Function at 0x140016e40
Capabilities:
Create process on windows
Create thread

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x320
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x358], rbx
mov rax, qword [0x140055b28]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov r12d, r8d
mov rdi, rcx
mov esi, 3
mov rcx, qword [rcx + 0x1b0]
call qword [sym.imp.USER32.dll_GetMenuItemCount]
cmp eax, esi
jle 0x1400173cc
nop word [rax + rax]
mov r8d, esi
lea rdx, [rsp + 0x38]
lea rcx, [rdi + 0x1b0]
call fcn.140013880
mov rbx, qword [rax]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], 0x50
xor edx, edx
lea r8d, [rdx + 0x4c]
lea rcx, [rsp + 0x54]
call fcn.140024690
mov dword [rsp + 0x54], 0x20
lea r9, [rsp + 0x50]
xor r8d, r8d
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetMenuItemInfoW]
test eax, eax
jne 0x140016f0c
inc esi
mov rcx, qword [rdi + 0x1b0]
call qword [sym.imp.USER32.dll_GetMenuItemCount]
cmp esi, eax
jl 0x140016ea0
jmp 0x1400173cc
mov r12, qword [rsp + 0x80]
xor edx, edx
lea r8d, [rdx + 0x50]
lea rcx, [rsp + 0x50]
call fcn.140024690
mov dword [rsp + 0x50], 0x50
mov dword [rsp + 0x54], 0x20
lea r9, [rsp + 0x50]
mov r8d, 1
mov edx, esi
mov rcx, qword [rdi + 0x1b0]
call qword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov rbx, qword [rsp + 0x80]
test rbx, rbx
je 0x1400173cc
test r12, r12
je 0x1400173cc
xor r13d, r13d
mov word [rsp + 0xf0], r13w
xor eax, eax
mov dword [rsp + 0xf2], eax
mov word [rsp + 0xf6], ax
mov word [rsp + 0x30], r13w
mov rax, qword [rbx]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x18]
movzx r11d, word [rsp + 0x30]
cmp r11w, 0x5c
jne 0x140016fbd
lea rdx, [0x140043cb4]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x140016fe9
mov word [rsp + 0xf0], r11w
mov eax, 0x3a
mov word [rsp + 0xf2], ax
mov eax, 0x5c
mov word [rsp + 0xf4], ax
mov word [rsp + 0xf6], r13w
mov eax, r12d
sub eax, 0x88
je 0x1400173a2
sub eax, 5
je 0x140017358
sub eax, 1
je 0x14001714d
sub eax, 1
je 0x14001712c
cmp eax, 1
je 0x1400170c7
mov dword [rdi + 0x88], 1
mov qword [rsp + 0x38], r13
mov rax, qword [r12]
lea rdx, [rsp + 0x38]
mov rcx, r12
call qword [rax + 0x20]
mov r11, qword [rbx]
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call qword [r11 + 0x78]
test eax, eax
je 0x1400170a3
mov dword [rdi + 0x88], 1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
mov dword [rdi + 0x88], r13d
cmp eax, 0x80004004
je 0x1400170b0
cmp eax, 1
je 0x1400170b0
test eax, eax
je 0x140017091
lea r9, [rsp + 0xf0]
mov edx, 0x27dd
lea r8d, [rdx + 0x41]
mov rcx, rdi
call fcn.140013250
jmp 0x1400170b0
mov rcx, qword [rdi + 0xa0]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x40]
jmp 0x1400170b0
mov rax, qword [rbx]
mov rdx, r12
mov rcx, rbx
call qword [rax + 0x38]
nop
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [rdi + 0x88], r13d
jmp 0x1400173ca
mov dword [rdi + 0x88], 1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
mov dword [rdi + 0x88], r13d
cmp eax, 0x80004004
je 0x1400173ca
cmp eax, 1
je 0x1400173ca
test eax, eax
je 0x140017117
lea r9, [rsp + 0xf0]
mov edx, 0x27dd
lea r8d, [rdx + 0x41]
mov rcx, rdi
call fcn.140013250
jmp 0x1400173ca
