Function at 0x140001000
Capabilities:
Create process on windows
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd68]
sub rsp, 0xe68
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xd50], rax
xor r13d, r13d
mov qword [rbp + 0x80], 0x10001f
xorps xmm0, xmm0
mov qword [rsp + 0x70], r13
mov rdi, r8
mov qword [rbp - 0x38], r13
mov r14, rdx
mov qword [rbp + 0x50], r13
mov r12, rcx
mov qword [rbp + 0x58], r13
xor edx, edx
mov qword [rbp + 0x60], r13
mov r8d, pe_nt_image_headers64
mov qword [rbp + 0x68], r13
lea rcx, [rbp + 0x1f0]
mov qword [rbp + 0x70], r13
mov r15d, r13d
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x88], r13
mov rbx, r9
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], r13
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xb0], r13
mov qword [rbp + 0xb8], r13
mov qword [rbp + 0xc0], r13
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], r13
mov qword [rbp + 0xe0], r13
mov qword [rbp + 0xe8], r13
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], r13
mov qword [rbp + 0x100], r13
mov qword [rbp + 0x108], r13
mov qword [rbp + 0x110], r13
mov qword [rbp + 0x118], r13
mov qword [rbp + 0x120], r13
mov qword [rbp + 0x128], r13
mov qword [rbp + 0x130], r13
mov qword [rbp + 0x138], r13
mov qword [rbp + 0x140], r13
mov qword [rbp + 0x148], r13
mov dword [rbp + 0x150], r13d
mov qword [rbp + 0x154], r13
mov qword [rbp + 0x15c], r13
mov qword [rbp + 0x164], r13
mov dword [rbp + 0x16c], r13d
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
movups xmmword [rbp + 0x1a0], xmm0
movups xmmword [rbp + 0x1b0], xmm0
movups xmmword [rbp + 0x1c0], xmm0
movups xmmword [rbp + 0x1d0], xmm0
movups xmmword [rbp + 0x1e0], xmm0
call fcn.140014f00
xorps xmm0, xmm0
lea rcx, [rbp + 0x350]
xor edx, edx
mov r8d, 0x1a0
movups xmmword [rbp + 0x2f0], xmm0
movups xmmword [rbp + 0x300], xmm0
movups xmmword [rbp + 0x310], xmm0
movups xmmword [rbp + 0x320], xmm0
movups xmmword [rbp + 0x330], xmm0
movups xmmword [rbp + 0x340], xmm0
call fcn.140014f00
xorps xmm0, xmm0
mov qword [rbp + 0x4f0], r13
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp + 0x4f8], r13
xor eax, eax
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp + 0x500], r13
movups xmmword [rbp], xmm0
mov qword [rbp + 0x508], r13
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x510], r13
mov qword [rbp + 0x518], r13
xor edx, edx
mov qword [rbp + 0x40], rax
mov r8d, 0x208
mov dword [rbp - 0x4c], r13d
lea rcx, [rbp + 0x520]
mov dword [rsp + 0x7c], r13d
movups xmmword [rbp + 0x20], xmm0
mov dword [rbp - 0x6c], r13d
movups xmmword [rbp + 0x30], xmm0
mov byte [rbp - 0x58], 1
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x40], r13
call fcn.140014f00
xor edx, edx
lea rcx, [rbp + 0x730]
mov r8d, 0x208
call fcn.140014f00
xor edx, edx
lea rcx, [rbp + 0x940]
mov r8d, 0x410
call fcn.140014f00
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
test r12, r12
je 0x1400017e0
test r14, r14
je 0x1400017e0
test rdi, rdi
je 0x1400017e0
test rbx, rbx
je 0x1400017e0
mov rcx, r12
call fcn.1400057f0
mov rsi, rax
test rax, rax
je 0x1400017e0
mov edx, 0x5c
mov rcx, rax
call fcn.140002fb0
test rax, rax
je 0x1400012c5
mov word [rax], r13w
lea rdx, [rbp + 0x520]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1400017e0
lea r9, [rbp + 0x730]
xor r8d, r8d
lea rdx, [0x14001e590]
lea rcx, [rbp + 0x520]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1400017e0
lea r8, [rbp + 0x730]
lea rdx, [0x14001e598]
lea rcx, [rbp + 0x940]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rbp + 0x940]
mov qword [rbp - 0x48], rax
lea rcx, [rbp + 0x940]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140001340
add eax, eax
mov dword [rsp + 0x78], 0x30
mov ecx, 0xfffc
mov qword [rbp - 0x80], r13
cmp eax, ecx
mov dword [rbp - 0x70], 0x40
xorps xmm0, xmm0
lea r9, [rsp + 0x78]
cmova eax, ecx
lea rdx, [rsp + 0x60]
mov word [rbp - 0x50], ax
mov r8d, 0xc0110000
add ax, 2
mov ecx, 0x1ab98307
mov word [rbp - 0x4e], ax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x78], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
movdqu xmmword [rbp - 0x68], xmm0
call fcn.140001e80
test eax, eax
je 0x1400017d9
mov qword [rsp + 0x50], r13
xor r9d, r9d
mov qword [rsp + 0x48], r13
xor r8d, r8d
mov qword [rsp + 0x40], r13
xor edx, edx
mov qword [rsp + 0x38], r13
xor ecx, ecx
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], 3
call qword [0x140022be0]
test eax, eax
jne 0x1400017d9
mov rdx, qword [rsp + 0x60]
lea r9, [rbp - 0x58]
lea r8, [rbp - 0x30]
mov qword [rsp + 0x20], 1
mov ecx, 0x7cd58168
call fcn.140001e80
test eax, eax
je 0x1400017d9
mov qword [rsp + 0x50], r13
xor r9d, r9d
mov qword [rsp + 0x48], r13
xor r8d, r8d
mov qword [rsp + 0x40], r13
xor edx, edx
mov qword [rsp + 0x38], r13
xor ecx, ecx
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], 0xd
call qword [0x140022be0]
test eax, eax
jne 0x1400017d9
mov rdx, qword [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov ecx, 0xe84d69f9
call fcn.140001e80
test eax, eax
je 0x1400017d9
mov qword [rsp + 0x50], r13
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], r13
xor r9d, r9d
mov qword [rsp + 0x40], r13
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x30], rdi
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], r14
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [0x140022be0]
test eax, eax
jne 0x1400017d9
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov r8d, 0xf001f
lea rdx, [rsp + 0x68]
mov ecx, 0x4a23a81b
call fcn.140001e80
test eax, eax
je 0x1400017d9
mov rax, qword [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x50], r13
xor r8d, r8d
mov qword [rsp + 0x48], r13
xor edx, edx
mov qword [rsp + 0x40], r13
xor ecx, ecx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0x1000000
mov qword [rsp + 0x20], 2
call qword [0x140022be0]
test eax, eax
jne 0x1400017d9
cmp qword [rsp + 0x68], r13
je 0x1400017e0
mov rcx, qword [rsp + 0x60]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001551
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x48], rbx
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rsi
xor r8d, r8d
mov qword [rsp + 0x30], r13
mov rdx, r12
mov dword [rsp + 0x28], 0x14
xor ecx, ecx
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000179d
mov r8, qword [rbx]
lea r9, [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov ecx, 0xc5d6775b
mov qword [rsp + 0x20], r13
call fcn.140001e80
test eax, eax
je 0x1400017d9
mov qword [rsp + 0x50], r13
lea rax, [rbp - 0x38]
mov qword [rsp + 0x48], 2
xor r9d, r9d
mov qword [rsp + 0x40], r13
xor r8d, r8d
mov qword [rsp + 0x38], 2
xor edx, edx
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [0x140022be0]
test eax, eax
jne 0x1400017d9
movsxd rdi, dword [r14 + 0x3c]
cmp dword [rdi + r14], 0x4550
jne 0x14000179d
mov rdx, qword [rbx + 8]
lea r8, [rbp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov ecx, 0xb2930066
call fcn.140001e80
test eax, eax
je 0x1400017d9
mov qword [rsp + 0x50], r13
xor r9d, r9d
mov qword [rsp + 0x48], r13
xor r8d, r8d
mov qword [rsp + 0x40], r13
xor edx, edx
mov qword [rsp + 0x38], r13
xor ecx, ecx
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [0x140022be0]
test eax, eax
jne 0x1400017d9
mov eax, dword [rdi + r14 + 0x28]
lea r8, [rbp + 0x50]
add rax, qword [rsp + 0x70]
xor r9d, r9d
mov rdx, qword [rbx + 8]
mov ecx, 0x8085727f
mov qword [rbp + 0xd0], rax
mov qword [rsp + 0x20], r13
call fcn.140001e80
test eax, eax
je 0x1400017d9
mov qword [rsp + 0x50], r13
xor r9d, r9d
mov qword [rsp + 0x48], r13
xor r8d, r8d
mov qword [rsp + 0x40], r13
xor edx, edx
mov qword [rsp + 0x38], r13
xor ecx, ecx
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [0x140022be0]
test eax, eax
jne 0x1400017d9
mov r8, qword [rbp + 0xd8]
lea r9, [rsp + 0x70]
mov rdx, qword [rbx]
add r8, 0x10
mov ecx, 0xfab864e6
mov qword [rsp + 0x20], 8
call fcn.140001e80
test eax, eax
je 0x1400017d9
mov qword [rsp + 0x50], r13
xor r9d, r9d
mov qword [rsp + 0x48], r13
xor r8d, r8d
mov qword [rsp + 0x40], r13
xor edx, edx
mov qword [rsp + 0x38], r13
xor ecx, ecx
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [0x140022be0]
test eax, eax
jne 0x1400017d9
mov rdx, qword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov ecx, 0x14a0cc11
call fcn.140001e80
test eax, eax
je 0x1400017d9
mov qword [rsp + 0x50], r13
xor r9d, r9d
mov qword [rsp + 0x48], r13
xor r8d, r8d
mov qword [rsp + 0x40], r13
xor edx, edx
mov qword [rsp + 0x38], r13
xor ecx, ecx
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [0x140022be0]
test eax, eax
jne 0x1400017d9
mov r15d, 1
mov rcx, rsi
call fcn.140005880
mov rcx, qword [rsp + 0x60]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400017bf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x60], r13
mov rcx, qword [rsp + 0x68]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x1400017d4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r15d
jmp 0x1400017e2
mov eax, 0xffffffff
jmp 0x1400017e2
xor eax, eax
mov rcx, qword [rbp + 0xd50]
xor rcx, rsp
call fcn.1400022a0
add rsp, 0xe68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret