Function at 0x140189000
Capabilities:
Create process on windows
Create process suspended

Disassembly:
jmp 0x140189000
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x46b8
call fcn.140001e38
sub rsp, 0x46b8
lea rbp, [rsp + 0x50]
xor r11d, r11d
mov qword [rbp + 0x1390], rdx
mov rdx, rsp
mov qword [rbp + 0x1398], rcx
mov rdi, r9
mov rsi, r8
lea rcx, [0x140656360]
lea r8, [0x1404e2ee0]
xor r9d, r9d
mov qword [rdx + 0x20], r11
mov edx, 0x1390
xor r10d, r10d
mov dword [0x140657700], 0x44
mov qword [0x140657708], r11
mov qword [0x140657710], r11
mov qword [0x140657718], r11
mov dword [0x14065773c], r10d
mov word [0x140657742], r10w
mov qword [0x140657748], r11
call fcn.1400025f4
movsxd rbx, dword [0x140898f40]
xor ecx, ecx
test rbx, rbx
lea r10, [0x1408b3ee0]
cmovle rbx, rcx
lea r11, [0x1404e2ee4]
mov qword [rbp + 0x4528], rbx
add rbx, 0xc
mov rax, rbx
mov r12, rsp
mov qword [rbp + 0x4520], r10
mov qword [rbp + 0x4530], r11
mov qword [rbp + 0x4538], 0xc
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140001e38
sub rsp, rax
lea rax, [rsp + 0x50]
mov r13, rax
lea rcx, [rbp + 0x4520]
mov edx, 2
mov r8, r13
mov r9, rbx
call fcn.1400048cc
mov rcx, r13
mov rdx, rbx
call fcn.140001929
mov ebx, eax
mov rax, r12
mov rsp, rax
movsxd r12, dword [0x140898f40]
xor ecx, ecx
test r12, r12
lea r10, [0x1408b3ee0]
cmovle r12, rcx
lea r11, [0x1404e2ef4]
mov qword [rbp + 0x4548], r12
add r12, 0xe
mov rax, r12
mov r13, rsp
mov qword [rbp + 0x4540], r10
mov qword [rbp + 0x4550], r11
mov qword [rbp + 0x4558], 0xe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140001e38
sub rsp, rax
lea rax, [rsp + 0x50]
mov r14, rax
lea rcx, [rbp + 0x4540]
mov edx, 2
mov r8, r14
mov r9, r12
call fcn.1400048cc
mov rcx, r14
mov rdx, r12
call fcn.140001929
mov r14d, eax
mov rax, r13
mov rsp, rax
movsxd r12, dword [0x140898f40]
xor ecx, ecx
test r12, r12
lea r10, [0x1408b3ee0]
cmovle r12, rcx
lea r11, [0x1404e2f04]
mov qword [rbp + 0x4568], r12
add r12, 0xc
mov rax, r12
mov r13, rsp
mov qword [rbp + 0x4560], r10
mov qword [rbp + 0x4570], r11
mov qword [rbp + 0x4578], 0xc
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140001e38
sub rsp, rax
lea rax, [rsp + 0x50]
mov r15, rax
lea rcx, [rbp + 0x4560]
mov edx, 2
mov r8, r15
mov r9, r12
call fcn.1400048cc
mov rcx, r15
mov rdx, r12
call fcn.140001929
mov edx, eax
mov rax, r13
mov rsp, rax
and ebx, 1
je 0x1401892d4
cmp byte [0x1408bce7f], 0x59
je 0x14018929a
and r14d, 1
jne 0x1401892de
test dl, 1
je 0x140189260
cmp byte [0x1408bce7f], 0x4e
je 0x1401893d4
mov rbx, rsp
lea rcx, [0x140656360]
mov edx, 0x1390
lea r8, [0x1404e2f14]
mov r9d, 0xc
mov qword [rbx + 0x20], 0
call fcn.1400025f4
lea rcx, [0x1404e2f24]
mov edx, 0x26
jmp 0x140189409
mov rbx, rsp
lea rcx, [0x140656360]
mov edx, 0x1390
lea r8, str.WINEXCEL.EXE
mov r9d, 0xc
mov qword [rbx + 0x20], 0
call fcn.1400025f4
lea rcx, str._Activating_Excel_32_bit_interface_...
mov edx, 0x26
jmp 0x140189409
and r14d, 1
je 0x140189382
cmp byte [0x1408bce7f], 0x36
je 0x140189348
test dl, 1
je 0x140189306
cmp byte [0x1408bce7f], 0x4e
je 0x1401893d4
test ebx, ebx
jne 0x140189260
jmp 0x140189394
test ebx, ebx
jne 0x140189260
mov rbx, rsp
lea rcx, [0x140656360]
mov edx, 0x1390
lea r8, [0x1404e2f84]
mov r9d, 0xe
mov qword [rbx + 0x20], 0
call fcn.1400025f4
lea rcx, [0x1404e2f94]
mov edx, 0x26
jmp 0x140189409
mov rbx, rsp
lea rcx, [0x140656360]
mov edx, 0x1390
lea r8, str.WINEXCEL64.EXE
mov r9d, 0xe
mov qword [rbx + 0x20], 0
call fcn.1400025f4
lea rcx, str._Activating_Excel_64_bit_interface_...
mov edx, 0x26
jmp 0x140189409
test dl, 1
je 0x140189e01
cmp byte [0x1408bce7f], 0x4e
je 0x1401893d4
test r14d, r14d
jne 0x14018930e
mov rbx, rsp
lea rcx, [0x140656360]
mov edx, 0x1390
lea r8, [0x1404e2ff4]
mov r9d, 0xc
mov qword [rbx + 0x20], 0
call fcn.1400025f4
lea rcx, [0x1404e3004]
mov edx, 0x24
jmp 0x140189409
mov rbx, rsp
lea rcx, [0x140656360]
mov edx, 0x1390
lea r8, [0x1404e302c]
mov r9d, 0xc
mov qword [rbx + 0x20], 0
call fcn.1400025f4
lea rcx, str._Activating_Excel.xlsm_interface_...
mov edx, 0x24
call fcn.140004ad9
mov rbx, rsp
lea rcx, [0x140656360]
mov edx, 0x1390
lea r8, [0x1404e3064]
mov r9d, 0xc
mov qword [rbx + 0x20], 3
call fcn.140003ef4
test eax, eax
je 0x140189711
movsxd r9, dword [0x140898f40]
xor edx, edx
test r9, r9
mov r12, rsp
cmovle r9, rdx
mov rax, r9
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140001e38
sub rsp, rax
lea rax, [rsp + 0x50]
mov rbx, rax
mov edx, r9d
mov rcx, rbx
lea r8, [0x1408b3ee0]
call fcn.140002c52
mov qword [rbp + 0x44b8], rbx
lea rbx, [0x140656360]
mov edx, 2
lea rcx, [rbp + 0x44b8]
mov r8, rbx
mov r9d, 0x1390
movsxd rax, eax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], 0x1390
call fcn.1400048cc
mov rax, r12
mov rsp, rax
lea rbx, str._____T__.
mov edx, 0x1390
mov qword [rbp + 0x42e8], rbx
lea rbx, [rbp]
mov rcx, rbx
lea r8, [0x140656360]
mov r9d, edx
mov r12, rsp
mov qword [rbp + 0x42f0], 1
call fcn.140002c52
mov edx, 0xc
lea rcx, [rbp + 0x44e0]
mov qword [rbp + 0x42f8], rbx
lea rbx, [0x1404e3078]
movsxd rax, eax
lea r9, [0x1404e307c]
mov qword [rbp + 0x4308], rbx
mov ebx, 1
mov r8, qword [rbp + 0x1398]
mov qword [rbp + 0x4300], rax
mov qword [rbp + 0x4310], rbx
mov qword [rbp + 0x4318], r9
mov qword [rbp + 0x4320], rbx
call fcn.140004390
mov edx, 0xc
lea r13, [rbp + 0x44f0]
mov rcx, r13
lea r8, [rbp + 0x44e0]
mov r9d, edx
call fcn.140002c52
mov edx, 0xc
lea rcx, [rbp + 0x4500]
movsxd rax, eax
lea r9, [0x1404e3080]
mov r8, qword [rbp + 0x1390]
mov qword [rbp + 0x4328], r13
mov qword [rbp + 0x4330], rax
mov qword [rbp + 0x4338], r9
mov qword [rbp + 0x4340], 1
call fcn.140004390
mov edx, 0xc
lea r13, [rbp + 0x4510]
mov rcx, r13
lea r8, [rbp + 0x4500]
mov r9d, edx
call fcn.140002c52
movsxd rax, eax
lea rdx, [0x1404e3084]
mov qword [rbp + 0x4350], rax
mov rax, rdi
