Function at 0x140004620
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1f8]
sub rsp, 0x2d0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140218f40]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r15, rcx
call fcn.14001e6e8
mov rcx, rax
xor r12d, r12d
mov edx, r12d
test rax, rax
setne dl
test edx, edx
jne 0x140004686
mov ecx, 0x80004005
call fcn.140014f90
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
mov edx, 0x104
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
lea rdi, [rbp - 0x50]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x14000471d
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14000479a
cmp dword [rdx + 0x10], eax
jge 0x1400046f3
cmp dword [rbx - 0xc], eax
jge 0x1400046e6
mov ecx, 0x80070057
call fcn.140014f90
int3
mov dword [rbx - 0x10], r12d
mov word [rbx], r12w
jmp 0x14000479a
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140004709
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
jmp 0x14000479a
mov r14d, dword [rbx - 0x10]
lea r13, [rbp - 0x50]
sub r13, rbx
sar r13, 1
test ecx, ecx
jns 0x14000473a
mov ecx, 0x80070057
call fcn.140014f90
int3
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14000475c
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.140014f30
mov rbx, qword [rsp + 0x20]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp r13, r14
lea r14, [rax + rax]
mov r9, r14
ja 0x140004780
lea r8, [rbx + r13*2]
call fcn.14015e47c
jmp 0x140004789
lea r8, [rbp - 0x50]
call fcn.14015e3f4
cmp edi, dword [rbx - 0xc]
jg 0x14000497a
mov dword [rbx - 0x10], edi
mov word [r14 + rbx], r12w
lea rdx, str.System32Main.cpl
lea rcx, [rsp + 0x20]
call fcn.140013e60
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0x44]
call fcn.140160160
mov dword [rsp + 0x40], VarBstrFromDisp
mov rax, qword [r15 + 0x40]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x70], 1
mov rax, qword [rsp + 0x20]
cmp dword [rax - 8], 1
jle 0x1400047f1
mov edx, dword [rax - 0x10]
lea rcx, [rsp + 0x20]
call fcn.140014e20
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebx, r12d
call fcn.14001e6e8
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x140004824
mov ecx, 0x80004005
call fcn.140014f90
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x28], rdi
mov ecx, 0x77
call fcn.14001e4bc
test rax, rax
je 0x140004860
mov r8d, 0x77
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140014c80
mov rdi, qword [rsp + 0x28]
nop dword [rax]
mov rdx, rdi
lea rcx, str.32770
call qword [sym.imp.USER32.dll_FindWindowW]
mov r13, rax
test rax, rax
jne 0x1400048d0
inc ebx
lea ecx, [rax + 0xa]
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 0x1f4
jl 0x140004860
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400048a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140004985
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140004985
xor r9d, r9d
lea r8, str.SysTabControl32
xor edx, edx
mov rcx, r13
call qword [sym.imp.USER32.dll_FindWindowExW]
mov r14, rax
test rax, rax
jne 0x14000491f
inc r12d
lea ecx, [rax + 0xa]
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp r12d, 0x1f4
jl 0x1400048d0
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000491d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x1400048a6
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1304
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11d, [rbx - 1]
movsxd r8, r11d
xor r9d, r9d
mov edx, 0x1330
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140004975
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x1400048a6
mov ecx, 0x80070057
call fcn.140014f90
nop
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14015e210
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret