Function at 0x14003a7b0
Capabilities:
Create process on windows
Get file attributes
Set current directory

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1680
call fcn.1400c1030
sub rsp, rax
lea rbp, [rsp + 0x50]
mov r14, rcx
mov qword [rbp + 0x1680], rbx
mov rdi, rdx
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x16a0]
mov rax, r9
test rdx, rdx
mov r15, r8
cmovne rcx, rdx
xor r12d, r12d
mov qword [rbp + 0x10], rcx
or r13, 0xffffffffffffffff
mov qword [rcx], r12
mov rcx, qword [rbp + 0x16b8]
test rcx, rcx
je 0x14003a82f
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r8, r13
xor edx, edx
call fcn.14008f420
mov rax, qword [rbp + 0x1688]
test rdi, rdi
je 0x14003b180
movzx edx, word [rdi]
test dx, dx
je 0x14003b180
test rax, rax
je 0x14003a858
cmp word [rax], r12w
cmove rax, r12
mov qword [rbp + 0x1688], rax
mov qword [rbp + 0x18], r12
mov r9, r12
mov qword [rbp + 8], rdi
mov rsi, rdi
mov qword [rbp + 0x28], r12
mov eax, SafeArrayAllocDescriptor
movabs r10, 0xffffffffffffff0
test r15, r15
je 0x14003a913
lea rdx, str.find
mov rcx, rdi
call fcn.1400abda0
test eax, eax
je 0x14003a900
lea rdx, str.explore
mov rcx, rdi
call fcn.1400abda0
test eax, eax
je 0x14003a900
lea rdx, str.open
mov rcx, rdi
call fcn.1400abda0
test eax, eax
je 0x14003a900
lea rdx, str.edit
mov rcx, rdi
call fcn.1400abda0
test eax, eax
je 0x14003a900
lea rdx, str.print
mov rcx, rdi
call fcn.1400abda0
test eax, eax
je 0x14003a900
lea rdx, str.properties
mov rcx, rdi
call fcn.1400abda0
test eax, eax
je 0x14003a900
mov qword [rbp + 0x28], r15
mov r9, r12
jmp 0x14003aa33
mov r9, rdi
mov qword [rbp + 0x18], rdi
mov rsi, r15
mov qword [rbp + 8], r15
jmp 0x14003aa33
mov r8, rdi
nop word [rax + rax]
lea rcx, [0x1400e3a80]
cmp dx, ax
je 0x14003a951
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14003a927
movzx edx, word [r8 + 2]
add r8, 2
mov eax, SafeArrayAllocDescriptor
test dx, dx
jne 0x14003a920
jmp 0x14003aa33
sub r8, rdi
sar r8, 1
lea r14, [r8 + r8]
lea rax, [r14 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14003a96b
mov rcx, r10
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400c1030
sub rsp, rcx
mov r8, r14
mov rdx, rdi
lea rbx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400a9ee0
mov word [r14 + rbx], r12w
cmp word [rbx], 0x2a
jne 0x14003a99e
lea r9, [rbx + 2]
jmp 0x14003aa13
lea rdx, str.find
mov rcx, rbx
call fcn.1400abda0
test eax, eax
je 0x14003aa10
lea rdx, str.explore
mov rcx, rbx
call fcn.1400abda0
test eax, eax
je 0x14003aa10
lea rdx, str.open
mov rcx, rbx
call fcn.1400abda0
test eax, eax
je 0x14003aa10
lea rdx, str.edit
mov rcx, rbx
call fcn.1400abda0
test eax, eax
je 0x14003aa10
lea rdx, str.print
mov rcx, rbx
call fcn.1400abda0
test eax, eax
je 0x14003aa10
lea rdx, str.properties
mov rcx, rbx
call fcn.1400abda0
test eax, eax
jne 0x14003aa29
mov r9, rbx
mov qword [rbp + 0x18], r9
test r9, r9
je 0x14003aa2c
lea rsi, [rdi + 2]
add rsi, r14
mov qword [rbp + 8], rsi
jmp 0x14003aa2c
mov r9, r12
mov r14, qword [rbp + 0x1670]
mov eax, r12d
mov byte [rbp], r12b
mov dword [rbp + 0x20], eax
cmp byte [rbp + 0x16b0], al
je 0x14003aaac
mov rcx, qword [r14 + 0xbd8]
test rcx, rcx
je 0x14003aa57
cmp qword [rcx + 0x10], rax
jne 0x14003aa7b
mov rcx, qword [r14 + 0xbf0]
test rcx, rcx
je 0x14003aa69
cmp qword [rcx + 0x10], rax
jne 0x14003aa7b
mov rcx, qword [r14 + 0xc08]
test rcx, rcx
je 0x14003aaac
cmp qword [rcx + 0x10], rax
je 0x14003aaac
mov byte [rbp + 0x1678], 1
test r9, r9
je 0x14003aab2
cmp byte [rbp + 0x1690], al
je 0x14003aaa5
lea r8, [0x1400cfffc]
mov rcx, r14
lea rdx, str.System_verbs_unsupported_with_RunAs.
call fcn.1400393c0
xor eax, eax
jmp 0x14003b185
mov byte [rbp + 0x1678], al
mov rbx, r13
inc rbx
cmp word [rsi + rbx*2], ax
jne 0x14003aab5
cmp rbx, 0x4001
jb 0x14003aaec
cmp byte [rbp + 0x1690], al
je 0x14003aaa5
lea r8, [0x1400cfffc]
mov rcx, r14
lea rdx, str.String_too_long.
call fcn.1400393c0
xor eax, eax
jmp 0x14003b185
mov r14, qword [rbp + 0x1698]
mov r12d, 1
test r9, r9
jne 0x14003ad5e
xor edx, edx
lea r8d, [r12 + 0x5f]
lea rcx, [rbp + 0xc8]
call fcn.1400aad30
mov dword [rbp + 0xc0], 0x68
mov dword [rbp + 0xfc], r12d
test r14, r14
je 0x14003ab43
cmp word [r14], 0
je 0x14003ab43
mov rcx, r14
call fcn.1400193a0
mov word [rbp + 0x100], ax
jmp 0x14003ab4b
mov word [rbp + 0x100], r12w
xor eax, eax
xor edx, edx
mov qword [rbp + 0x30], rdx
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rax
test r15, r15
je 0x14003abc5
cmp word [r15], ax
je 0x14003abc5
mov rax, r13
nop dword [rax]
inc rax
cmp word [r15 + rax*2], dx
jne 0x14003ab70
add rax, rbx
lea rax, [rax*2 + 0x14]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14003ab98
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400c1030
sub rsp, rcx
lea rdx, str._s__s
mov r9, r15
mov r8, rdi
lea rsi, [rsp + 0x50]
mov rcx, rsi
call fcn.140004f90
xor edx, edx
jmp 0x14003ac10
lea rax, [rbx*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14003abe0
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400c1030
sub rsp, rcx
lea rsi, [rsp + 0x50]
mov rcx, rsi
sub rcx, rdi
nop word [rax + rax]
movzx eax, word [rdi]
mov word [rdi + rcx], ax
add rdi, 2
test ax, ax
jne 0x14003ac00
movzx edi, byte [rbp + 0x1678]
test dil, dil
je 0x14003ac98
mov rcx, qword [rbp + 0x10]
lea rax, [rbp + 0x20]
movzx r15d, byte [rbp + 0x1690]
mov rdx, rsi
mov r8, qword [rbp + 0x1688]
movzx r9d, r15b
mov qword [rsp + 0x48], rax
lea rax, [rbp]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rbp + 0x1670]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x16b8]
mov qword [rsp + 0x28], rax
movzx eax, word [rbp + 0x100]
mov word [rsp + 0x20], ax
call fcn.140061370
test eax, eax
je 0x14003aaa5
cmp byte [rbp], 0
jne 0x14003ad13
mov eax, dword [rbp + 0x20]
mov rsi, qword [rbp + 8]
jmp 0x14003ad6d
lea rax, [rbp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp + 0xc0]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x1688]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14003ad4e
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x14003acea
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x10]
mov qword [rcx], rax
mov rax, qword [rbp + 0x16b8]
test rax, rax
je 0x14003b03f
mov edx, dword [rbp + 0x40]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rax
call fcn.1400012b0
mov rax, qword [rbp + 0x10]
cmp byte [rbp + 0x16a8], 0
je 0x14003ad2e
mov rcx, qword [0x140101a58]
mov dword [rcx + 0x40], 0
cmp qword [rbp + 0x16a0], 0
jne 0x14003ad46
mov rcx, qword [rax]
test rcx, rcx
je 0x14003ad46
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r12d
jmp 0x14003b185
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r15d, byte [rbp + 0x1690]
jmp 0x14003ad76
movzx r15d, byte [rbp + 0x1690]
movzx edi, byte [rbp + 0x1678]
test dil, dil
jne 0x14003b04f
xor edx, edx
lea rcx, [rbp + 0x54]
lea r8d, [rdx + 0x6c]
call fcn.1400aad30
mov rsi, qword [rbp + 0x1688]
mov qword [rbp + 0x78], rsi
mov dword [rbp + 0x50], WSAStartup
mov dword [rbp + 0x54], 0x440
test r14, r14
je 0x14003adba
cmp word [r14], 0
je 0x14003adba
mov rcx, r14
call fcn.1400193a0
mov dword [rbp + 0x80], eax
jmp 0x14003adc1
mov dword [rbp + 0x80], r12d
mov rax, qword [rbp + 0x18]
test rax, rax
je 0x14003ade5
lea rdx, str.properties
mov qword [rbp + 0x60], rax
mov rcx, rax
call fcn.1400abda0
test eax, eax
jne 0x14003ade5
or dword [rbp + 0x54], 0xc
mov r14, qword [rbp + 0x28]
test r14, r14
jne 0x14003af7a
lea rax, [rbx*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14003ae0d
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400c1030
sub rsp, rcx
mov rcx, qword [rbp + 8]
lea rdi, [rsp + 0x50]
mov rdx, rdi
sub rdx, rcx
nop dword [rax + rax]
