcx, rax
call fcn.14006f364
test rax, rax
jne 0x14004641b
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rcx, 0xffffffffffffffff
lea edx, [rax + 1]
mov edi, eax
mov eax, 2
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.14006f7d8
mov edx, edi
mov rcx, rax
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x140046419
cmp qword [rsi + 0x10], 1
mov r15, rax
jbe 0x1400463e1
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 8]
call fcn.140017790
mov rcx, rax
call fcn.1400131b4
mov r12, rax
test rax, rax
je 0x1400463e1
mov rcx, rax
call fcn.14006f364
test rax, rax
jne 0x140046458
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, 0xffffffffffffffff
lea edx, [rax + 1]
mov edi, eax
mov eax, 2
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.14006f7d8
mov ecx, edi
mov rdx, rax
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor edi, edi
test r13b, r13b
je 0x140046458
mov rcx, qword [rsi + 8]
lea rdi, [0x14008b090]
mov rcx, qword [rcx]
mov rdx, rdi
call fcn.1400182d0
mov rcx, qword [rsi + 8]
mov rdx, rdi
mov rcx, qword [rcx + 8]
call fcn.1400182d0
mov rcx, qword [rsi + 8]
mov rdx, rdi
mov rcx, qword [rcx + 0x10]
call fcn.1400182d0
xor edi, edi
mov ecx, dword [rbp + 0xa0]
mov dword [rsp + 0x74], edi
mov qword [rsp + 0x78], rdi
movzx eax, cx
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], rdi
mov dword [rsp + 0x70], eax
test al, 8
je 0x140046495
or eax, 6
mov dword [rsp + 0x70], eax
mov edx, reloc.WSOCK32.dll_recv
test byte [rsp + 0x70], dl
cmovne eax, edx
test ecx, ecx
setne sil
mov dword [rsp + 0x70], eax
test sil, sil
je 0x140046510
lea rcx, [rsp + 0x70]
call fcn.140016068
or rcx, 0xffffffffffffffff
movzx edi, sil
cmp rax, rcx
lea esi, [rcx + 1]
lea rcx, [rsp + 0x70]
mov qword [rbp + 0x38], rax
cmove edi, esi
call fcn.140016184
or rcx, 0xffffffffffffffff
mov qword [rbp + 0x40], rax
cmp rax, rcx
lea rcx, [rsp + 0x70]
cmove edi, esi
call fcn.1400162c8
or rcx, 0xffffffffffffffff
movzx esi, dil
cmp rax, rcx
lea edi, [rcx + 1]
cmove esi, edi
mov qword [rbp + 0x30], rax
test sil, sil
je 0x140046510
bts dword [rbp + 0x1c], 8
test r13b, r13b
je 0x1400465c3
call fcn.14000285c
mov r9d, dword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
test al, al
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r14d
mov r14, qword [rsp + 0x68]
mov qword [rsp + 0x20], r15
mov rcx, r14
je 0x140046561
call fcn.140002a30
jmp 0x140046566
call fcn.140002db4
mov rcx, r14
mov r13b, al
call fcn.14006f364
mov rdi, r14
mov rcx, rax
xor eax, eax
rep stosb byte [rdi], al
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
call fcn.14006f364
mov rcx, rax
xor eax, eax
rep stosb byte [rdi], al
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
call fcn.14006f364
mov rcx, rax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, r14
call fcn.14006f380
mov rcx, qword [rsp + 0x58]
call fcn.14006f380
mov rcx, qword [rsp + 0x60]
call fcn.14006f380
xor edi, edi
jmp 0x140046603
lea rcx, [rbp - 0x40]
movzx eax, sil
xor r9d, r9d
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x20]
xor r8d, r8d
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rdi
mov rdx, r15
xor ecx, ecx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne r13b
mov rcx, r15
call fcn.14006f380
mov rcx, r12
call fcn.14006f380
test r13b, r13b
jne 0x1400466af
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
cmp byte [rcx + 0x19], dil
je 0x140046636
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax + 0x48]
jmp 0x14004663a
mov rdx, qword [rcx + 0x10]
mov dword [rdx + 0x1c], 1
cmp byte [rcx + 0x19], dil
je 0x140046651
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax + 0x48]
jmp 0x140046655
mov rcx, qword [rcx + 0x10]
mov byte [rcx + 0x20], dil
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbx]
movsxd rdi, dword [rcx + 4]
xor esi, esi
add rdi, rbx
mov rcx, qword [rdi + 0x10]
cmp byte [rdi + 0x19], sil
je 0x140046679
mov rcx, qword [rcx + 0x48]
add rcx, 0x28
mov edx, eax
call fcn.1400180b8
cmp byte [rdi + 0x19], sil
je 0x140046694
mov rax, qword [rdi + 0x10]
mov rcx, qword [rax + 0x48]
jmp 0x140046698
mov rcx, qword [rdi + 0x10]
mov byte [rcx + 0x40], sil
mov rcx, qword [rbp + 0xb0]
xor edx, edx
call fcn.1400180b8
jmp 0x1400467f0
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test sil, sil
je 0x1400467b8
lea rcx, [rbp - 0x60]
call fcn.1400163e4
lea rcx, [rbp - 0x80]
call fcn.1400163e4
lea rcx, [rbp - 0x70]
call fcn.1400163e4
mov edx, dword [rbp - 0x30]
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x74], edx
cmp qword [rbp - 0x58], rdi
jne 0x140046711
test al, 2
je 0x140046711
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140046711
call fcn.140016658
mov rcx, rax
mov qword [rbp - 0x58], rax
call fcn.1400166d4
mov eax, dword [rsp + 0x70]
cmp qword [rbp - 0x50], rdi
jne 0x14004673c
test al, 4
je 0x14004673c
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x14004673c
shr eax, 3
test al, 1
jne 0x14004673c
call fcn.140016658
mov rcx, rax
mov qword [rbp - 0x50], rax
call fcn.1400166d4
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
cmp qword [rbx + 0x7e0], rdi
jne 0x140046776
call fcn.14006f7d8
test rax, rax
je 0x140046763
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.1400495ac
jmp 0x140046766
mov rax, rdi
mov qword [rbx + 0x7e0], rax
mov qword [rbx + 0x7d8], rax
jmp 0x1400467b2
call fcn.14006f7d8
test rax, rax
je 0x140046792
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.1400495ac
mov rdx, rax
jmp 0x140046795
mov rdx, rdi
mov rax, qword [rbx + 0x7e0]
mov qword [rdx + 0x10], rax
mov rax, qword [rbx + 0x7e0]
mov qword [rax + 8], rdx
mov qword [rbx + 0x7e0], rdx
inc dword [rbx + 0x7e8]
cmp byte [rbp + 0x98], dil
je 0x1400467ce
mov rax, qword [rbp - 0x40]
mov qword [rbx + 0x7a8], rax
jmp 0x1400467f0
mov eax, dword [rbp - 0x30]
mov rcx, qword [rbp + 0xb0]
pxor xmm1, xmm1
cvtsi2sd xmm1, rax
call fcn.1400182a0
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x70]
call fcn.140015fec
mov rbx, qword [rsp + 0x190]
xor eax, eax
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret