Function at 0x140011488
Capabilities:
Create process on windows
Get common file path

Disassembly:
jmp 0x140016d30
push rbp
push rdi
sub rsp, 0x2a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x6e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140028018]
xor rax, rbp
mov qword [rbp + 0x268], rax
lea rcx, [0x14002e117]
call fcn.1400116a4
lea r9, [rbp + 8]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140024138]
call fcn.1400112c1
test eax, eax
jl 0x140016e61
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x28]
call fcn.140011221
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea r9, str._c_start__temp_
lea r8, str.cmd.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rbp + 0x68], rax
cmp dword [rbp + 0x68], 0x20
jle 0x140016e0a
lea rdx, str.Temp_folder_opened.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011370
mov qword [rbp + 0x258], rax
lea rdx, [0x140011343]
mov rcx, qword [rbp + 0x258]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x140016e56
cmp dword [rbp + 0x68], 0x20
jg 0x140016e56
lea rdx, str.Could_not_open_temp_folder.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140011370
mov qword [rbp + 0x258], rax
mov edx, dword [rbp + 0x68]
mov rcx, qword [rbp + 0x258]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int____ptr64]
mov qword [rbp + 0x260], rax
lea rdx, [0x140011343]
mov rcx, qword [rbp + 0x260]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x28]
call fcn.1400115e6
jmp 0x140016e8f
lea rdx, str.Could_not_get_temp_folder_file_path.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140011370
mov qword [rbp + 0x258], rax
lea rdx, [0x140011343]
mov rcx, qword [rbp + 0x258]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r9, [rbp + 0x88]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140023e80]
call fcn.1400112c1
test eax, eax
jl 0x140016fa6
mov rdx, qword [rbp + 0x88]
lea rcx, [rbp + 0xa8]
call fcn.140011221
nop
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rbp + 0xa8]
call fcn.14001122b
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, str.explorer.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rbp + 0xe8], rax
cmp dword [rbp + 0xe8], 0x20
jle 0x140016f46
lea rdx, str.Recent_folder_opened.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011370
mov qword [rbp + 0x258], rax
lea rdx, [0x140011343]
mov rcx, qword [rbp + 0x258]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x140016f98
cmp dword [rbp + 0xe8], 0x20
jg 0x140016f98
lea rdx, str.Could_not_open_recent_folder.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140011370
mov qword [rbp + 0x258], rax
mov edx, dword [rbp + 0xe8]
mov rcx, qword [rbp + 0x258]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int____ptr64]
mov qword [rbp + 0x260], rax
lea rdx, [0x140011343]
mov rcx, qword [rbp + 0x260]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rbp + 0xa8]
call fcn.1400115e6
jmp 0x140016fd4
lea rdx, str.Could_not_get_recent_folder_file_path.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140011370
mov qword [rbp + 0x258], rax
lea rdx, [0x140011343]
mov rcx, qword [rbp + 0x258]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x140021ab0]
lea rcx, [rbp + 0x108]
call fcn.1400112ee
nop
lea rax, str.C:WindowsPrefetch
mov qword [rbp + 0x148], rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x148]
lea r8, str.explorer.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rbp + 0x168], rax
cmp dword [rbp + 0x168], 0x20
jle 0x140017064
lea rdx, str.Prefetch_folder_opened.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011370
mov qword [rbp + 0x258], rax
lea rdx, [0x140011343]
mov rcx, qword [rbp + 0x258]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x1400170b5
cmp dword [rbp + 0x168], 0x20
jg 0x1400170b5
lea rdx, str.Could_not_open__folder.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140011370
mov qword [rbp + 0x258], rax
mov edx, dword [rbp + 0x168]
mov rcx, qword [rbp + 0x258]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int____ptr64]
mov qword [rbp + 0x260], rax
lea rdx, [0x140011343]
mov rcx, qword [rbp + 0x260]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rbp + 0x244], 0
lea rcx, [rbp + 0x108]
call fcn.14001113b
mov eax, dword [rbp + 0x244]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400211f0]
call fcn.14001159b
mov eax, edi
mov rcx, qword [rbp + 0x268]
xor rcx, rbp
call fcn.140011339
lea rsp, [rbp + 0x278]
pop rdi
pop rbp
ret