Function at 0x140030550
Capabilities:
Create process on windows
Get file attributes
Set current directory

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1680
call fcn.1400ad480
sub rsp, rax
lea rbp, [rsp + 0x60]
mov r14, rcx
mov qword [rbp + 0x1670], rbx
mov rdi, rdx
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x1690]
mov rax, r9
test rdx, rdx
mov r15, r8
cmovne rcx, rdx
xor r12d, r12d
mov qword [rbp + 8], rcx
or r13, 0xffffffffffffffff
mov qword [rcx], r12
mov rcx, qword [rbp + 0x16a8]
test rcx, rcx
je 0x1400305cf
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r8, r13
xor edx, edx
call fcn.14007c070
mov rax, qword [rbp + 0x1678]
test rdi, rdi
je 0x140030abd
cmp word [rdi], r12w
je 0x140030abd
test rax, rax
je 0x1400305f6
cmp word [rax], r12w
cmove rax, r12
mov qword [rbp + 0x1678], rax
mov qword [rbp + 0x10], rdi
mov rbx, r12
mov qword [rbp], rbx
mov rsi, rdi
mov qword [rbp + 0x18], r12
movabs r11, 0xffffffffffffff0
mov rcx, rdi
test r15, r15
je 0x1400306a9
lea rdx, str.find
call fcn.1400981f0
test eax, eax
je 0x140030696
lea rdx, str.explore
mov rcx, rdi
call fcn.1400981f0
test eax, eax
je 0x140030696
lea rdx, str.open
mov rcx, rdi
call fcn.1400981f0
test eax, eax
je 0x140030696
lea rdx, str.edit
mov rcx, rdi
call fcn.1400981f0
test eax, eax
je 0x140030696
lea rdx, str.print
mov rcx, rdi
call fcn.1400981f0
test eax, eax
je 0x140030696
lea rdx, str.properties
mov rcx, rdi
call fcn.1400981f0
test eax, eax
je 0x140030696
mov qword [rbp + 0x18], r15
jmp 0x14003079d
mov rbx, rdi
mov qword [rbp + 0x10], r15
mov qword [rbp], rbx
mov rsi, r15
jmp 0x14003079d
lea rdx, [0x1400cf8a0]
call fcn.14000a680
test rax, rax
je 0x14003079d
sub rax, rdi
sar rax, 1
lea r14, [rax + rax]
lea rax, [r14 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400306d8
mov rcx, r11
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400ad480
sub rsp, rcx
mov r8, r14
mov rdx, rdi
lea rbx, [rsp + 0x60]
mov rcx, rbx
call fcn.140095f70
mov word [r14 + rbx], r12w
cmp word [rbx], 0x2a
jne 0x14003070b
add rbx, 2
jmp 0x14003077d
lea rdx, str.find
mov rcx, rbx
call fcn.1400981f0
test eax, eax
je 0x14003077d
lea rdx, str.explore
mov rcx, rbx
call fcn.1400981f0
test eax, eax
je 0x14003077d
lea rdx, str.open
mov rcx, rbx
call fcn.1400981f0
test eax, eax
je 0x14003077d
lea rdx, str.edit
mov rcx, rbx
call fcn.1400981f0
test eax, eax
je 0x14003077d
lea rdx, str.print
mov rcx, rbx
call fcn.1400981f0
test eax, eax
je 0x14003077d
lea rdx, str.properties
mov rcx, rbx
call fcn.1400981f0
test eax, eax
jne 0x140030793
mov qword [rbp], rbx
test rbx, rbx
je 0x140030796
lea rsi, [rdi + 2]
add rsi, r14
mov qword [rbp + 0x10], rsi
jmp 0x140030796
mov rbx, r12
mov r14, qword [rbp + 0x1660]
xor edx, edx
mov byte [rbp + 0x1668], r12b
mov r8d, 0x400
lea rcx, [rbp + 0x220]
call fcn.140097200
cmp byte [rbp + 0x16a0], r12b
je 0x140030825
mov rax, qword [r14 + 0xbb8]
test rax, rax
je 0x1400307d3
cmp qword [rax + 0x10], r12
jne 0x1400307f7
mov rax, qword [r14 + 0xbd0]
test rax, rax
je 0x1400307e5
cmp qword [rax + 0x10], r12
jne 0x1400307f7
mov rax, qword [r14 + 0xbe8]
test rax, rax
je 0x140030825
cmp qword [rax + 0x10], r12
je 0x140030825
mov r12b, 1
test rbx, rbx
je 0x140030825
cmp byte [rbp + 0x1680], 0
je 0x14003081e
lea r8, [0x1400bbf7c]
mov rcx, r14
lea rdx, str.System_verbs_unsupported_with_RunAs.
call fcn.14002f740
xor eax, eax
jmp 0x140030ac2
mov rbx, r13
nop dword [rax + rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140030830
cmp rbx, 0x4001
jb 0x140030869
cmp byte [rbp + 0x1680], 0
je 0x14003081e
lea r8, [0x1400bbf7c]
mov rcx, r14
lea rdx, str.String_too_long.
call fcn.14002f740
xor eax, eax
jmp 0x140030ac2
cmp qword [rbp], 0
mov esi, 1
mov r14, qword [rbp + 0x1688]
jne 0x140030b2a
xor edx, edx
lea r8d, [rsi + 0x5f]
lea rcx, [rbp + 0xb8]
call fcn.140097200
mov dword [rbp + 0xb0], 0x68
mov dword [rbp + 0xec], esi
test r14, r14
je 0x1400308bf
cmp word [r14], 0
je 0x1400308bf
mov rcx, r14
call fcn.140015e10
mov word [rbp + 0xf0], ax
jmp 0x1400308c6
mov word [rbp + 0xf0], si
xor eax, eax
xor edx, edx
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], rax
test r15, r15
je 0x140030939
cmp word [r15], ax
je 0x140030939
mov rax, r13
inc rax
cmp word [r15 + rax*2], dx
jne 0x1400308e4
add rax, rbx
lea rax, [rax*2 + 0x14]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14003090c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400ad480
sub rsp, rcx
lea rdx, str._s__s
mov r9, r15
mov r8, rdi
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.140004910
xor edx, edx
jmp 0x140030980
lea rax, [rbx*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140030954
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400ad480
sub rsp, rcx
lea rsi, [rsp + 0x60]
mov rcx, rsi
sub rcx, rdi
nop
movzx eax, word [rdi]
mov word [rcx + rdi], ax
lea rdi, [rdi + 2]
test ax, ax
jne 0x140030970
mov r15, qword [rbp + 0x1678]
test r12b, r12b
je 0x140030a12
mov rcx, qword [rbp + 8]
lea rax, [rbp + 0x220]
movzx r8d, byte [rbp + 0x1698]
mov rdx, rsi
mov rdi, qword [rbp + 0x1660]
movzx r9d, byte [rbp + 0x1680]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x1668]
mov qword [rsp + 0x48], rcx
mov rcx, rdi
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x16a8]
mov qword [rsp + 0x30], rax
movzx eax, word [rbp + 0xf0]
mov word [rsp + 0x28], ax
mov byte [rsp + 0x20], r8b
mov r8, r15
call fcn.1400538b0
test eax, eax
je 0x14003081e
cmp byte [rbp + 0x1668], 0
jne 0x140030a8a
jmp 0x140030b38
lea rax, [rbp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp + 0xb0]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140030adc
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x140030a61
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp + 8]
mov qword [rcx], rax
mov rax, qword [rbp + 0x16a8]
test rax, rax
je 0x140030dd5
mov edx, dword [rbp + 0x30]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rax
call fcn.140001460
mov rax, qword [rbp + 8]
cmp byte [rbp + 0x1698], 0
je 0x140030aa5
mov rcx, qword [0x1400ebaa8]
mov dword [rcx + 0x40], 0
cmp qword [rbp + 0x1690], 0
jne 0x140030abd
mov rcx, qword [rax]
test rcx, rcx
je 0x140030abd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rbp + 0x1670]
lea rsp, [rbp + 0x1620]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx r8d, byte [rbp + 0x1698]
lea rcx, [rbp + 0x220]
call fcn.140079db0
xor edx, edx
lea rcx, [rbp + 0x44]
lea r8d, [rdx + 0x6c]
call fcn.140097200
mov dword [rbp + 0x40], WSAStartup
mov dword [rbp + 0x44], 0x440
mov qword [rbp + 0x68], r15
test r14, r14
je 0x140030b67
cmp word [r14], 0
je 0x140030b67
mov rcx, r14
call fcn.140015e10
mov dword [rbp + 0x70], eax
jmp 0x140030b6e
mov r15, qword [rbp + 0x1678]
mov rdi, qword [rbp + 0x1660]
test r12b, r12b
je 0x140030af0
cmp byte [rbp + 0x1680], 0
je 0x14003081e
lea r8, [rbp + 0x220]
mov rcx, rdi
lea rdx, str.Launch_Error__possibly_related_to_RunAs_.
call fcn.14002f740
xor eax, eax
jmp 0x140030ac2
mov dword [rbp + 0x70], 1
mov rdi, qword [rbp]
test rdi, rdi
je 0x140030b92
lea rdx, str.properties
mov qword [rbp + 0x50], rdi
mov rcx, rdi
call fcn.1400981f0
test eax, eax
jne 0x140030b92
or dword [rbp + 0x44], 0xc
mov r12, qword [rbp + 0x18]
test r12, r12
jne 0x140030dcc
lea rax, [rbx*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140030bba
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400ad480
mov r14, qword [rbp + 0x10]
sub rsp, rcx
mov rcx, r14
lea rdi, [rsp + 0x60]
mov rdx, rdi
sub rdx, r14
nop dword [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140030be0
cmp word [rdi], 0x22
jne 0x140030c38
mov edx, SafeArrayAllocDescriptor
lea rcx, [rdi + 2]
call fcn.1400963a8
test rax, rax
je 0x140030c38
xor ebx, ebx
lea r14, [rdi + 2]
mov rdi, qword [rbp]
mov word [rax], bx
cmp word [rax + 2], bx
je 0x140030d0b
cmp word [rax + 2], 0x20
lea r12, [rax + 2]
jne 0x140030d0b
add r12, 2
jmp 0x140030d0b
test r15, r15
je 0x140030c46
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edx, SafeArrayAllocDescriptor
lea rcx, [rdi + 2]
call fcn.1400963a8
mov rsi, rax
test rax, rax
je 0x140030cf3
lea rbx, [rax - 2]
cmp rbx, rdi
jbe 0x140030c8d
nop dword [rax]
movzx edx, word [rbx]
lea rcx, [0x1400d5058]
call fcn.1400963a8
test rax, rax
jne 0x140030c8d
sub rbx, 2
cmp rbx, rdi
ja 0x140030c70
cmp word [rbx], 0x2e
jne 0x140030cdc
xor eax, eax
mov word [rsi], ax
mov rax, rsi
sub rax, rbx
and rax, 0xfffffffffffffffe
cmp rax, 8
jne 0x140030cbc
mov rdx, rbx
lea rcx, str..exe.bat.com.cmd.hta
call fcn.140078ec0
test rax, rax
jne 0x140030cec
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x140030cec
mov eax, SafeArrayAllocDescriptor
lea rcx, [rsi + 2]
mov word [rsi], ax
mov edx, eax
jmp 0x140030c4f
mov eax, SafeArrayAllocDescriptor
lea rcx, [rsi + 2]
mov edx, eax
jmp 0x140030c4f
mov r14, rdi
lea r12, [rsi + 2]
test r15, r15
je 0x140030d05
lea rcx, [0x1400efcc0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rdi, qword [rbp]
xor ebx, ebx
lea rcx, [rbp + 0x40]
mov qword [rbp + 0x58], r14
mov qword [rbp + 0x60], r12
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140030ddd
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400f6be0], eax
jle 0x140030d86
lea rcx, [0x1400f6be0]
call fcn.140093fa4
cmp dword [0x1400f6be0], 0xffffffff
jne 0x140030d86
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetProcessId
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1400f6be0]
mov qword [0x1400f6be8], rax
call fcn.140093f44
mov rcx, qword [rbp + 0xa8]
mov rax, qword [rbp + 8]
mov qword [rax], rcx
test rcx, rcx
je 0x140030a8e
mov rbx, qword [rbp + 0x16a8]
test rbx, rbx
je 0x140030a8e
mov rax, qword [0x1400f6be8]
test rax, rax
je 0x140030a8a
call rax
mov edx, eax
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
jmp 0x140030a85
mov r14, qword [rbp + 0x10]
jmp 0x140030d09
mov rax, rcx
jmp 0x140030a8e
movzx r8d, byte [rbp + 0x1698]
lea rcx, [rbp + 0x220]
call fcn.140079db0
movzx eax, byte [rbp + 0x1680]
test al, al
je 0x14003081e
test rdi, rdi
je 0x140030e22
mov r9, rdi
lea r8, str._nVerb:___s_
mov edx, 0x80
lea rcx, [rbp + 0x120]
call fcn.140078a50
jmp 0x140030e29
mov word [rbp + 0x120], bx
lea rcx, [0x1400bbf7c]
test r12, r12
mov rdx, rcx
mov rax, r13
cmovne rdx, r12
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140030e40
cmp rax, 0x190
lea r9, [0x1400cfe10]
mov r8, rcx
cmova r8, r9
nop
inc r13
cmp word [r14 + r13*2], 0
jne 0x140030e60
mov qword [rsp + 0x38], r8
lea rax, [rbp + 0x120]
mov qword [rsp + 0x30], rdx
lea r8, str.Failed_attempt_to_launch_program_or_document:_nAction:____0.400s_s__s_nParams:____0.400s_s_
mov qword [rsp + 0x28], rax
cmp r13, 0x190
mov edx, 0x800
cmova rcx, r9
mov r9, r14
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x620]
call fcn.140078a50
mov rcx, qword [rbp + 0x1660]
lea r8, [rbp + 0x220]
lea rdx, [rbp + 0x620]
call fcn.14002f740
xor eax, eax
jmp 0x140030ac2