Function at 0x1400723a0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x140], rbx
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rbx, rdx
mov rdi, rcx
mov byte [rcx + 0x420], 1
xor edx, edx
mov r8d, 0x88
lea rcx, [rsp + 0x50]
call fcn.1401afc90
mov rcx, qword [rbx + 0x110]
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + ILClone]
nop
lea rdx, str.btn_menu_setting
lea rcx, [rsp + 0x50]
call fcn.1400df660
test al, al
je 0x140072463
mov rcx, qword [rdi + 0x418]
call fcn.1400e8ee0
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400726c2
mov rcx, qword [rdi + 0x418]
call fcn.1400e8ee0
mov rcx, rax
lea r9, str.BasicSetting_Nav
xor r8d, r8d
mov edx, 0x429
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400726c2
lea rdx, str.btn_menu_feedback
lea rcx, [rsp + 0x50]
call fcn.1400df660
test al, al
je 0x140072647
xor r13d, r13d
mov qword [rsp + 0x48], r13
lea rdx, str.http:__www1.tabxexplorer.com_service_index.html_pidpidmidmidm2mid2appverappverososverinstdateinstdate
lea rcx, [rsp + 0x30]
call fcn.140028d90
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.14002afa0
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov rbp, 0xffffffffffffffff
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400724cb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rbx, str.fromtabxexplorer
mov rcx, rbp
inc rcx
cmp word [rbx + rcx*2], 0
jne 0x1400724d5
mov r14, rbx
mov rax, qword [rsp + 0x48]
sub r14, rax
sar r14, 1
mov r15d, dword [rax - 0x10]
test ecx, ecx
js 0x140072710
movsxd rdx, ecx
mov rcx, rbx
call fcn.1401c1b54
mov r12, rax
mov ecx, 0x7fffffff
sub ecx, eax
cmp ecx, r15d
jl 0x14007271b
lea esi, [r15 + rax]
test esi, esi
js 0x140072726
mov rax, qword [rsp + 0x48]
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, esi
or ecx, edx
jge 0x14007254a
mov edx, esi
lea rcx, [rsp + 0x48]
call fcn.14000cf20
mov rax, qword [rsp + 0x48]
cmp r14, r15
ja 0x140072553
lea rbx, [rax + r14*2]
movsxd rdx, r12d
add rdx, rdx
lea rcx, [rax + r15*2]
mov r9, rdx
mov r8, rbx
call fcn.14000e830
mov rax, qword [rsp + 0x48]
cmp esi, dword [rax - 0xc]
jg 0x140072705
mov dword [rax - 0x10], esi
movsxd rcx, esi
mov rax, qword [rsp + 0x48]
mov word [rax + rcx*2], r13w
mov rcx, qword [0x1402b4800]
test rcx, rcx
jne 0x1400725f3
lea rcx, [0x14029e068]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [0x1402b4800], 0
jne 0x1400725df
mov ecx, ILClone
call fcn.1401606ac
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400725d0
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov rcx, rax
call fcn.14003d990
jmp 0x1400725d3
mov rax, r13
lock or dword [rsp], 0
mov qword [0x1402b4800], rax
lea rcx, [0x14029e068]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x1402b4800]
mov edx, 1
call fcn.14003ecb0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, qword [rsp + 0x48]
lea rdx, [0x1401f56e0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
sub ebp, 1
jg 0x1400726c2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400726c2
lea rdx, str.btn_menu_resotre_explorer
lea rcx, [rsp + 0x50]
call fcn.1400df660
test al, al
je 0x140072688
mov rcx, qword [rdi + 0x418]
call fcn.1400e8ee0
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400726c2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 0x418]
call fcn.14006fde0
jmp 0x1400726c2
lea rdx, str.btn_menu_takeover_explorer
lea rcx, [rsp + 0x50]
call fcn.1400df660
test al, al
je 0x1400726c2
mov rcx, qword [rdi + 0x418]
call fcn.1400e8ee0
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400726c2
mov rcx, qword [rdi + 0x418]
call fcn.140065110
mov edx, 1
mov rcx, rdi
call fcn.1400e90a0
nop
lea rcx, [rsp + 0x50]
call fcn.140028e30
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140160a40
mov rbx, qword [rsp + 0x140]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.14000ca90
int3
mov ecx, 0x80070057
call fcn.14000ca90
int3
mov ecx, 0x80070057
call fcn.14000ca90
int3
mov ecx, 0x80070057
call fcn.14000ca90
int3