Function at 0x1400fddf7
Capabilities:
Create process on windows

Disassembly:
push rbp
sub rsp, 0x1e0
lea rbp, [rsp + 0x80]
mov eax, edx
mov edx, ecx
mov word [rbp + 0x170], dx
mov word [rbp + 0x178], ax
mov eax, r8d
mov word [rbp + 0x180], ax
mov dword [rbp + 0x154], 0xab7add75
movzx eax, word [rbp + 0x178]
mov word [rbp + 0xb6], ax
movzx eax, word [rbp + 0xb6]
movzx eax, ax
test eax, eax
je 0x1400fdecd
cmp eax, 0x133
jne 0x1400fdeef
mov r8, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x138]
mov rax, qword [rbp + 0x140]
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellAboutW]
call rax
mov dword [rbp + 0xc8], eax
mov ecx, 0x16
call fcn.1400fe14c
mov dword [rbp + 0xc8], 0x8088d13
lea rcx, [rbp + 0xb8]
mov rdx, qword [rbp + 0x118]
mov rax, qword [rbp + 0x120]
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ExtractAssociatedIconW]
call rax
mov qword [rbp + 0xb8], rax
jmp 0x1400fdeef
sub dword [rbp + 0x154], 0x7b265a9f
lea rax, [rbp + 0xb6]
mov qword [rbp + 0x148], rax
mov word [rbp + 0xce], 0x43aa
nop
mov rax, qword [rbp + 0x148]
movzx eax, word [rax]
movzx edx, ax
movzx eax, word [rbp + 0xb6]
movzx eax, ax
add edx, eax
movzx eax, word [rbp + 0x180]
and ax, word [rbp + 0x178]
movzx eax, ax
cmp edx, eax
jle 0x1400fdfc5
mov rax, qword [rbp + 0x148]
movzx eax, word [rax]
movzx edx, ax
movzx eax, word [rbp + 0xb6]
movzx eax, ax
mov ecx, eax
sar edx, cl
mov eax, edx
mov edx, eax
mov rax, qword [rbp + 0x148]
mov word [rax], dx
mov ecx, 0x65
call fcn.1400fe82e
movzx eax, word [rbp + 0xb6]
mov word [rbp + 0x178], ax
mov rax, qword [rbp + 0x110]
mov edx, 0xb8
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_SHGetIconOverlayIndexW]
call rax
mov dword [rbp + 0xc4], eax
mov rax, qword [rbp + 0x148]
movzx eax, word [rax]
movzx edx, ax
movzx eax, word [rbp + 0xb6]
movzx eax, ax
mov ecx, eax
shl edx, cl
mov eax, edx
mov edx, eax
mov rax, qword [rbp + 0x148]
mov word [rax], dx
movzx eax, word [rbp + 0xb6]
movzx eax, ax
mov r8d, 0x7a
mov edx, eax
mov ecx, 7
call fcn.1400fd6ca
mov byte [rbp + 0x10f], 0x72
movzx eax, word [rbp + 0xce]
cmp ax, 0xf84
jle 0x1400fe100
mov rax, qword [rbp + 0x148]
movzx eax, word [rax]
movzx eax, ax
test eax, eax
jne 0x1400fe081
movzx eax, word [rbp + 0xce]
cwde
cmp eax, 0x322
je 0x1400fe00a
cmp eax, 0x43aa
je 0x1400fe01d
jmp 0x1400fe057
mov rax, qword [rbp + 0x148]
movzx eax, word [rax]
mov word [rbp + 0x180], ax
jmp 0x1400fe057
lea rax, [rbp + 0xce]
mov qword [rbp + 0x100], rax
lea rax, [rbp + 0xc8]
mov qword [rbp + 0xf8], rax
mov eax, dword [rbp + 0x154]
mov dword [rbp + 0xf4], eax
movabs rax, 0x34338354ffca512e
mov qword [rbp + 0x158], rax
nop
lea rax, [rbp + 0xc4]
mov qword [rbp + 0xe8], rax
mov eax, dword [rbp + 0x154]
mov dword [rbp + 0xe4], eax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0xd8], rax
jmp 0x1400fe0e0
movzx eax, word [rbp + 0xb6]
xor ax, word [rbp + 0x170]
mov edx, eax
mov rax, qword [rbp + 0x148]
mov word [rax], dx
movzx eax, word [rbp + 0xce]
add ax, 0x1565
mov word [rbp + 0xce], ax
lea rax, [rbp + 0x10]
mov rcx, rax
mov rax, qword [sym.imp.comdlg32.dll_GetOpenFileNameW]
call rax
mov dword [rbp + 0xd4], eax
movzx ecx, word [rbp + 0xb6]
movzx eax, word [rbp + 0x178]
sub eax, ecx
mov edx, eax
mov rax, qword [rbp + 0x148]
mov word [rax], dx
nop
movzx edx, byte [rbp + 0x10f]
movzx eax, word [rbp + 0xb6]
movzx eax, ax
mov r8d, edx
mov edx, eax
mov ecx, 7
call fcn.1400fe387
movzx eax, word [rbp + 0xb6]
or ax, word [rbp + 0x178]
mov edx, eax
mov rax, qword [rbp + 0x148]
mov word [rax], dx
lea rax, [rbp - 0x60]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExW]
call rax
mov dword [rbp + 0xd0], eax
movzx eax, word [rbp + 0x180]
mov word [rbp + 0x170], ax
mov eax, 0x40
add rsp, 0x1e0
pop rbp
ret