mov qword [rbp + 0x4348], r13
mov qword [rbp + 0x4358], rdx
mov qword [rbp + 0x4360], 1
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140001e38
sub rsp, rax
lea rax, [rsp + 0x50]
mov r13, rax
mov edx, edi
mov rcx, r13
mov r8, rsi
mov r9d, edi
call fcn.140002c52
mov edx, 0xa
lea rcx, [rbp + 0x42e8]
lea r8, [0x140656360]
mov r9d, 0x1390
movsxd rax, eax
lea r10, [rbp + 0x4620]
mov qword [rbp + 0x4368], r13
mov qword [rbp + 0x4370], rax
mov byte [r10], 0
mov qword [rbp + 0x4378], r10
mov qword [rbp + 0x4380], 1
call fcn.1400048cc
mov rax, r12
mov rsp, rax
mov r13, rsp
xor r10d, r10d
xor ecx, ecx
lea rdx, [0x140656360]
xor r8d, r8d
xor r9d, r9d
lea r11, [0x140657700]
lea r12, [0x1406579a8]
mov dword [r13 + 0x20], 0
mov dword [r13 + 0x28], 0x28
mov qword [r13 + 0x30], r10
mov qword [r13 + 0x38], r10
mov qword [r13 + 0x40], r11
mov qword [r13 + 0x48], r12
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
je 0x140189716
mov rcx, qword [0x1406579a8]
test rcx, rcx
je 0x1401896ef
cmp byte [0x1408b9740], 0x59
je 0x1401896de
test byte [0x1408bdc14], 1
jne 0x1401896ef
mov edx, 0x2710
call sub.KERNEL32.dll_WaitForSingleObject
mov rcx, qword [0x1406579a8]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [0x1406579b0]
call sub.KERNEL32.dll_CloseHandle
lea rcx, [0x1406579b8]
call fcn.14000317f
jmp 0x140189e96
mov ebx, 1
mov r10, rsp
lea rcx, [0x140657780]
lea rdx, [0x1404e3088]
lea r8, [0x1404e2e80]
mov r9d, 0x104
mov qword [r10 + 0x20], 1
call fcn.14000494e
mov edx, 0xc
lea rcx, [rbp + 0x4580]
mov r8, qword [rbp + 0x1398]
mov r13, rsp
call fcn.140004390
mov edx, 0xc
lea r14, [rbp + 0x4590]
mov rcx, r14
lea r8, [rbp + 0x4580]
mov r9d, edx
call fcn.140002c52
mov edx, 0xc
lea rcx, [rbp + 0x45a0]
movsxd r12, eax
lea r9, [0x1408bce7e]
mov r8, qword [rbp + 0x1390]
lea r10, [0x1404e308c]
mov qword [rbp + 0x4428], r14
mov qword [rbp + 0x4430], r12
mov qword [rbp + 0x4438], r9
mov qword [rbp + 0x4440], rbx
mov qword [rbp + 0x4448], r10
mov qword [rbp + 0x4450], rbx
call fcn.140004390
mov edx, 0xc
lea rcx, [rbp + 0x45b0]
mov r9d, edx
lea r8, [rbp + 0x45a0]
call fcn.140002c52
movsxd rax, eax
lea rdx, [rbp + 0x45b0]
mov qword [rbp + 0x4480], rdi
add rdi, r12
mov qword [rbp + 0x4460], rax
lea rcx, [0x1404e3090]
mov qword [rbp + 0x4458], rdx
mov qword [rbp + 0x4468], rcx
mov qword [rbp + 0x4470], 1
lea rdi, [rdi + rax + 3]
mov rax, rdi
mov qword [rbp + 0x4478], rsi
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140001e38
sub rsp, rax
lea rax, [rsp + 0x50]
mov rsi, rax
lea rcx, [rbp + 0x4428]
mov edx, 6
mov r8, rsi
mov r9, rdi
call fcn.1400048cc
lea rcx, [0x1404e2e80]
mov rdx, rsi
mov r8, rdi
call fcn.140002e00
mov rax, r13
mov rsp, rax
lea rcx, [0x1404e2e80]
call fcn.140001163
mov rax, rsp
lea rcx, [0x140657780]
mov edx, 0x104
lea r8, [0x1404e3094]
mov r9d, 1
mov dword [rax + 0x20], 0xffffffff
call fcn.140006019
lea rsi, [0x140657780]
mov r10, rsp
movsxd rax, eax
xor edi, edi
mov rdx, rax
lea r8, [0x1404e3098]
neg rdx
mov r9d, 4
add rdx, 0x104
mov qword [r10 + 0x20], rdi
lea rcx, [rsi + rax]
cmovle rdx, rdi
call fcn.1400025f4
mov rax, rsp
lea rcx, [0x1406578a0]
lea rdx, [0x1404e30a0]
lea r8, [0x1404e2e80]
mov r9d, 0x104
mov qword [rax + 0x20], 1
call fcn.14000494e
movsxd r10, dword [0x140898f40]
lea r13, str.WINEXCEL.DAT
mov qword [rbp + 0x4398], r13
lea rdx, [rbp + 0x4650]
mov qword [rbp + 0x43c8], rdx
mov edx, 0x104
test r10, r10
lea r13, [rbp + 0x4170]
mov rcx, r13
lea rsi, [rbp + 0x4630]
mov qword [rbp + 0x4498], rsi
mov esi, 0
lea r8, [0x140657780]
mov r9d, edx
lea rdi, str.COPY__b
cmovg rsi, r10
mov qword [rbp + 0x4488], rdi
mov dil, 0x22
lea r11, [0x1408b3ee0]
lea r14, [rbp + 0x4640]
lea r15, [0x1404e30c0]
mov r12, rsp
mov qword [rbp + 0x4490], 8
mov byte [r14 - 0x10], dil
mov qword [rbp + 0x44a0], rbx
mov qword [rbp + 0x4388], r11
mov qword [rbp + 0x4390], rsi
mov qword [rbp + 0x43a0], 0xc
mov byte [r14], dil
mov qword [rbp + 0x43a8], r14
mov qword [rbp + 0x43b0], rbx
mov qword [rbp + 0x43b8], r15
mov qword [rbp + 0x43c0], rbx
mov byte [r14 + 0x10], dil
mov qword [rbp + 0x43d0], rbx
call fcn.140002c52
movsxd rax, eax
mov qword [rbp + 0x43d8], r13
lea r13, [rbp + 0x4660]
mov qword [rbp + 0x43e8], r13
mov qword [rbp + 0x43e0], rax
mov byte [r13], 0x22
lea r13, [rsi + rax + 0x10]
mov rax, r13
mov qword [rbp + 0x43f0], 1
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140001e38
sub rsp, rax
lea rax, [rsp + 0x50]
mov rsi, rax
lea rcx, [rbp + 0x4388]
mov edx, 7
mov r8, rsi
mov r9, r13
call fcn.1400048cc
mov edx, 0x12c
lea r14, [rbp + 0x3de0]
mov rcx, r14
mov r8, rsi
mov r9, r13
call fcn.1400042eb
mov edx, 3
lea rcx, [rbp + 0x4488]
lea r8, [0x140656360]
mov r9d, 0x1390
mov qword [rcx + 0x20], r14
mov qword [rcx + 0x28], 0x12c
call fcn.1400048cc
mov rax, r12
mov rsp, rax
mov edx, 0x1390
lea rcx, [rbp + 0x1390]
lea r8, [0x140656360]
mov r9d, edx
call fcn.140002c52
movsxd rax, eax
lea rcx, [0x1404e2e80]
mov r8, rax
lea rdx, [rbp + 0x1390]
call fcn.140002e00
lea rcx, [0x1404e2e80]
call fcn.140001163
mov edx, 0x12c
lea rcx, [rbp + 0x3f10]
lea r8, [0x1406578a0]
mov r9d, 0x104
call fcn.1400042eb
mov edx, 0x12c
lea rcx, [rbp + 0x3f10]
call fcn.140004c69
mov rax, rsp
lea rcx, [0x1406578a0]
lea rdx, [0x1404e30c4]
lea r8, [0x1404e2e80]
mov r9d, 0x104
mov qword [rax + 0x20], 1
call fcn.14000494e
lea rcx, [0x1408b3ddc]
lea rdx, str..xlsm
mov r8d, 0x104
mov r9d, 5
call fcn.140001771
lea rcx, [0x1408b3ddc]
mov edx, 0x104
call fcn.14000425a
test eax, eax
jne 0x140189b8c
lea rcx, [0x1408b3ddc]
lea rdx, str..xlsx
mov r8d, 0x104
mov r9d, 5
call fcn.140001771
lea rcx, [0x1408b3ddc]
mov edx, 0x104
call fcn.14000425a
test eax, eax
jne 0x140189bc0
lea rcx, [0x1408b3ddc]
lea rdx, [0x1404e30d8]
mov r8d, 0x104
mov r9d, 4
call fcn.140001771
lea rcx, [0x1408b3ddc]
mov edx, 0x104
call fcn.14000425a
test eax, eax
jne 0x140189c44
mov edx, 0x104
lea rbx, [rbp + 0x3ab0]
mov rcx, rbx
lea r8, [0x140657780]
mov r9d, edx
lea rax, [rbp + 0x45c0]
mov byte [rax], 0x22
mov qword [rbp + 0x43f8], rax
mov qword [rbp + 0x4400], 1
call fcn.140002c52
movsxd rax, eax
lea rdx, [rbp + 0x45e0]
mov qword [rbp + 0x4408], rbx
lea rcx, [rbp + 0x43f8]
mov qword [rcx + 0x18], rax
mov byte [rdx], 0x22
mov qword [rcx + 0x20], rdx
mov edx, 3
mov qword [rcx + 0x28], 1
jmp 0x140189d2a
mov edx, 0x104
lea rsi, [rbp + 0x3bc0]
mov rcx, rsi
lea r8, [0x1408b3ddc]
mov r9d, edx
lea rax, [rbp + 0x45d0]
mov byte [rax], 0x22
mov qword [rbp + 0x4278], rax
mov qword [rbp + 0x4280], 1
call fcn.140002c52
mov qword [rbp + 0x42a0], rbx
mov edx, 0x104
mov qword [rbp + 0x42b0], rbx
lea rcx, [rbp + 0x45f0]
mov qword [rbp + 0x42c0], rbx
lea rbx, [rbp + 0x3cd0]
mov qword [rbp + 0x4298], rcx
mov rcx, rbx
lea r8, [0x140657780]
mov r9d, edx
mov qword [rbp + 0x4288], rsi
lea rsi, [0x1404e30e0]
movsxd rax, eax
mov byte [rbp + 0x45f0], dil
mov byte [rbp + 0x4600], dil
lea rdi, [rbp + 0x4600]
mov qword [rbp + 0x4290], rax
mov qword [rbp + 0x42a8], rsi
mov qword [rbp + 0x42b8], rdi
call fcn.140002c52
movsxd rax, eax
lea rdx, [rbp + 0x4610]
mov qword [rbp + 0x42c8], rbx
lea rcx, [rbp + 0x4278]
mov qword [rcx + 0x58], rax
mov byte [rdx], 0x22
mov qword [rcx + 0x60], rdx
mov edx, 7
mov qword [rcx + 0x68], 1
lea r8, [0x140656360]
mov r9d, 0x1390
call fcn.1400048cc
mov edx, 0x1390
lea rcx, [rbp + 0x2720]
lea r8, [0x140656360]
mov r9d, edx
call fcn.140002c52
movsxd rax, eax
lea rcx, [0x1404e2e80]
mov r8, rax
lea rdx, [rbp + 0x2720]
call fcn.140002e00
lea rcx, [0x1404e2e80]
call fcn.140001163
mov ebx, 0x3e8
call fcn.140002360
mov ecx, 0x64
call sub.KERNEL32.dll_Sleep
lea rcx, [0x140657780]
mov edx, 0x104
call fcn.140001929
test al, 1
jne 0x140189da9
dec ebx
jge 0x140189d81
mov edx, 0x12c
lea rcx, [rbp + 0x4040]
lea r8, [0x1406578a0]
mov r9d, 0x104
call fcn.1400042eb
mov edx, 0x12c
lea rcx, [rbp + 0x4040]
call fcn.140004c69
test byte [0x1408bdc14], 1
je 0x140189df2
lea rcx, str._Excel_.xlsm_workbook_should_activate_soon._Please_continue_...
mov edx, 0x3f
call fcn.140004ad9
mov ecx, 0x3e8
call sub.KERNEL32.dll_Sleep
jmp 0x140189e96
test r14d, r14d
jne 0x14018930e
movsxd rcx, dword [0x140898f40]
xor esi, esi
test rcx, rcx
lea rdx, str._Excel_interface_failed.
cmovg rsi, rcx
lea rdi, [0x1408b3ee0]
mov qword [rbp + 0x18], rsi
add rsi, 0x33
mov rax, rsi
lea r8, str.WINEXCEL_module_not_found.
mov qword [rbp], rdx
mov rbx, rsp
mov qword [rbp + 8], 0x19
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], 0x1a
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140001e38
sub rsp, rax
lea rax, [rsp + 0x50]
mov rdi, rax
lea rcx, [rbp]
mov edx, 3
mov r8, rdi
mov r9, rsi
call fcn.1400048cc
mov rcx, rdi
mov rdx, rsi
call fcn.1400040c0
mov rax, rbx
mov rsp, rax
lea rsp, [rbp + 0x4668]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret