Function at 0x140176840
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x1e8
mov dword [rsp + 0x30], 0x71a7
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0x71a7
je 0x140176877
jmp 0x1401768c9
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0x1aae
je 0x140176895
cmp dword [rsp + 0x5c], 0x7fcf
je 0x1401768b4
jmp 0x1401768c4
cmp dword [rsp + 0x30], 0x60a8
je 0x1401768b2
mov r8d, dword [rsp + 0x30]
mov edx, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x30]
call fcn.140174c90
nop
jmp 0x1401768c4
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHELL32.dll_ILGetNext]
mov qword [rsp + 0x70], rax
jmp 0x1401769e9
movabs rax, 0x741a3082364b39
cmp qword [rsp + 0x1f0], rax
jb 0x1401769e9
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0xa8], rax
movabs rax, 0x72744148ee4247
cmp qword [rsp + 0xa8], rax
je 0x140176922
movabs rax, 0x7a56f840bf2d45
cmp qword [rsp + 0xa8], rax
je 0x1401769dc
jmp 0x1401769e9
mov eax, dword [rsp + 0x30]
add eax, 0x12bd
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHELL32.dll_ILRemoveLastID]
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x30]
sub eax, 0x14af
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0x95e
je 0x1401769c6
cmp dword [rsp + 0x60], 0x4f64
je 0x140176969
jmp 0x1401769da
lea rdx, [rsp + 0x54]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.SHELL32.dll_SHQueryRecycleBinW]
mov dword [rsp + 0x9c], eax
mov eax, dword [rsp + 0x30]
and eax, 0x9b5
mov dword [rsp + 0x30], eax
movzx eax, byte [rsp + 0x200]
mov byte [rsp + 0x20], al
movzx r9d, byte [rsp + 0x200]
movzx r8d, byte [rsp + 0x200]
movzx edx, byte [rsp + 0x200]
movzx ecx, byte [rsp + 0x200]
call fcn.140175db0
nop
jmp 0x1401769da
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x54]
call qword [sym.imp.SHELL32.dll_SHIsFileAvailableOffline]
mov dword [rsp + 0x68], eax
jmp 0x1401769e9
mov eax, dword [rsp + 0x30]
xor eax, 0x93e
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x1f0]
shr rax, 0x6e
movabs rcx, 0x72a6fdb9ab20f5
cmp rax, rcx
jbe 0x140176a13
lea rcx, [rsp + 0xa0]
call qword [sym.imp.SHELL32.dll_ILFree]
nop
cmp dword [rsp + 0x30], 0x190b
jl 0x14017700a
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x208]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0x7235
je 0x140176a4c
cmp dword [rsp + 0x64], 0xfa10
je 0x140176a91
jmp 0x140176ac4
mov eax, dword [rsp + 0x30]
or eax, 0x1168
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
mov r9d, dword [rsp + 0x208]
movzx r8d, byte [rsp + 0x200]
mov rdx, qword [rsp + 0x1f8]
mov rcx, qword [rsp + 0x1f0]
call fcn.140176840
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
shl eax, 1
mov dword [rsp + 0x30], eax
jmp 0x140176ac4
mov eax, dword [rsp + 0x30]
add eax, 0x6b43
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x3c]
mov eax, dword [rax]
sub eax, ecx
mov dword [rsp + 0x30], eax
movzx eax, byte [rsp + 0x200]
mov byte [rsp + 0x34], al
movzx eax, word [section..data]
mov dword [rsp + 0x7c], eax
cmp dword [rsp + 0x7c], 0x1052
je 0x140176aea
jmp 0x140176ed9
mov eax, 0x465
mov word [rsp + 0x38], ax
movabs rax, 0x74e583967ca399
cmp qword [rsp + 0x1f8], rax
jne 0x140176bee
mov eax, dword [rsp + 0x208]
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0xc510
je 0x140176b2c
jmp 0x140176bb4
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x30]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x48]
cmp eax, dword [rcx]
jge 0x140176b59
mov rax, qword [rsp + 0x48]
mov r8d, dword [rax]
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x3c]
call fcn.140174c90
nop
jmp 0x140176b66
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x3c]
mov eax, dword [rax]
and eax, ecx
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
add eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
lea r9, [rsp + 0x130]
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x34]
call qword [sym.imp.SHELL32.dll_SHBindToParent]
mov dword [rsp + 0x8c], eax
movabs rax, 0x786c39853e5a39
mov qword [rsp + 0x1f8], rax
movsx eax, word [rsp + 0x38]
sub eax, 0x378
mov word [rsp + 0x38], ax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x3c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
jmp 0x140176e21
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0xc8], rax
cmp qword [rsp + 0xc8], 0
je 0x140176c0e
jmp 0x140176cb1
movzx eax, word [section..data]
cmp eax, 0x4fc
jge 0x140176c90
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x3c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
movabs rax, 0x71697ecf4cf3cc
cmp qword [rsp + 0x1f0], rax
jne 0x140176c4f
mov dword [rsp + 0x208], 0xe6a6
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9d, 0x8e
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x38]
call qword [sym.imp.SHELL32.dll_SHParseDisplayName]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x3c]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
jmp 0x140176caf
lea rax, [rsp + 0x200]
mov qword [rsp + 0xf0], rax
movzx eax, word [section..data]
mov word [rsp + 0x98], ax
jmp 0x140176ce7
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov dword [rsp + 0x3c], eax
lea rcx, [rsp + 0x130]
call qword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
mov dword [rsp + 0x58], eax
movzx ecx, word [rsp + 0x38]
call fcn.140174fb0
movsx eax, word [rsp + 0x38]
add eax, 0xe6
mov word [rsp + 0x38], ax
mov byte [rsp + 0x40], 8
movzx eax, word [rsp + 0x38]
mov word [rsp + 0x50], ax
movsx eax, byte [rsp + 0x40]
cmp eax, 0x56
jle 0x140176d35
lea rcx, [rsp + 0xa0]
call qword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x3c]
movzx ecx, al
mov eax, dword [rsp + 0x30]
shl eax, cl
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
movsx eax, word [rsp + 0x38]
or eax, 0xaf
mov word [rsp + 0x50], ax
movzx eax, byte [rsp + 0x34]
mov byte [rsp + 0x94], al
cmp byte [rsp + 0x94], 0xd8
je 0x140176d50
jmp 0x140176de9
mov eax, dword [rsp + 0x208]
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0x45c6
je 0x140176d6d
jmp 0x140176dc5
movabs rax, 0x756e1be9d6780f
cmp qword [rsp + 0x1f8], rax
jle 0x140176dc3
call fcn.140175570
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.SHELL32.dll_SHIsFileAvailableOffline]
mov dword [rsp + 0xb8], eax
movzx eax, byte [rsp + 0x34]
mov byte [rsp + 0x200], al
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x30]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
jmp 0x140176de7
mov edx, 0x23
mov rcx, qword [rsp + 0xf8]
call sub.SHELL32.dll_SHTestTokenMembership
mov dword [rsp + 0x54], eax
movsx eax, byte [rsp + 0x40]
sar eax, 2
mov byte [rsp + 0x40], al
jmp 0x140176e11
lea rax, [rsp + 0x38]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0x108], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0xbc], eax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x110], rax
movsx eax, word [rsp + 0x38]
xor eax, 0x1f5
mov word [rsp + 0x38], ax
mov eax, dword [rsp + 0x208]
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0xf766
je 0x140176e4d
jmp 0x140176ebd
movabs rax, 0x7670ad5f72832b
cmp qword [rsp + 0x1f0], rax
ja 0x140176e94
movzx ecx, word [rsp + 0x38]
call fcn.140174fb0
lea rcx, [rsp + 0x130]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rsp + 0xc0], eax
movabs rax, 0x76182aeb1c655d
mov qword [rsp + 0x1f8], rax
jmp 0x140176ebb
movabs rax, 0x782c4e92d5a63b
cmp qword [rsp + 0x1f8], rax
jle 0x140176ebb
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x30]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
jmp 0x140176ed4
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call qword [sym.imp.SHELL32.dll_SHIsFileAvailableOffline]
mov dword [rsp + 0x8c], eax
jmp 0x140176f86
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x30]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
add eax, dword [rsp + 0x3c]
mov dword [rsp + 0x30], eax
movzx eax, byte [rsp + 0x34]
sub eax, 0xd
movzx ecx, byte [rsp + 0x200]
cmp eax, ecx
jge 0x140176f5f
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
mov dword [rsp + 0x90], eax
movzx eax, byte [rsp + 0x34]
mov byte [rsp + 0x200], al
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x9c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xb0], rax
jmp 0x140176f86
mov eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0xd0], rcx
movzx ecx, al
mov rax, qword [rsp + 0xd0]
mov eax, dword [rax]
shl eax, cl
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0xd8], rax
movabs rax, 0x7c9c79275a050c
cmp qword [rsp + 0xd8], rax
je 0x140176fae
jmp 0x140176fca
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xe0]
mov ecx, 0xc3
call qword [sym.imp.SHELL32.dll_SHGetImageList]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x30]
mov eax, dword [rax]
and eax, ecx
mov rcx, qword [rsp + 0x48]
mov dword [rcx], eax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x3c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x48]
mov r8d, dword [rax]
mov edx, dword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax]
call fcn.140174c90
nop
movabs rax, 0x7c04d35d7d8bf9
mov qword [rsp + 0x1f8], rax
mov eax, 0xb5
add rsp, 0x1e8
ret