Function at 0x1400011c0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x14001a008]
xor rax, rsp
mov qword [rbp + 0x90], rax
xor r9d, r9d
mov dword [rsp + 0x50], 0x104
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea r8, str.http
lea rax, [rbp - 0x80]
lea edx, [r9 + 2]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringA]
test eax, eax
js 0x140001980
xorps xmm0, xmm0
lea rax, [rbp - 0x80]
movups xmmword [rsp + 0x58], xmm0
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001244
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x1400019d6
xor r13d, r13d
cmp rbx, 0x10
jae 0x1400012a1
mov r8, rbx
mov qword [rsp + 0x68], rbx
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x70], 0xf
lea rcx, [rsp + 0x58]
call fcn.140005390
mov byte [rsp + rbx + 0x58], r13b
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x58]
jmp 0x140001339
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x1400012da
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140001b20
test rax, rax
je 0x1400019b2
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001317
mov ecx, 0x16
mov rdi, rax
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001305
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400019b8
jmp 0x1400012bb
test rcx, rcx
je 0x140001314
call fcn.140001b20
mov rsi, rax
jmp 0x140001317
mov rsi, r13
mov r8, rbx
mov qword [rsp + 0x58], rsi
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x68], rbx
mov rcx, rsi
mov qword [rsp + 0x70], rdi
call fcn.140005390
mov byte [rsi + rbx], r13b
cmp rdi, 0x10
lea r14, [rsp + 0x58]
cmovae r14, rsi
cmp rbx, 0xa
jb 0x1400013a0
lea r15, [rbx + r14]
mov edx, 0x63
lea r8, [r15 - 9]
mov rcx, r14
sub r8, r14
call fcn.14000f220
test rax, rax
je 0x1400013a0
movabs r12, 0x652e656d6f726863
cmp qword [rax], r12
jne 0x140001384
cmp word [rax + 8], 0x6578
je 0x1400015bf
inc rax
lea r8, [r15 - 9]
sub r8, rax
mov rcx, rax
mov edx, 0x63
call fcn.14000f220
test rax, rax
jne 0x140001373
cmp rdi, 0x10
lea r14, [rsp + 0x58]
cmovae r14, rsi
cmp rbx, 9
jb 0x14000140b
lea r15, [rbx + r14]
mov edx, 0x6f
lea r8, [r15 - 8]
mov rcx, r14
sub r8, r14
call fcn.14000f220
test rax, rax
je 0x14000140b
movabs r12, 0x78652e617265706f
nop word [rax + rax]
cmp qword [rax], r12
jne 0x1400013ef
cmp byte [rax + 8], 0x65
je 0x1400016aa
inc rax
lea r8, [r15 - 8]
sub r8, rax
mov rcx, rax
mov edx, 0x6f
call fcn.14000f220
test rax, rax
jne 0x1400013e0
cmp rdi, 0x10
lea r14, [rsp + 0x58]
cmovae r14, rsi
cmp rbx, 0xb
jb 0x140001478
lea r15, [rbx + r14]
mov edx, 0x66
lea r8, [r15 - 0xa]
mov rcx, r14
sub r8, r14
call fcn.14000f220
test rax, rax
je 0x140001478
movabs r12, 0x2e786f6665726966
cmp qword [rax], r12
jne 0x14000145c
cmp word [rax + 8], 0x7865
jne 0x14000145c
cmp byte [rax + 0xa], 0x65
je 0x14000178b
inc rax
lea r8, [r15 - 0xa]
sub r8, rax
mov rcx, rax
mov edx, 0x66
call fcn.14000f220
test rax, rax
jne 0x140001445
cmp rdi, 0x10
lea r14, [rsp + 0x58]
cmovae r14, rsi
cmp rbx, 0xa
jb 0x1400014e1
lea r8, [r14 - 9]
mov edx, 0x6d
add r8, rbx
mov rcx, r14
sub r8, r14
call fcn.14000f220
test rax, rax
je 0x1400014e1
movabs r15, 0x652e65676465736d
cmp qword [rax], r15
jne 0x1400014c2
cmp word [rax + 8], 0x6578
je 0x14000186c
inc rax
lea r8, [r14 - 9]
add r8, rbx
mov edx, 0x6d
sub r8, rax
mov rcx, rax
call fcn.14000f220
test rax, rax
jne 0x1400014b1
mov ecx, 0x60
mov qword [rsp + 0x38], r13
call fcn.140001b20
movaps xmm0, xmmword [str.https:__chrome.google.com_webstore_detail_metamask_nkbihfbeogaeaoehlefnkodbefgpgknn]
lea rdx, str.open
mov qword [rsp + 0x30], rax
mov r8, rax
mov qword [rsp + 0x40], 0x53
xor r9d, r9d
mov qword [rsp + 0x48], 0x5f
xor ecx, ecx
movups xmmword [rax], xmm0
mov dword [rsp + 0x28], 1
movaps xmm1, xmmword [0x1400178f0]
movups xmmword [rax + 0x10], xmm1
mov qword [rsp + 0x20], r13
movaps xmm0, xmmword [0x140017900]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140017910]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x140017920]
movups xmmword [rax + 0x40], xmm0
movzx eax, word [0x140017930]
mov word [r8 + 0x50], ax
movzx eax, byte [0x140017932]
mov byte [r8 + 0x52], al
mov byte [r8 + 0x53], r13b
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000194d
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001948
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400019be
jmp 0x140001948
sub rax, r14
cmp rax, 0xffffffffffffffff
je 0x1400013a0
mov ecx, 0x60
mov qword [rsp + 0x38], r13
call fcn.140001b20
movaps xmm0, xmmword [str.https:__chrome.google.com_webstore_detail_metamask_nkbihfbeogaeaoehlefnkodbefgpgknn]
lea rdx, str.open
mov qword [rsp + 0x30], rax
mov r8, rax
mov qword [rsp + 0x40], 0x53
xor r9d, r9d
mov qword [rsp + 0x48], 0x5f
xor ecx, ecx
movups xmmword [rax], xmm0
mov dword [rsp + 0x28], 1
movaps xmm1, xmmword [0x1400178f0]
movups xmmword [rax + 0x10], xmm1
mov qword [rsp + 0x20], r13
movaps xmm0, xmmword [0x140017900]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140017910]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x140017920]
movups xmmword [rax + 0x40], xmm0
movzx eax, word [0x140017930]
mov word [r8 + 0x50], ax
movzx eax, byte [0x140017932]
mov byte [r8 + 0x52], al
mov byte [r8 + 0x53], r13b
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000194d
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001948
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400019c4
jmp 0x140001948
sub rax, r14
cmp rax, 0xffffffffffffffff
je 0x14000140b
mov ecx, 0x40
mov qword [rsp + 0x38], r13
call fcn.140001b20
movups xmm0, xmmword [str.https:__addons.opera.com_en_gb_extensions_details_metamask_10_]
mov qword [rsp + 0x30], rax
lea rdx, str.open
mov qword [rsp + 0x40], 0x3e
mov r8, rax
mov qword [rsp + 0x48], 0x3f
xor r9d, r9d
movups xmmword [rax], xmm0
mov dword [rsp + 0x28], 1
xor ecx, ecx
movups xmm1, xmmword [0x140017948]
mov qword [rsp + 0x20], r13
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140017958]
movups xmmword [rax + 0x20], xmm0
movsd xmm0, qword [0x140017968]
movsd qword [rax + 0x30], xmm0
mov eax, dword [0x140017970]
mov dword [r8 + 0x38], eax
movzx eax, word [0x140017974]
mov word [r8 + 0x3c], ax
mov byte [r8 + 0x3e], r13b
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000194d
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001948
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400019ca
jmp 0x140001948
sub rax, r14
cmp rax, 0xffffffffffffffff
je 0x140001478
mov ecx, 0x40
mov qword [rsp + 0x38], r13
call fcn.140001b20
movups xmm0, xmmword [str.https:__addons.mozilla.org_en_US_firefox_addon_ether_metamask_]
mov qword [rsp + 0x30], rax
lea rdx, str.open
mov qword [rsp + 0x40], 0x3e
mov r8, rax
mov qword [rsp + 0x48], 0x3f
xor r9d, r9d
movups xmmword [rax], xmm0
mov dword [rsp + 0x28], 1
xor ecx, ecx
movups xmm1, xmmword [0x140017988]
mov qword [rsp + 0x20], r13
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140017998]
movups xmmword [rax + 0x20], xmm0
movsd xmm0, qword [0x1400179a8]
movsd qword [rax + 0x30], xmm0
mov eax, dword [0x1400179b0]
mov dword [r8 + 0x38], eax
movzx eax, word [0x1400179b4]
mov word [r8 + 0x3c], ax
mov byte [r8 + 0x3e], r13b
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000194d
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001948
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400019d0
jmp 0x140001948
sub rax, r14
cmp rax, 0xffffffffffffffff
je 0x1400014e1
mov ecx, 0x70
mov qword [rsp + 0x38], r13
call fcn.140001b20
movaps xmm0, xmmword [str.https:__microsoftedge.microsoft.com_addons_detail_metamask_ejbalbakoplchlghecdalmeeeajnimhm_hlen_US]
lea rdx, str.open
mov qword [rsp + 0x30], rax
mov r8, rax
mov qword [rsp + 0x40], 0x64
xor r9d, r9d
mov qword [rsp + 0x48], 0x6f
xor ecx, ecx
movups xmmword [rax], xmm0
mov dword [rsp + 0x28], 1
movaps xmm1, xmmword [0x1400179d0]
movups xmmword [rax + 0x10], xmm1
mov qword [rsp + 0x20], r13
movaps xmm0, xmmword [0x1400179e0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400179f0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x140017a00]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [0x140017a10]
movups xmmword [rax + 0x50], xmm1
mov eax, dword [0x140017a20]
mov dword [r8 + 0x60], eax
mov byte [r8 + 0x64], r13b
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000194d
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001948
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400019dc
call fcn.140001b5c
cmp rdi, 0x10
jb 0x140001980
lea rdx, [rdi + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001978
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400019b2
mov rcx, rsi
call fcn.140001b5c
xor eax, eax
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.140001b00
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140005e0c
int3
call fcn.140001100
int3
call fcn.140005e0c
int3
call fcn.140005e0c
int3
call fcn.140005e0c
int3
call fcn.140005e0c
int3
call fcn.1400011a0
int3
call fcn.140005e0c
int3