movzx eax, word [rcx]
mov word [rcx + rdx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14003ae30
cmp word [rdi], 0x22
jne 0x14003ae8b
mov edx, SafeArrayAllocDescriptor
lea rcx, [rdi + 2]
call fcn.1400aa318
test rax, rax
je 0x14003ae8b
xor ecx, ecx
lea rsi, [rdi + 2]
movzx edi, byte [rbp + 0x1678]
mov word [rax], cx
cmp word [rax + 2], cx
je 0x14003af7e
cmp word [rax + 2], 0x20
lea r14, [rax + 2]
jne 0x14003af7e
add r14, 2
jmp 0x14003af7e
test rsi, rsi
je 0x14003ae99
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edx, SafeArrayAllocDescriptor
lea rcx, [rdi + 2]
call fcn.1400aa318
mov rsi, rax
test rax, rax
je 0x14003af44
lea rbx, [rax - 2]
cmp rbx, rdi
jbe 0x14003aedd
nop dword [rax]
movzx edx, word [rbx]
lea rcx, [0x1400e9968]
call fcn.1400aa318
test rax, rax
jne 0x14003aedd
sub rbx, 2
cmp rbx, rdi
ja 0x14003aec0
cmp word [rbx], 0x2e
jne 0x14003af2c
xor eax, eax
mov word [rsi], ax
mov rax, rsi
sub rax, rbx
and rax, 0xfffffffffffffffe
cmp rax, 8
jne 0x14003af0c
mov rdx, rbx
lea rcx, str..exe.bat.com.cmd.hta
call fcn.14008c110
test rax, rax
jne 0x14003af3c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x14003af3c
mov eax, SafeArrayAllocDescriptor
lea rcx, [rsi + 2]
mov word [rsi], ax
mov edx, eax
jmp 0x14003aea2
mov eax, SafeArrayAllocDescriptor
lea rcx, [rsi + 2]
mov edx, eax
jmp 0x14003aea2
mov qword [rbp + 8], rdi
lea r14, [rsi + 2]
mov rax, qword [rbp + 0x1688]
test rax, rax
je 0x14003af73
mov rax, qword [0x140103ef0]
lea rcx, [0x1400cfffc]
test rax, rax
je 0x14003af6d
mov rax, qword [rax]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
movzx edi, byte [rbp + 0x1678]
mov rsi, qword [rbp + 8]
lea rcx, [rbp + 0x50]
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x70], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14003b047
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14010ab60], eax
jle 0x14003aff9
lea rcx, [0x14010ab60]
call fcn.1400a7f38
cmp dword [0x14010ab60], 0xffffffff
jne 0x14003aff9
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetProcessId
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14010ab60]
mov qword [0x14010ab68], rax
call fcn.1400a7ed8
mov rcx, qword [rbp + 0xb8]
mov rax, qword [rbp + 0x10]
mov qword [rax], rcx
test rcx, rcx
je 0x14003ad17
mov rbx, qword [rbp + 0x16b8]
test rbx, rbx
je 0x14003ad17
mov rax, qword [0x14010ab68]
test rax, rax
je 0x14003ad13
call rax
mov edx, eax
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
jmp 0x14003ad0e
mov rax, rcx
jmp 0x14003ad17
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14003b053
mov r14, qword [rbp + 0x28]
cmp byte [rbp + 0x16a8], 0
je 0x14003b066
mov rcx, qword [0x140101a58]
mov dword [rcx + 0x40], eax
test r15b, r15b
je 0x14003aaa5
lea rcx, [rbp + 0x230]
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x1ff
mov r8d, eax
mov qword [rsp + 0x20], rcx
xor edx, edx
mov ecx, 0x1200
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r9, qword [rbp + 0x18]
test r9, r9
je 0x14003b0c0
lea r8, str._nVerb:___s_
mov edx, 0x80
lea rcx, [rbp + 0x130]
call fcn.14008bcb0
jmp 0x14003b0c7
mov word [rbp + 0x130], bx
lea rcx, [0x1400cfffc]
test r14, r14
mov rdx, rcx
mov rax, r13
cmovne rdx, r14
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], bx
jne 0x14003b0e0
cmp rax, 0x190
lea r9, [0x1400e47a0]
mov r8, rcx
cmova r8, r9
nop dword [rax]
inc r13
cmp word [rsi + r13*2], bx
jne 0x14003b100
mov qword [rsp + 0x40], r8
lea rax, str.Launch_Error__possibly_related_to_RunAs_:
mov qword [rsp + 0x38], rdx
lea r8, str._s_nAction:____0.400s_s__s_nParams:____0.400s_s_
cmp r13, 0x190
mov edx, 0x800
cmova rcx, r9
test dil, dil
lea r9, str.Failed_attempt_to_launch_program_or_document:
cmovne r9, rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x630]
mov qword [rsp + 0x20], rsi
call fcn.14008bcb0
mov rcx, qword [rbp + 0x1670]
lea r8, [rbp + 0x230]
lea rdx, [rbp + 0x630]
call fcn.1400393c0
xor eax, eax
jmp 0x14003b185
mov eax, 1
mov rbx, qword [rbp + 0x1680]
lea rsp, [rbp + 0x1630]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret