Function at 0x1400701a0
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov byte [rax + 0x10], dl
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
mov rbp, rcx
mov r12b, r8b
mov edi, 0x68
lea rcx, [rax - 0xb8]
xor edx, edx
mov r8, rdi
movaps xmmword [rax - 0x48], xmm6
mov rbx, r9
call fcn.140019a70
xor esi, esi
lea eax, [rdi - 0x67]
mov dword [rsp + 0xe0], edi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x1b0], esi
mov dword [rsp + 0x11c], eax
mov word [rsp + 0x120], ax
mov edi, esi
mov r14d, esi
cmp r12b, sil
je 0x14007024e
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
call fcn.140008d20
cmp qword [rbx + 0x10], 7
mov dword [rsp + 0x1b0], eax
jbe 0x140070280
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x38]
call fcn.140008d20
mov edi, eax
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x38]
jmp 0x14007026c
cmp qword [rbx + 0x10], 3
jbe 0x140070296
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
call fcn.140008d20
mov edi, eax
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
and edi, 0xffff0000
call fcn.140008d20
movzx r14d, ax
cmp r12b, sil
je 0x140070296
cmp qword [rbx + 0x10], 6
jbe 0x140070291
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x30]
jmp 0x1400702a5
cmp r12b, sil
jne 0x1400702b2
cmp qword [rbx + 0x10], 2
jbe 0x1400702b2
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x10]
call fcn.140008d20
mov word [rsp + 0x120], ax
mov eax, reloc.WSOCK32.dll_recv
mov r13d, esi
bt edi, 0x10
cmovb r13d, eax
mov rax, qword [rbx + 8]
mov rcx, qword [rax]
call fcn.140063fa0
mov rcx, rax
call fcn.1400172a0
cmp r12b, sil
je 0x14007039f
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x68], rax
mov rcx, qword [rcx + 8]
call fcn.140063fa0
mov rcx, rax
call fcn.1400172a0
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x70], rax
call fcn.140063fa0
mov rcx, rax
call fcn.1400172a0
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x20]
mov qword [rsp + 0x60], rax
call fcn.140063fa0
mov rcx, rax
call fcn.1400172a0
cmp qword [rbx + 0x10], 5
mov r15, rax
jbe 0x140070365
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x28]
call fcn.140063fa0
mov rcx, rax
call fcn.1400172a0
mov rsi, rax
test rax, rax
je 0x140070365
mov rcx, rax
call fcn.140019b5c
test rax, rax
jne 0x14007040f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rcx, 0xffffffffffffffff
lea edx, [rax + 1]
mov edi, eax
mov eax, 2
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.140018cc8
mov edx, edi
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x14007040f
mov edi, 1
mov r15, rax
cmp qword [rbx + 0x10], rdi
jbe 0x1400703d7
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 8]
call fcn.140063fa0
mov rcx, rax
call fcn.1400172a0
mov rsi, rax
test rax, rax
je 0x1400703d7
mov rcx, rax
call fcn.140019b5c
test rax, rax
jne 0x14007044f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, 0xffffffffffffffff
lea edx, [rax + 1]
mov edi, eax
mov eax, 2
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.140018cc8
mov ecx, edi
mov rdx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test r12b, r12b
je 0x14007044a
mov rcx, qword [rbx + 8]
lea rdi, [0x14009a680]
mov rcx, qword [rcx]
mov rdx, rdi
call fcn.140015040
mov rcx, qword [rbx + 8]
mov rdx, rdi
mov rcx, qword [rcx + 8]
call fcn.140015040
mov rcx, qword [rbx + 8]
mov rdx, rdi
mov rcx, qword [rcx + 0x10]
call fcn.140015040
mov edi, 1
lea rcx, [rsp + 0x90]
mov edx, r14d
call fcn.140041d70
test r14d, r14d
je 0x1400704d8
lea rcx, [rsp + 0x90]
call fcn.140052450
or rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x90]
cmp rax, rbx
lea r14d, [rbx + 1]
mov qword [rsp + 0x138], rax
cmove edi, r14d
call fcn.1400523d0
lea rcx, [rsp + 0x90]
cmp rax, rbx
mov qword [rsp + 0x140], rax
cmove edi, r14d
call fcn.140052380
or rcx, 0xffffffffffffffff
cmp rax, rcx
movzx ebx, dil
mov qword [rsp + 0x130], rax
cmove ebx, r14d
cmp bl, r14b
je 0x1400704de
bts dword [rsp + 0x11c], 8
jmp 0x1400704de
xor r14d, r14d
mov bl, r14b
cmp r12b, r14b
je 0x140070599
mov r9, qword [rsp + 0x60]
lea rax, [rsp + 0x78]
lea rcx, [rsp + 0x1b0]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x1b0]
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], r13d
mov r13, qword [rsp + 0x68]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r14
mov r14, qword [rsp + 0x70]
mov rdx, r13
mov r8, r14
mov dword [rsp + 0x20], eax
call fcn.140055b60
mov rcx, r13
mov r12b, al
call fcn.140019b5c
mov rdi, r13
mov rcx, rax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, r14
call fcn.140019b5c
mov rdi, r14
mov rcx, rax
xor eax, eax
rep stosb byte [rdi], al
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
call fcn.140019b5c
mov rcx, rax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, r13
call fcn.140018ec8
mov rcx, r14
call fcn.140018ec8
mov rcx, qword [rsp + 0x60]
call fcn.140018ec8
xor r14d, r14d
jmp 0x1400705de
lea rcx, [rsp + 0x78]
movzx eax, bl
xor r9d, r9d
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0xe0]
xor r8d, r8d
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r14
mov rdx, r15
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, r14d
setne r12b
mov rcx, r15
call fcn.140018ec8
mov rcx, rsi
call fcn.140018ec8
cmp r12b, r14b
jne 0x140070644
mov rax, qword [rbp]
xor r8d, r8d
movsxd rcx, dword [rax + 4]
lea edx, [r8 + 1]
add rcx, rbp
call fcn.140003990
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r8d, r8d
mov edx, eax
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
add rcx, rbp
call fcn.140003940
mov rdi, qword [rsp + 0x1c0]
mov rcx, rdi
call fcn.1400038c0
mov dword [rdi + 8], 1
mov dword [rdi], r14d
jmp 0x1400706e1
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp bl, r14b
je 0x140070693
lea rcx, [rsp + 0x90]
call fcn.140052300
mov edx, dword [rsp + 0x88]
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x94], edx
call fcn.140052290
lea rcx, [rbp + 0x740]
lea rdx, [rsp + 0x90]
call fcn.14005a790
cmp byte [rsp + 0x1a8], r14b
je 0x1400706ab
mov rax, qword [rsp + 0x78]
mov qword [rbp + 0x710], rax
jmp 0x1400706e1
mov eax, dword [rsp + 0x88]
mov rdi, qword [rsp + 0x1c0]
pxor xmm6, xmm6
mov rcx, rdi
cvtsi2sd xmm6, rax
call fcn.1400038c0
mov rcx, qword [rsp + 0x78]
movsd qword [rdi], xmm6
mov dword [rdi + 8], 3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x90]
call fcn.14005b690
lea r11, [rsp + 0x160]
xor eax, eax
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret