Function at 0x140174780
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r15, r9
mov ebx, r8d
mov rdi, rcx
mov r13, qword [rbp + 0x230]
mov r12, qword [rbp + 0x238]
cmp dword [rbp + 0x240], 0
jne 0x140174bcf
cmp ebx, 0x110
jne 0x1401747ef
call fcn.1401762a0
mov qword [r12], rax
mov eax, 1
jmp 0x140174bd1
xor esi, esi
lea edx, [rsi + 2]
lea r14d, [rsi + 1]
cmp ebx, 0x111
jne 0x140174981
mov rax, r15
shr rax, 0x10
cmp r14w, r15w
jne 0x14017486d
cmp si, ax
je 0x14017490e
movzx ecx, r15w
mov rax, r15
shr rax, 0x10
mov edx, 0x525
cmp dx, cx
jne 0x1401749a3
cmp si, ax
jne 0x1401749a3
xor edx, edx
mov rcx, rdi
call fcn.14017a6f0
mov edx, r14d
mov rcx, rdi
call fcn.140178a90
mov rcx, rdi
call fcn.140178600
mov rcx, rdi
call fcn.14017c150
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
cmp dx, r15w
jne 0x14017491a
cmp si, ax
jne 0x140174942
mov eax, dword [rcx + 0xaf4]
cmp eax, edx
je 0x14017490e
dec eax
test eax, 0xfffffffd
jne 0x140174904
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
call fcn.140044940
mov rcx, rax
lea r8, str.RECOVERY_TEXT
lea rdx, str.TEXT_ASK_EXIT
call fcn.140048080
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140019100
mov rbx, rax
call fcn.1401285c0
lea rcx, [0x1402620b8]
lea r8, [0x1402620c0]
cmp dword [rax + 0x88], 0
cmovne r8, rcx
mov r9d, 4
mov rdx, rbx
mov rcx, qword [rdi + 8]
call fcn.14005fae0
cmp eax, 6
jne 0x14017490e
lea edx, [rax - 4]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_EndDialog]
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
mov eax, 0x8211
cmp ax, r15w
jne 0x140174942
mov rax, r15
shr rax, 0x10
cmp si, ax
jne 0x140174942
call fcn.1401769c0
mov qword [r12], rax
mov eax, r14d
jmp 0x140174bd1
movzx ecx, r15w
mov eax, 0x3ff
cmp ax, r15w
jne 0x14017481e
mov rax, r15
shr rax, 0x10
cmp si, ax
jne 0x140174825
mov rcx, rdi
call fcn.140178680
mov rcx, rdi
call fcn.14017c150
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
cmp ebx, edx
jne 0x1401749c8
call fcn.140175ea0
mov rcx, rdi
call fcn.140178600
call fcn.140173ff0
mov rcx, rax
call fcn.14017d1b0
mov qword [r12], rsi
mov edx, 2
cmp ebx, dword [0x14030b1c8]
jne 0x140174ac6
mov rcx, rdi
call fcn.140179f10
mov qword [r12], rax
mov eax, r14d
jmp 0x140174bd1
cmp ebx, 0x233
jne 0x140174aa6
cmp dword [rcx + 0xaf4], esi
jne 0x140174a98
cmp dword [rcx + 0xb08], esi
jne 0x140174a98
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, r15
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
mov r9d, 0x104
lea r8, [rbp - 0x50]
xor edx, edx
mov rcx, r15
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x14017535c
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x48]
call fcn.140018bd0
test al, al
jne 0x140174a7f
lea rax, [rbp - 0x50]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140174a63
mov r8d, ebx
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x48]
call fcn.140018f70
nop
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.1401770a0
mov rcx, r15
call qword [sym.imp.SHELL32.dll_DragFinish]
xor esi, esi
mov qword [r12], rsi
lea eax, [rsi + 1]
jmp 0x140174bd1
cmp ebx, 0x113
jne 0x1401749a8
mov r8, r15
call fcn.140179640
mov qword [r12], rax
mov eax, r14d
jmp 0x140174bd1
cmp ebx, dword [0x14030b1cc]
jne 0x140174ae2
mov rcx, rdi
call fcn.14017a0e0
mov qword [r12], rax
mov eax, r14d
jmp 0x140174bd1
cmp ebx, dword [0x14030617c]
jne 0x140174b3b
xor edx, edx
mov rcx, rdi
call fcn.14017a6f0
mov edx, r14d
mov rcx, rdi
call fcn.140178a90
mov rcx, rdi
call fcn.140178600
mov rcx, rdi
call fcn.14017c150
lea rdx, str.OnStop___
mov rcx, qword [rdi + 0xb00]
call fcn.1400c81c0
mov edx, 5
mov rcx, rdi
call fcn.14017a6f0
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
cmp ebx, 7
jne 0x140174b54
mov edx, r14d
mov rcx, rdi
call fcn.14017cc40
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
cmp ebx, 8
jne 0x140174b7f
mov rcx, r15
call qword [sym.imp.USER32.dll_GetParent]
cmp rax, qword [rdi + 8]
je 0x14017490e
xor edx, edx
mov rcx, rdi
call fcn.14017cc40
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
cmp ebx, 0x1c
jne 0x140174b98
mov edx, r15d
mov rcx, rdi
call fcn.14017cc40
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
cmp ebx, 0x111
jne 0x140175219
mov eax, 0x8218
cmp ax, r15w
mov rax, r15
jne 0x140174bfb
shr rax, 0x10
cmp si, ax
je 0x140174c0f
mov ecx, 0x821f
cmp cx, r15w
jne 0x140174c28
cmp si, ax
je 0x14017490e
xor eax, eax
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1401f3bf0
mov rbx, qword [rsp + 0x318]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
shr rax, 0x10
mov ecx, 0x8246
cmp cx, r15w
jne 0x140174bbb
cmp si, ax
jne 0x140174bbb
mov rcx, rdi
call fcn.140175ea0
mov rcx, rdi
call fcn.140178ef0
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
mov ecx, 0x821a
cmp cx, r15w
jne 0x140174c49
cmp si, ax
jne 0x140174bcf
mov rcx, rdi
call fcn.14017a510
mov qword [r12], rax
mov eax, r14d
jmp 0x140174bd1
mov ecx, 0x8212
cmp cx, r15w
jne 0x140174d98
cmp si, ax
jne 0x140174bcf
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rsp + 0x78], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rsi
mov dword [rbp - 0x58], esi
lea r13, vtable.CRecoverySettingDlg.0
mov qword [rsp + 0x70], r13
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
mov rax, qword [rbp - 0x68]
test rax, rax
jne 0x140174cf8
call fcn.1401f38b8
mov qword [rbp - 0x68], rax
test rax, rax
jne 0x140174cf8
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
call fcn.140175a10
nop
mov qword [rsp + 0x70], r13
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14017490e
call fcn.1401f3988
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1401f39e8
lea rax, [rsp + 0x70]
mov qword [rbp - 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbp - 0x78], eax
lea r15, [0x14030fbd8]
mov qword [rsp + 0x50], r15
mov byte [rsp + 0x58], 0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x58], 1
mov rax, qword [0x14030fc00]
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x80]
mov qword [0x14030fc00], rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rsi
lea r9, [0x140017d90]
mov r8, rbx
mov edx, 0xe5
mov rcx, qword [0x1403043d0]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
cmp rax, 2
jne 0x140174cc3
mov qword [rsp + 0x70], r13
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
jmp 0x140174cda
mov ecx, 0x4e5
cmp cx, r15w
jne 0x140174ddd
cmp si, ax
jne 0x140174bcf
call fcn.140132d10
mov rcx, rdi
call fcn.14017b230
mov rcx, rdi
call fcn.140177b90
mov rcx, rdi
call fcn.14017bf10
mov rcx, rdi
call fcn.140175a10
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
mov ecx, 0x821b
cmp cx, r15w
jne 0x140174f25
cmp si, ax
jne 0x140174bcf
mov ecx, dword [rdi + 0xb08]
test ecx, ecx
je 0x140174f0e
sub ecx, r14d
je 0x140174f11
sub ecx, r14d
je 0x140174e33
cmp ecx, r14d
jne 0x14017490e
mov edx, 4
mov rcx, rdi
call fcn.14017c920
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
mov rcx, rdi
call fcn.140175ea0
call fcn.140173ff0
cmp dword [rax + 0x10], esi
jne 0x140174ef5
call fcn.140173ff0
cmp dword [rax + 0x14], esi
jne 0x140174ef5
call fcn.140173ff0
cmp dword [rax + 0x18], esi
jne 0x140174ef5
call fcn.140173ff0
cmp dword [rax + 0x1c], esi
jne 0x140174ef5
call fcn.140173ff0
cmp dword [rax + 0x20], esi
jne 0x140174ef5
call fcn.140173ff0
cmp dword [rax + 0x24], esi
jne 0x140174ef5
lea rax, [rsp + 0x40]
mov qword [rsp + 0x48], rax
call fcn.140044940
mov rcx, rax
lea r8, str.RECOVERY_TEXT
lea rdx, str.TEXT_MSG_NEED_CHECK_SYMBOLS
call fcn.140048080
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140019100
mov rbx, rax
call fcn.1401285c0
lea rcx, [0x1402620b8]
lea r8, [0x1402620c0]
cmp dword [rax + 0x88], 0
cmovne r8, rcx
xor r9d, r9d
mov rdx, rbx
mov rcx, qword [rdi + 8]
call fcn.14005fae0
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
mov edx, 3
mov rcx, rdi
call fcn.14017c920
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
mov edx, r14d
mov rcx, rdi
call fcn.14017c920
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
mov ecx, 0x821c
cmp cx, r15w
jne 0x140174f93
cmp si, ax
jne 0x140174bcf
mov ecx, dword [rdi + 0xb08]
sub ecx, r14d
je 0x140174f7d
sub ecx, r14d
je 0x140174f66
cmp ecx, r14d
jne 0x14017490e
mov rcx, rdi
call fcn.14017c920
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