mov rcx, qword [rdi + 0xa0]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x40]
jmp 0x1400173ca
mov dword [rdi + 0x88], 1
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax + 0x60]
mov dword [rdi + 0x88], r13d
jmp 0x1400173ca
mov qword [rsp + 0x38], r13
lea r8, str..wmt__.vhd__.vmdk__.vdi
mov edx, 0x27fb
lea rcx, [rsp + 0x38]
call fcn.14001f910
mov word [rsp + 0x100], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x102]
call fcn.140024690
mov dword [rsp + 0x50], 0x98
xor edx, edx
mov r8d, SysAllocStringByteLen
lea rcx, [rsp + 0x58]
call fcn.140024690
mov r11, qword [rdi + 8]
mov qword [rsp + 0x58], r11
lea rax, [rsp + 0x100]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], 0x104
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0xb0], 0x1800
lea rcx, [rsp + 0x50]
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x14001734b
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rsi, eax
mov edx, esi
lea rcx, [rdi + 0xb8]
call fcn.140010a60
test eax, eax
je 0x140017282
lea rbp, [rsi + rsi]
lea edx, [rsi + 1]
movsxd rdx, edx
add rdx, rdx
mov r9, rbp
lea r8, [rsp + 0x100]
mov rcx, qword [rdi + 0xb8]
call fcn.140024908
test eax, eax
je 0x14001726c
cmp eax, 0xc
je 0x140017261
cmp eax, 0x16
je 0x140017256
cmp eax, 0x22
je 0x140017256
cmp eax, 0x50
je 0x14001726c
mov ecx, 0x80004005
call fcn.14000e230
int3
mov ecx, 0x80070057
call fcn.14000e230
int3
mov ecx, 0x8007000e
call fcn.14000e230
int3
mov rax, qword [rdi + 0xb8]
mov dword [rax - 8], esi
mov rax, qword [rdi + 0xb8]
mov word [rax + rbp], r13w
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rsi, eax
mov edx, esi
lea rcx, [rdi + 0xc0]
call fcn.140010a60
test eax, eax
je 0x140017318
lea rbp, [rsi + rsi]
lea edx, [rsi + 1]
movsxd rdx, edx
add rdx, rdx
mov r9, rbp
lea r8, [rsp + 0xf0]
mov rcx, qword [rdi + 0xc0]
call fcn.140024908
test eax, eax
je 0x140017302
cmp eax, 0xc
je 0x1400172f7
cmp eax, 0x16
je 0x1400172ec
cmp eax, 0x22
je 0x1400172ec
cmp eax, 0x50
je 0x140017302
mov ecx, 0x80004005
call fcn.14000e230
int3
mov ecx, 0x80070057
call fcn.14000e230
int3
mov ecx, 0x8007000e
call fcn.14000e230
int3
mov rax, qword [rdi + 0xc0]
mov dword [rax - 8], esi
mov rax, qword [rdi + 0xc0]
mov word [rax + rbp], r13w
mov byte [rdi + 0xc8], 0
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
mov r9, rdi
lea r8, [0x140016d40]
xor edx, edx
xor ecx, ecx
call fcn.140025d34
test rax, rax
je 0x14001734b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x1400173ca
mov qword [rsp + 0x38], r13
lea r9, str..nrg_.bin_.ccd_.cue_.iso_.isz_.vcd_.ape_.flac_.wv_.mds_.mdf_.img_
mov r8d, 0x2793
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140015240
mov rbx, qword [rsp + 0x38]
test eax, eax
je 0x140017397
xor r9d, r9d
lea r8, [rsp + 0xf0]
mov rdx, rbx
mov rcx, rdi
call fcn.140016d70
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x1400173ca
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rsp + 0xf0]
lea rdx, [0x140044038]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
jmp 0x1400173cc
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.1400253c0
mov rbx, qword [rsp + 0x358]
add rsp, 0x320
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret