Function at 0x1401779c0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rbx, r9
mov esi, r8d
mov rdi, rcx
mov r12, qword [rbp + 0x230]
mov r15, qword [rbp + 0x238]
cmp dword [rbp + 0x240], 0
jne 0x1401785a9
cmp r8d, 0x110
jne 0x140177a2f
call fcn.140179520
mov qword [r15], rax
mov eax, 1
jmp 0x1401785ab
mov r14d, 1
xor r13d, r13d
lea edx, [r14 + 1]
cmp esi, 0x111
jne 0x140177bc4
cmp r14w, bx
jne 0x140177ab1
mov rax, rbx
shr rax, 0x10
cmp r13w, ax
je 0x140177b59
movzx eax, bx
mov ecx, 0x525
cmp cx, ax
jne 0x140177bea
mov rax, rbx
shr rax, 0x10
cmp r13w, ax
jne 0x140177bea
xor edx, edx
mov rcx, rdi
call fcn.14017d980
mov edx, r14d
mov rcx, rdi
call fcn.14017bd20
mov rcx, rdi
call fcn.14017b890
mov rcx, rdi
call fcn.14017f3f0
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
cmp dx, bx
jne 0x140177b64
mov rax, rbx
shr rax, 0x10
cmp r13w, ax
jne 0x140177b8b
mov eax, dword [rcx + 0xaf4]
cmp eax, edx
je 0x140177b59
dec eax
test eax, 0xfffffffd
jne 0x140177b4f
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
call fcn.140044d30
mov rcx, rax
lea r8, str.RECOVERY_TEXT
lea rdx, str.TEXT_ASK_EXIT
call fcn.140048480
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400190e0
mov rbx, rax
call fcn.14012bfe0
lea rcx, [0x1402670d8]
lea r8, [0x1402670e0]
cmp dword [rax + 0x88], 0
cmovne r8, rcx
mov r9d, 4
mov rdx, rbx
mov rcx, qword [rdi + 8]
call fcn.140061b80
cmp eax, 6
jne 0x140177b59
lea edx, [rax - 4]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_EndDialog]
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
mov eax, 0x8211
cmp ax, bx
jne 0x140177b8b
mov rax, rbx
shr rax, 0x10
cmp r13w, ax
jne 0x140177b8b
call fcn.140179c40
mov qword [r15], rax
mov eax, r14d
jmp 0x1401785ab
movzx eax, bx
mov ecx, 0x3ff
cmp cx, bx
jne 0x140177a62
mov rax, rbx
shr rax, 0x10
cmp r13w, ax
jne 0x140177bea
mov rcx, rdi
call fcn.14017b910
mov rcx, rdi
call fcn.14017f3f0
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
cmp esi, edx
jne 0x140177c09
call fcn.140179120
mov rcx, rdi
call fcn.14017b890
call fcn.140177240
mov rcx, rax
call fcn.140180450
mov qword [r15], r13
mov edx, 2
cmp esi, dword [0x1403112c4]
jne 0x140177d05
mov rcx, rdi
call fcn.14017d1a0
mov qword [r15], rax
mov eax, r14d
jmp 0x1401785ab
cmp esi, 0x233
jne 0x140177ce6
cmp dword [rcx + 0xaf4], r13d
jne 0x140177b59
cmp dword [rcx + 0xb08], r13d
jne 0x140177b59
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
mov r9d, 0x104
lea r8, [rbp - 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x1401785e0
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x48]
call fcn.140018bb0
test al, al
jne 0x140177cc2
lea rax, [rbp - 0x50]
mov rsi, 0xffffffffffffffff
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140177ca6
mov r8d, esi
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x48]
call fcn.140018f50
nop
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.14017a320
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_DragFinish]
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
cmp esi, 0x113
jne 0x140177bea
mov r8, rbx
call fcn.14017c8d0
mov qword [r15], rax
mov eax, r14d
jmp 0x1401785ab
cmp esi, dword [0x14030c27c]
jne 0x140177d20
mov rcx, rdi
call fcn.14017d370
mov qword [r15], rax
mov eax, r14d
jmp 0x1401785ab
cmp esi, dword [0x1403112c0]
jne 0x140177d78
xor edx, edx
mov rcx, rdi
call fcn.14017d980
mov edx, r14d
mov rcx, rdi
call fcn.14017bd20
mov rcx, rdi
call fcn.14017b890
mov rcx, rdi
call fcn.14017f3f0
lea rdx, str.OnStop___
mov rcx, qword [rdi + 0xb00]
call fcn.1400ca650
mov edx, 5
mov rcx, rdi
call fcn.14017d980
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
cmp esi, 7
jne 0x140177d93
mov edx, r14d
mov rcx, rdi
call fcn.14017fee0
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
cmp esi, 8
jne 0x140177dc0
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
cmp rax, qword [rdi + 8]
je 0x140177b59
xor edx, edx
mov rcx, rdi
call fcn.14017fee0
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
cmp esi, 0x1c
jne 0x140177dda
mov edx, ebx
mov rcx, rdi
call fcn.14017fee0
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
cmp esi, 0x111
jne 0x140178478
mov eax, 0x8218
cmp ax, bx
jne 0x140177ee2
mov rax, rbx
shr rax, 0x10
cmp r13w, ax
je 0x140177efd
mov eax, 0x821f
cmp ax, bx
jne 0x140177f18
mov rax, rbx
shr rax, 0x10
cmp r13w, ax
je 0x140177b59
mov eax, 0x8212
cmp ax, bx
jne 0x140177fea
mov rax, rbx
shr rax, 0x10
cmp r13w, ax
jne 0x140178035
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rsp + 0x78], r13
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r13
mov dword [rbp - 0x58], r13d
lea r12, vtable.CRecoverySettingDlg.0
mov qword [rsp + 0x70], r12
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
mov rax, qword [rbp - 0x68]
test rax, rax
jne 0x140177f4a
call fcn.1401f7180
mov qword [rbp - 0x68], rax
test rax, rax
jne 0x140177f4a
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
call fcn.140178c90
nop
mov qword [rsp + 0x70], r12
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140177b59
call fcn.1401f7250
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
mov eax, 0x8246
cmp ax, bx
jne 0x140177e05
mov rax, rbx
shr rax, 0x10
cmp r13w, ax
jne 0x140177f18
mov rcx, rdi
call fcn.140179120
mov rcx, rdi
call fcn.14017c180
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
mov eax, 0x821a
cmp ax, bx
jne 0x140177e24
mov rax, rbx
shr rax, 0x10
cmp r13w, ax
jne 0x140177fea
mov rcx, rdi
call fcn.14017d7a0
mov qword [r15], rax
mov eax, r14d
jmp 0x1401785ab
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1401f72b0
lea rax, [rsp + 0x70]
mov qword [rbp - 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbp - 0x78], eax
lea rsi, [0x140315cd8]
mov qword [rsp + 0x50], rsi
mov byte [rsp + 0x58], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x58], 1
mov rax, qword [0x140315d00]
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x80]
mov qword [0x140315d00], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], r13
lea r9, [0x140017d70]
mov r8, rbx
mov edx, 0xe5
mov rcx, qword [0x14030a4d0]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
cmp rax, 2
jne 0x140177eae
mov qword [rsp + 0x70], r12
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
jmp 0x140177ec5
mov eax, 0x4e5
cmp ax, bx
jne 0x140178035
mov rax, rbx
shr rax, 0x10
cmp r13w, ax
jne 0x140178186
call fcn.140136470
mov rcx, rdi
call fcn.14017e4c0
mov rcx, rdi
call fcn.14017ae20
mov rcx, rdi
call fcn.14017f1b0
mov rcx, rdi
call fcn.140178c90
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
mov eax, 0x821b
cmp ax, bx
jne 0x140178186
mov rax, rbx
shr rax, 0x10
cmp r13w, ax
jne 0x1401781f8
mov ecx, dword [rdi + 0xb08]
test ecx, ecx
je 0x140178170
sub ecx, r14d
je 0x140178173
sub ecx, r14d
je 0x140178091
cmp ecx, r14d
jne 0x140177b59
mov edx, 4
mov rcx, rdi
call fcn.14017fbc0
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
mov rcx, rdi
call fcn.140179120
call fcn.140177240
cmp dword [rax + 0x10], r13d
jne 0x140178158
call fcn.140177240
cmp dword [rax + 0x14], r13d
jne 0x140178158
call fcn.140177240
cmp dword [rax + 0x18], r13d
jne 0x140178158
call fcn.140177240
cmp dword [rax + 0x1c], r13d
jne 0x140178158
call fcn.140177240
cmp dword [rax + 0x20], r13d
jne 0x140178158
call fcn.140177240
cmp dword [rax + 0x24], r13d
jne 0x140178158
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
call fcn.140044d30
mov rcx, rax
lea r8, str.RECOVERY_TEXT
lea rdx, str.TEXT_MSG_NEED_CHECK_SYMBOLS
call fcn.140048480
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400190e0
mov rbx, rax
call fcn.14012bfe0
lea rcx, [0x1402670d8]
lea r8, [0x1402670e0]
cmp dword [rax + 0x88], 0
cmovne r8, rcx
xor r9d, r9d
mov rdx, rbx
mov rcx, qword [rdi + 8]
call fcn.140061b80
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
mov edx, 3
mov rcx, rdi
call fcn.14017fbc0
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
mov edx, r14d
mov rcx, rdi
call fcn.14017fbc0
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
mov eax, 0x821c
cmp ax, bx
jne 0x1401781f8
mov rax, rbx
shr rax, 0x10
cmp r13w, ax
jne 0x1401783fc
mov ecx, dword [rdi + 0xb08]
sub ecx, r14d
je 0x1401781e3
sub ecx, r14d
je 0x1401781cd
cmp ecx, r14d
jne 0x140177b59
mov rcx, rdi
call fcn.14017fbc0
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
mov edx, r14d
mov rcx, rdi
call fcn.14017fbc0
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
xor edx, edx
mov rcx, rdi
call fcn.14017fbc0
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
mov eax, 0x821d
cmp ax, bx
jne 0x140178350
call fcn.140177240
mov rbx, rax
lea rcx, [rax + 0x50]
call fcn.140018cc0
lea rcx, [rbx + 0x58]
call fcn.140018cc0
lea rcx, [rbx + 0x70]
call fcn.140018cc0
mov qword [rbx + 0x60], r13
mov dword [rbx + 0x68], r13d
mov rcx, qword [rdi + 0x88]
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
call qword [case.0x140038ca6.0]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x50], rax
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x1401785eb
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rbx, [0x140267540]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140018bb0
mov rsi, 0xffffffffffffffff
test al, al
jne 0x1401782bb
mov r8, rsi
inc r8
cmp word [rbx + r8*2], 0
jne 0x1401782a2
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140018f50
nop
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x1401785d5
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rbx, str.IDC_EDIT_FILE_PATHNAME
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140018bb0
test al, al
jne 0x14017831b
nop word [rax + rax]
inc rsi
cmp word [rbx + rsi*2], 0
jne 0x140178300
mov r8d, esi
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140018f50
nop
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov rcx, qword [rdi + 0xb00]
call fcn.1400cce40
xor edx, edx
mov rcx, rdi
call fcn.14017d980
xor edx, edx
mov rcx, rdi
call fcn.14017fbc0
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
mov eax, 0x54e
cmp ax, bx
jne 0x140178374
mov dword [rdi + 0xa70], r14d
mov rcx, rdi
call fcn.14017d980
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
mov eax, 0x821e
cmp ax, bx
jne 0x14017839b
mov dword [rdi + 0xa70], r13d
mov edx, r14d
mov rcx, rdi
call fcn.14017d980
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
mov eax, 0x8221
cmp ax, bx
jne 0x1401783fc
mov rax, rbx
shr rax, 0x10
cmp r13w, ax
je 0x1401783ce
mov eax, 0x822d
cmp ax, bx
jne 0x1401785a9
shr rbx, 0x10
cmp r13w, bx
jne 0x1401785a9
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.https:__www.bandisoft.com_bandizip_help_password_recovery_
lea rdx, [0x14026ad70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
mov eax, 0x8222
cmp ax, bx
jne 0x1401783b2
shr rbx, 0x10
cmp r13w, bx
jne 0x1401785a9
lea rcx, [rsp + 0x40]
call fcn.1400e2a80
nop
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, qword [rax]
lea rdx, [0x14026ad70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov rsi, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140177b59
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
cmp esi, 0x2e0
jne 0x1401785a9
call fcn.140044d30
mov rcx, rax
mov rdx, qword [rdi + 8]
call fcn.140048190
shr rbx, 0x10
movzx ebx, bx
mov edx, ebx
mov rcx, qword [rdi + 0xb00]
call fcn.1400c9980
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x50], xmm0
movsxd rsi, dword [rdi + 0xb10]
mov r9d, ebx
test ebx, ebx
jne 0x140178504
call fcn.1400386e0
movsxd rcx, dword [rax]
imul rcx, rsi
movabs r12, 0x2aaaaaaaaaaaaaab
mov rax, r12
imul rcx
mov rsi, rdx
sar rsi, 4
mov rcx, rsi
shr rcx, 0x3f
add rsi, rcx
movsxd rbx, dword [rdi + 0xb14]
call fcn.1400386e0
movsxd rcx, dword [rax]
imul rcx, rbx
jmp 0x140178534
imul rsi, r9
movabs r12, 0x2aaaaaaaaaaaaaab
mov rax, r12
imul rsi
mov r8, rdx
sar r8, 4
mov rsi, r8
shr rsi, 0x3f
add rsi, r8
movsxd rcx, dword [rdi + 0xb14]
imul rcx, r9
mov rax, r12
imul rcx
mov rbx, rdx
sar rbx, 4
mov rax, rbx
shr rax, 0x3f
add rbx, rax
mov dword [rsp + 0x30], 0x16
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov dword [rsp + 0x30], ILIsEqual
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], esi
movups xmm1, xmmword [rsp + 0x50]
movdqa xmm0, xmm1
psrldq xmm0, 4
movd r9d, xmm0
movd r8d, xmm1
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov qword [r15], r13
mov eax, r14d
jmp 0x1401785ab
xor eax, eax
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1401f74b0
mov rbx, qword [rsp + 0x318]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
int3
mov ecx, 0x80004005
call fcn.140019300
int3