mov edx, r14d
mov rcx, rdi
call fcn.14017c920
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
xor edx, edx
mov rcx, rdi
call fcn.14017c920
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
mov ecx, 0x821d
cmp cx, r15w
jne 0x1401750f2
call fcn.140173ff0
mov rbx, rax
lea rcx, [rax + 0x50]
call fcn.140018ce0
lea rcx, [rbx + 0x58]
call fcn.140018ce0
lea rcx, [rbx + 0x70]
call fcn.140018ce0
mov qword [rbx + 0x60], rsi
mov dword [rbx + 0x68], esi
mov rcx, qword [rdi + 0x88]
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
call qword [case.0x140038716.0]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x50], rax
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x140175367
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea r15, [0x140262520]
mov rdx, r15
lea rcx, [rsp + 0x48]
call fcn.140018bd0
mov rbx, 0xffffffffffffffff
test al, al
jne 0x140175059
mov r8, rbx
nop dword [rax]
inc r8
cmp word [r15 + r8*2], 0
jne 0x140175040
mov rdx, r15
lea rcx, [rsp + 0x48]
call fcn.140018f70
nop
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x140175351
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea r15, str.IDC_EDIT_FILE_PATHNAME
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.140018bd0
test al, al
jne 0x1401750bc
nop dword [rax + rax]
inc rbx
cmp word [r15 + rbx*2], 0
jne 0x1401750a0
mov r8d, ebx
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.140018f70
nop
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov rcx, qword [rdi + 0xb00]
call fcn.1400ca920
xor edx, edx
mov rcx, rdi
call fcn.14017a6f0
xor edx, edx
mov rcx, rdi
call fcn.14017c920
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
mov ecx, 0x54e
cmp cx, r15w
jne 0x140175118
mov dword [rdi + 0xa70], r14d
mov rcx, rdi
call fcn.14017a6f0
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
mov ecx, 0x821e
cmp cx, r15w
jne 0x140175140
mov dword [rdi + 0xa70], esi
mov edx, r14d
mov rcx, rdi
call fcn.14017a6f0
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
mov ecx, 0x8221
cmp cx, r15w
jne 0x140175159
cmp si, ax
je 0x1401751ea
jmp 0x140174bcf
mov ecx, 0x8222
cmp cx, r15w
jne 0x1401751d2
cmp si, ax
jne 0x140174bcf
lea rcx, [rsp + 0x40]
call fcn.1400e0690
nop
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, qword [rax]
lea rdx, [0x140265d30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov rbx, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14017490e
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
mov ecx, 0x822d
cmp cx, r15w
jne 0x140174bcf
cmp si, ax
jne 0x140174bcf
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.https:__www.bandisoft.com_bandizip_help_password_recovery_
lea rdx, [0x140265d30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
cmp ebx, 0x2e0
jne 0x140174bcf
call fcn.140044940
mov rcx, rax
mov rdx, qword [rdi + 8]
call fcn.140047d90
shr r15, 0x10
movzx ebx, r15w
mov edx, ebx
mov rcx, qword [rdi + 0xb00]
call fcn.1400c74f0
movups xmm0, xmmword [r13]
movups xmmword [rsp + 0x50], xmm0
movsxd r15, dword [rdi + 0xb10]
mov r9d, ebx
test ebx, ebx
jne 0x1401752a6
call fcn.140038150
movsxd rcx, dword [rax]
imul rcx, r15
movabs r13, 0x2aaaaaaaaaaaaaab
mov rax, r13
imul rcx
mov r15, rdx
sar r15, 4
mov rcx, r15
shr rcx, 0x3f
add r15, rcx
movsxd rbx, dword [rdi + 0xb14]
call fcn.140038150
movsxd rcx, dword [rax]
imul rcx, rbx
jmp 0x1401752d6
imul r15, r9
movabs r13, 0x2aaaaaaaaaaaaaab
mov rax, r13
imul r15
mov r8, rdx
sar r8, 4
mov r15, r8
shr r15, 0x3f
add r15, r8
movsxd rcx, dword [rdi + 0xb14]
imul rcx, r9
mov rax, r13
imul rcx
mov rbx, rdx
sar rbx, 4
mov rax, rbx
shr rax, 0x3f
add rbx, rax
mov dword [rsp + 0x30], 0x16
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov dword [rsp + 0x30], ILIsEqual
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r15d
movups xmm1, xmmword [rsp + 0x50]
movdqa xmm0, xmm1
psrldq xmm0, 4
movd r9d, xmm0
movd r8d, xmm1
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov qword [r12], rsi
mov eax, r14d
jmp 0x140174bd1
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
int3
mov ecx, 0x80004005
call fcn.140019320
int3