Function at 0x14004a9dc
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], dl
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
mov rbx, rcx
mov r12b, r8b
mov edi, 0x68
lea rcx, [rsp + 0xf0]
xor edx, edx
mov r8, rdi
mov rsi, r9
call fcn.1400761e0
xor ebp, ebp
lea eax, [rdi - 0x67]
mov dword [rsp + 0xf0], edi
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x12c], eax
mov word [rsp + 0x130], ax
mov edi, ebp
mov r15d, ebp
cmp r12b, bpl
je 0x14004aa80
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 0x18]
call fcn.140017618
cmp qword [rsi + 0x10], 7
mov dword [rsp + 0x60], eax
jbe 0x14004aab2
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 0x38]
call fcn.140017618
mov edi, eax
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 0x38]
jmp 0x14004aa9e
cmp qword [rsi + 0x10], 3
jbe 0x14004aac8
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 0x18]
call fcn.140017618
mov edi, eax
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 0x18]
and edi, 0xffff0000
call fcn.140017618
movzx r15d, ax
cmp r12b, bpl
je 0x14004aac8
cmp qword [rsi + 0x10], 6
jbe 0x14004aac3
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 0x30]
jmp 0x14004aad7
cmp r12b, bpl
jne 0x14004aae4
cmp qword [rsi + 0x10], 2
jbe 0x14004aae4
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 0x10]
call fcn.140017618
mov word [rsp + 0x130], ax
mov eax, reloc.WSOCK32.dll_recv
bt edi, 0x10
mov r13d, ebp
cmovb r13d, eax
mov rax, qword [rsi + 8]
xor edi, edi
mov rcx, qword [rax]
call fcn.1400174a4
mov rcx, rax
call fcn.140013048
cmp r12b, dil
je 0x14004abd3
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x70], rax
mov rcx, qword [rcx + 8]
call fcn.1400174a4
mov rcx, rax
call fcn.140013048
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x78], rax
call fcn.1400174a4
mov rcx, rax
call fcn.140013048
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx + 0x20]
mov qword [rsp + 0x68], rax
call fcn.1400174a4
mov rcx, rax
call fcn.140013048
cmp qword [rsi + 0x10], 5
mov r14, rax
jbe 0x14004ab99
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx + 0x28]
call fcn.1400174a4
mov rcx, rax
call fcn.140013048
mov rbp, rax
cmp rax, rdi
je 0x14004ab99
mov rcx, rax
call fcn.140075704
cmp rax, rdi
jne 0x14004ac41
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rcx, 0xffffffffffffffff
lea edx, [rax + 1]
mov edi, eax
mov eax, 2
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.140075b98
mov edx, edi
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x14004ac3f
cmp qword [rsi + 0x10], 1
mov r14, rax
jbe 0x14004ac07
mov rax, qword [rsi + 8]
mov rcx, qword [rax + 8]
call fcn.1400174a4
mov rcx, rax
call fcn.140013048
mov rbp, rax
cmp rax, rdi
je 0x14004ac07
mov rcx, rax
call fcn.140075704
cmp rax, rdi
jne 0x14004ac7e
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, 0xffffffffffffffff
lea edx, [rax + 1]
mov edi, eax
mov eax, 2
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.140075b98
mov ecx, edi
mov rdx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor edi, edi
cmp r12b, dil
je 0x14004ac7e
mov rcx, qword [rsi + 8]
lea rdi, [0x1400956d0]
mov rcx, qword [rcx]
mov rdx, rdi
call fcn.140017fc0
mov rcx, qword [rsi + 8]
mov rdx, rdi
mov rcx, qword [rcx + 8]
call fcn.140017fc0
mov rcx, qword [rsi + 8]
mov rdx, rdi
mov rcx, qword [rcx + 0x10]
call fcn.140017fc0
xor edi, edi
movzx eax, r15w
mov dword [rsp + 0x84], edi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rdi
mov dword [rsp + 0x80], eax
test al, 8
je 0x14004acde
or eax, 6
mov dword [rsp + 0x80], eax
mov ecx, reloc.WSOCK32.dll_recv
test byte [rsp + 0x80], cl
cmovne eax, ecx
cmp r15d, edi
setne sil
mov dword [rsp + 0x80], eax
cmp sil, dil
je 0x14004ad73
lea rcx, [rsp + 0x80]
call fcn.140015d48
or r15, 0xffffffffffffffff
movzx edi, sil
cmp rax, r15
lea esi, [r15 + 1]
lea rcx, [rsp + 0x80]
cmove edi, esi
mov qword [rsp + 0x148], rax
call fcn.140015e64
cmp rax, r15
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x150], rax
cmove edi, esi
call fcn.140015fa0
movzx esi, dil
lea edi, [r15 + 1]
cmp rax, r15
mov qword [rsp + 0x140], rax
cmove esi, edi
cmp sil, dil
je 0x14004ad73
bts dword [rsp + 0x12c], 8
cmp r12b, dil
je 0x14004ae46
lea rcx, [rsp + 0x1b0]
call fcn.140002990
mov r15, qword [rsp + 0x78]
mov r9, qword [rsp + 0x68]
cmp al, dil
lea rax, [rsp + 0xd0]
lea rcx, [rsp + 0x1b0]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xf0]
mov r8, r15
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x60]
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], r13d
mov r13, qword [rsp + 0x70]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
mov rdx, r13
je 0x14004ade8
call fcn.140002b78
jmp 0x14004aded
call fcn.140002f3c
mov rcx, r13
mov r12b, al
call fcn.140075704
mov rdi, r13
mov rcx, rax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, r15
call fcn.140075704
mov rdi, r15
mov rcx, rax
xor eax, eax
rep stosb byte [rdi], al
mov rdi, qword [rsp + 0x68]
mov rcx, rdi
call fcn.140075704
mov rcx, rax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, r13
call fcn.140075884
mov rcx, r15
call fcn.140075884
mov rcx, qword [rsp + 0x68]
call fcn.140075884
xor edi, edi
jmp 0x14004ae8e
lea rcx, [rsp + 0xd0]
movzx eax, sil
xor r9d, r9d
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0xf0]
xor r8d, r8d
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rdi
mov rdx, r14
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, edi
setne r12b
mov rcx, r14
call fcn.140075884
mov rcx, rbp
call fcn.140075884
cmp r12b, dil
jne 0x14004af31
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
cmp byte [rcx + 0x19], dil
je 0x14004aec1
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax + 0x30]
jmp 0x14004aec5
mov rdx, qword [rcx + 0x10]
mov dword [rdx + 0x1c], 1
cmp byte [rcx + 0x19], dil
je 0x14004aedc
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax + 0x30]
jmp 0x14004aee0
mov rcx, qword [rcx + 0x10]
mov byte [rcx + 0x20], dil
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbx]
movsxd rdx, dword [rcx + 4]
add rdx, rbx
mov rcx, qword [rdx + 0x10]
cmp byte [rdx + 0x19], dil
je 0x14004af02
mov rcx, qword [rcx + 0x30]
mov dword [rcx + 0x24], eax
cmp byte [rdx + 0x19], dil
je 0x14004af15
mov rax, qword [rdx + 0x10]
mov rcx, qword [rax + 0x30]
jmp 0x14004af19
mov rcx, qword [rdx + 0x10]
mov byte [rcx + 0x28], dil
mov rcx, qword [rsp + 0x1c0]
xor edx, edx
call fcn.140017da8
jmp 0x14004b0ba
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp sil, dil
je 0x14004b074
lea rcx, [rsp + 0xb0]
call fcn.1400160bc
lea rcx, [rsp + 0x90]
call fcn.1400160bc
lea rcx, [rsp + 0xa0]
call fcn.1400160bc
mov edx, dword [rsp + 0xe0]
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x84], edx
cmp qword [rsp + 0xb8], rdi
jne 0x14004afbb
test al, 2
je 0x14004afbb
mov rcx, qword [rsp + 0x88]
cmp rcx, rdi
je 0x14004afbb
call fcn.14001632c
mov rcx, rax
mov qword [rsp + 0xb8], rax
call fcn.1400163a0
mov eax, dword [rsp + 0x80]
cmp qword [rsp + 0xc0], rdi
jne 0x14004aff2
test al, 4
je 0x14004aff2
mov rcx, qword [rsp + 0x98]
cmp rcx, rdi
je 0x14004aff2
shr eax, 3
test al, 1
jne 0x14004aff2
call fcn.14001632c
mov rcx, rax
mov qword [rsp + 0xc0], rax
call fcn.1400163a0
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
cmp qword [rbx + 0x7f0], rdi
jne 0x14004b02f
call fcn.140075b98
cmp rax, rdi
je 0x14004b01c
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.14004e098
jmp 0x14004b01f
mov rax, rdi
mov qword [rbx + 0x7f0], rax
mov qword [rbx + 0x7e8], rax
jmp 0x14004b06e
call fcn.140075b98
cmp rax, rdi
je 0x14004b04e
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.14004e098
mov rdx, rax
jmp 0x14004b051
mov rdx, rdi
mov rax, qword [rbx + 0x7f0]
mov qword [rdx + 0x10], rax
mov rax, qword [rbx + 0x7f0]
mov qword [rax + 8], rdx
mov qword [rbx + 0x7f0], rdx
inc dword [rbx + 0x7f8]
cmp byte [rsp + 0x1a8], dil
je 0x14004b08f
mov rax, qword [rsp + 0xd0]
mov qword [rbx + 0x7b8], rax
jmp 0x14004b0ba
mov eax, dword [rsp + 0xe0]
mov rcx, qword [rsp + 0x1c0]
pxor xmm1, xmm1
cvtsi2sd xmm1, rax
call fcn.140017f90
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x80]
call fcn.140015ccc
mov rbx, qword [rsp + 0x1a0]
xor eax, eax
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret