Function at 0x140006870
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140019030]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, rcx
xor ebx, ebx
mov dword [rbp - 0x28], ebx
lea rdx, [0x140019d30]
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov dil, 1
lea edx, [rbx + 0x2e]
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_COleControl::ReleaseCaches]
mov esi, eax
cmp eax, 0xffffffff
je 0x1400069fc
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
sub eax, esi
lea r8d, [rax - 1]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_12600]
nop
lea rdx, [0x140011d78]
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CFileFind::CloseContext]
test eax, eax
je 0x14000691c
lea rdx, [0x140011d80]
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CFileFind::CloseContext]
test eax, eax
jne 0x14000691f
xor dil, dil
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test dil, dil
jne 0x1400069fc
mov edx, 0x92
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_CRuntimeClass::IsDerivedFrom]
lea rdx, [0x140011d88]
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_COleCurrency::operator_]
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1667]
mov rdi, qword [rbp - 0x30]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonComboBox::FindItem]
test rax, rax
je 0x14000697c
mov rbx, qword [rax + 0x40]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.14000b9a0
test rax, rax
jne 0x140006ab1
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov edx, 0x94
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CRuntimeClass::IsDerivedFrom]
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
mov edx, 0x7a
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CRuntimeClass::IsDerivedFrom]
mov r9d, 0x30
mov r8, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x20]
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCRibbonStatusBar::LoadState]
nop
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x140006ab1
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov dword [rbp - 0x28], 1
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
lea rdx, str.file:__
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x140006a32
mov dword [rsp + 0x20], eax
mov r9, qword [rbp - 0x30]
mov r8d, ecx
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str._contextIdAttach_Digital_Signature
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1667]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
mov r9, qword [rbp - 0x30]
lea r8, str.IEXPLORE
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbp - 0x18]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14000dba0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret