Function at 0x140060930
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rdi, rdx
mov rsi, rcx
cmp word [rdx], 0x48
jne 0x14006095a
call fcn.14000b6f0
jmp 0x140060b75
mov dword [rbp - 0x29], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
movups xmmword [rbp - 0x11], xmm0
movups xmmword [rbp - 1], xmm0
movups xmmword [rbp + 0xf], xmm0
movups xmmword [rbp + 0x1f], xmm0
movups xmmword [rbp + 0x2f], xmm0
xor eax, eax
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], rax
call fcn.140033570
mov rcx, rax
test rax, rax
je 0x140060b93
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp + 0x6f], rax
lea rdx, str.explorer__select_
mov rbx, 0xffffffffffffffff
cmp rdx, 0x10000
jae 0x1400609ca
movzx edx, dx
lea rcx, [rbp + 0x6f]
call fcn.140033ce0
jmp 0x1400609e7
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400609d0
mov r8d, eax
lea rcx, [rbp + 0x6f]
call fcn.140035250
nop
mov r8, rdi
lea rdx, [rbp + 0x6f]
lea rcx, [rbp + 0x7f]
call fcn.14004f720
nop
mov rdx, qword [rbp + 0x6f]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140060a15
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea rax, [rbp - 0x49]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x7f]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140060b45
call fcn.140033570
mov rcx, rax
test rax, rax
je 0x140060b88
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp + 0x77], rax
lea rdx, [0x140130428]
cmp rdx, 0x10000
jae 0x140060a92
movzx edx, dx
lea rcx, [rbp + 0x77]
call fcn.140033ce0
jmp 0x140060aac
mov rax, rbx
inc rax
cmp word [rdx + rax*2], 0
jne 0x140060a95
mov r8d, eax
lea rcx, [rbp + 0x77]
call fcn.140035250
nop
mov r8, rdi
lea rdx, [rbp + 0x77]
lea rcx, [rbp - 0x51]
call fcn.14004f720
nop
lea r8, [0x140130424]
mov rdx, rax
lea rcx, [rbp - 0x59]
call fcn.14004f720
nop
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140060aef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp + 0x77]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140060b0c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov r9d, gethostbyaddr
lea r8, [0x14011f590]
mov rdx, qword [rbp - 0x59]
mov rcx, rsi
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140060b5a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x140060b5a
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140060b75
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsp + 0x110]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140032b30
nop
mov ecx, 0x80004005
call fcn.140032b30
int3