Function at 0x140127de8
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x298]
sub rsp, 0x380
mov rax, qword [0x140412700]
xor rax, rsp
mov qword [rbp + 0x270], rax
xor edi, edi
mov rsi, rcx
mov qword [rsp + 0x40], rdi
test rcx, rcx
jne 0x140127e6d
lea rdx, [rbp - 0x20]
lea rcx, str.WinMergeScript
call qword [sym.imp.ole32.dll_CLSIDFromProgID]
mov ebx, eax
test eax, eax
js 0x1401281c8
lea rax, [rsp + 0x40]
xor edx, edx
lea r9, [0x140303f08]
mov qword [rsp + 0x20], rax
lea r8d, [rsi + 0x17]
lea rcx, [rbp - 0x20]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
jmp 0x1401281c0
lea rdx, str..ocx
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x140127ffa
lea rdx, str..dll
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x140127ffa
lea rdx, str.text_scriptlet
mov qword [rbp - 0x30], InitCommonControls
mov rcx, rsi
mov qword [rbp - 0x28], 2
call qword [sym.imp.SHLWAPI.dll_PathIsContentTypeW]
test eax, eax
jne 0x140127eed
lea rdx, [0x1403a2d90]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x140127eed
lea rdx, [0x1403a2dd0]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
lea rcx, [0x14036ac58]
test eax, eax
je 0x140127ef4
lea rcx, str.script:
mov ebx, pe_nt_image_headers64
lea rdx, [rbp - 0x10]
mov r8d, ebx
call fcn.140127b38
lea rcx, [rbp - 0x10]
call fcn.140286900
sub rbx, rax
lea rdx, [rbp - 0x10]
mov r8, rbx
mov rcx, rsi
lea rdx, [rdx + rax*2]
call fcn.140127b38
lea r9, [rsp + 0x40]
lea r8, [0x140303f08]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ole32.dll_CoGetObject]
mov ebx, eax
cmp eax, 0x80004002
jne 0x140127fb2
lea rax, str.open
mov dword [rsp + 0x60], VarBstrFromDisp
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x60]
lea rax, [0x14039bb44]
mov qword [rsp + 0x68], rdi
mov qword [rbp - 0x78], rax
mov dword [rsp + 0x64], 0x100
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], rdi
mov dword [rbp - 0x70], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1401281c8
lea r9, [rsp + 0x40]
lea r8, [0x140303f08]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ole32.dll_CoGetObject]
mov ebx, eax
cmp ebx, 0x800401e7
je 0x140127fc6
cmp ebx, 0x8000ffff
jne 0x1401281c0
mov rdi, qword [rsp + 0x40]
mov rax, rdi
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.1402194b0
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
xorps xmm0, xmm0
lea rdx, [rbp - 0x10]
mov r8d, pe_nt_image_headers64
mov rcx, rsi
movups xmmword [rbp - 0x20], xmm0
mov r15d, edi
call fcn.140127b38
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x10]
call qword [sym.imp.OLEAUT32.dll_LoadRegTypeLib]
mov ebx, eax
test eax, eax
js 0x140128194
mov rcx, qword [rbp - 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x14001d845.0]
mov r14d, eax
test r15d, r15d
jne 0x140128147
mov ecx, r14d
dec r14d
test ecx, ecx
je 0x140128147
mov rcx, qword [rbp - 0x30]
lea r8, [rsp + 0x48]
mov edx, r14d
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x14001d845.0]
mov ebx, eax
test eax, eax
js 0x140128147
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x14001d845.0]
mov ebx, eax
test eax, eax
js 0x14012812d
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x50], rdi
xor r9d, r9d
mov qword [rsp + 0x28], rdi
or edx, 0xffffffff
mov qword [rsp + 0x20], rdi
mov rax, qword [rcx]
mov rax, qword [rax + 0x60]
call qword [case.0x14001d845.0]
mov ebx, eax
test eax, eax
js 0x140128113
mov rax, qword [rsp + 0x58]
cmp dword [rax + 0x2c], 5
jne 0x140128108
mov rcx, qword [rsp + 0x50]
lea rdx, str.WinMergeScript
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x140128108
mov rdx, qword [rsp + 0x58]
lea r8d, [r15 + 0x10]
lea rcx, [rbp - 0x20]
call fcn.1402bec40
mov r15d, 1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x98]
call qword [case.0x14001d845.0]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001d845.0]
test ebx, ebx
jns 0x140128042
mov rcx, qword [rbp - 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14001d845.0]
test r15d, r15d
je 0x140128194
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
mov rcx, rsi
test rax, rax
jne 0x14012817d
call fcn.140127b8c
mov qword [rsp + 0x40], rax
jmp 0x140128194
lea rdx, [rbp - 0x20]
call fcn.140127d28
mov rcx, r14
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rdx, str..dll
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x1401281b4
cmp ebx, 0x80029c4a
je 0x140127fc6
cmp ebx, 0x80028019
je 0x140127fc6
test ebx, ebx
jns 0x140127fc6
xor edx, edx
mov ecx, ebx
call fcn.1401279fc
mov r14, rax
test rsi, rsi
je 0x1401281fa
mov r8, rsi
lea rcx, str._1_n_2
mov rdx, rax
call fcn.140127ac0
mov rcx, r14
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, rbx
mov r9d, 0x2010
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140127fcb