Function at 0x1400f5a90
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov r14, rcx
mov dword [rbp + 0x48], 0
lea rcx, [rbp - 0x38]
call fcn.1400f1cd0
nop
xor r8d, r8d
lea rdx, str.Root
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
js 0x1400f5c47
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
mov rcx, rax
call fcn.1400fbb40
cmp al, 1
jne 0x1400f5c47
lea rdx, str.rundll32.exe_shell32.dll_Control_RunDLL
lea rcx, [rbp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
lea rcx, [rbp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rdi, rax
mov dword [rbp + 0x48], 1
mov r15d, 0x22
mov word [rbp + 0x40], r15w
lea rcx, [rbp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
lea rcx, [rbp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], 1
lea r9, [rbp + 0x40]
mov r8d, ebx
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov r8, r14
mov rdx, rdi
lea rcx, [rbp - 0x20]
call fcn.140006490
mov rsi, rax
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
mov rdi, rax
mov dword [rbp + 0x48], 3
mov word [rbp + 0x40], r15w
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rdx, rax
mov dword [rsp + 0x20], 1
lea r9, [rbp + 0x40]
mov r8d, ebx
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov rdx, rdi
lea rcx, [rbp + 0x50]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x28]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rbp + 0x50]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov rbx, rax
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9, rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rbp - 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret