Function at 0x14006d6d0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x418]
sub rsp, 0x518
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1403b8c08]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov rbx, r9
mov qword [rsp + 0x30], rbx
mov r14, r8
mov r13d, edx
mov r15, rcx
call fcn.1400e97a0
mov r8, qword [rax]
mov r12d, 1
mov edx, r12d
mov rcx, rax
call qword [r8 + InitCommonControls]
lea rsi, [0x1402ec568]
cmp al, r12b
jne 0x14006d8d2
mov edx, r13d
mov rcx, r15
call fcn.1400db910
mov rsi, rax
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 0x390], xmm0
mov byte [rbp + 0x380], 0
lea r8d, [r12 + 0x52]
lea rdx, str.d:jenkins.jenkinsworkspacehalodeskcoral_desktopclouddesktopcloudloginwnd.cpp
lea rcx, [rbp + 0x380]
call fcn.14000c230
nop
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 0x310], xmm0
mov byte [rbp + 0x300], 0
lea r8d, [r12 + 2]
lea rdx, [0x1402ecb4c]
lea rcx, [rbp + 0x300]
call fcn.14000c230
nop
call fcn.1400e97a0
mov rdi, rax
mov r9d, 0xda
lea r8, [rbp + 0x380]
lea rdx, [rbp + 0x300]
lea rcx, [rsp + 0x50]
call fcn.14000e2f0
mov rbx, rax
lea rdx, str.CCloudLoginWnd_WebCall_dispIdMember_
mov rcx, rax
call fcn.14000f730
mov edx, r13d
mov rcx, rbx
call fcn.14000f3b0
lea rdx, [0x1402ecbb4]
mov rcx, rbx
call fcn.14000f730
lea rdx, [0x1402ec568]
test rsi, rsi
cmovne rdx, rsi
mov rcx, rbx
call fcn.14000c3d0
mov rax, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x38]
nop
lea rcx, [rsp + 0x50]
call fcn.14000f8a0
nop
mov rdx, qword [rbp + 0x318]
cmp rdx, 0x10
jb 0x14006d86e
inc rdx
mov rcx, qword [rbp + 0x300]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006d869
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006e099
call fcn.140171af0
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 0x310], xmm0
mov byte [rbp + 0x300], 0
mov rdx, qword [rbp + 0x398]
cmp rdx, 0x10
jb 0x14006d8c6
inc rdx
mov rcx, qword [rbp + 0x380]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006d8c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006e09f
call fcn.140171af0
mov rbx, qword [rsp + 0x30]
lea rsi, [0x1402ec568]
lea eax, [r13 - 0x7d6]
cmp eax, 0x16
ja case.0x14006d8f5.2010
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x6e0cc]
add rcx, rdx
jmp rcx
cmp byte [r15 + 0xac], 0
je 0x14006e06d
lea rcx, [r15 - 0x4c0]
mov edx, 0x3e8
call fcn.14006d240
jmp 0x14006e06d
lea rbx, [r15 - 0x4c0]
lea rdx, [r15 + 0x70]
xor esi, esi
test rbx, rbx
cmove rdx, rsi
lea rcx, [0x1403b8240]
call fcn.140015cb0
xor r9d, r9d
xor r8d, r8d
lea edx, [rsi + 0x10]
mov rcx, rbx
call fcn.1400f6360
jmp 0x14006e06d
lea rcx, [r15 - 0x4c0]
xor r9d, r9d
mov edx, SHCreateDirectory
lea r8d, [r9 + 2]
call fcn.1400f6380
jmp 0x14006e06d
test r14, r14
je 0x14006e06d
mov rax, qword [r14]
test rax, rax
je 0x14006e06d
cmp byte [r15 + 0xac], 0
je 0x14006e06d
mov esi, dword [rax + 8]
mov r14d, dword [rax + 0x20]
call fcn.1400e97a0
mov r8, qword [rax]
mov edx, r12d
mov rcx, rax
call qword [r8 + InitCommonControls]
cmp al, 1
jne 0x14006db1f
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 0x3b0], xmm0
mov byte [rbp + 0x3a0], 0
mov r8d, 0x53
lea rdx, str.d:jenkins.jenkinsworkspacehalodeskcoral_desktopclouddesktopcloudloginwnd.cpp
lea rcx, [rbp + 0x3a0]
call fcn.14000c230
nop
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 0x330], xmm0
mov byte [rbp + 0x320], 0
mov r8d, 3
lea rdx, [0x1402ecb4c]
lea rcx, [rbp + 0x320]
call fcn.14000c230
nop
call fcn.1400e97a0
mov rdi, rax
mov r9d, 0xf1
lea r8, [rbp + 0x3a0]
lea rdx, [rbp + 0x320]
lea rcx, [rbp + 0x38]
call fcn.14000e2f0
mov rbx, rax
lea rdx, str.CCloudLoginWnd_WebCall_MoveWindow
mov rcx, rax
call fcn.14000f730
mov edx, r14d
mov rcx, rbx
call fcn.14000f1f0
lea rdx, [0x1402ecbb4]
mov rcx, rbx
call fcn.14000f730
mov edx, esi
mov rcx, rbx
call fcn.14000f1f0
mov rax, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x38]
nop
lea rcx, [rbp + 0x38]
call fcn.14000f8a0
nop
mov rdx, qword [rbp + 0x338]
cmp rdx, 0x10
jb 0x14006dac7
inc rdx
mov rcx, qword [rbp + 0x320]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006dac2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006e0a5
call fcn.140171af0
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 0x330], xmm0
mov byte [rbp + 0x320], 0
mov rdx, qword [rbp + 0x3b8]
cmp rdx, 0x10
jb 0x14006db1f
inc rdx
mov rcx, qword [rbp + 0x3a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006db1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006e0ab
call fcn.140171af0
movss xmm3, dword [r15 + 0xb0]
mov r8d, esi
mov edx, r14d
lea rcx, [rbp + 0x2f0]
call fcn.1400bd3d0
mov eax, dword [rbp + 0x2fc]
mov r8d, dword [rbp + 0x2f4]
sub eax, r8d
mov r9d, dword [rbp + 0x2f8]
mov edx, dword [rbp + 0x2f0]
sub r9d, edx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], eax
mov rcx, qword [r15 - 0x4b8]
call qword [sym.imp.USER32.dll_MoveWindow]
jmp 0x14006e06d
lea rcx, [r15 - 0x4c0]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x60]
test r14, r14
je 0x14006e06d
mov rdx, qword [r14]
test rdx, rdx
je 0x14006e06d
cmp dword [rdx + 8], 0
jne 0x14006e06d
mov rdx, qword [rdx + 0x20]
lea rcx, [rsp + 0x38]
call fcn.14000d6b0
nop
mov rax, qword [rsp + 0x38]
cmp dword [rax - 0x10], 0
je 0x14006dc32
mov rcx, qword [0x1403d4be8]
test rcx, rcx
jne 0x14006dc23
lea rcx, [0x1403b8068]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [0x1403d4be8], 0
jne 0x14006dc0f
mov ecx, reloc.WS2_32.dll_WSASetLastError
call fcn.140171ab4
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14006dc01
mov rcx, rax
call fcn.140071350
mov rsi, rax
jmp 0x14006dc03
xor esi, esi
lock or dword [rsp], 0
mov qword [0x1403d4be8], rsi
lea rcx, [0x1403b8068]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x1403d4be8]
lea rdx, [rsp + 0x38]
call fcn.140074fb0
mov rax, qword [rsp + 0x38]
lea rdx, [rax - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006e06d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14006e06d
test r14, r14
je 0x14006e06d
mov rdx, qword [r14]
test rdx, rdx
je 0x14006e06d
mov rdx, qword [rdx + 8]
lea rcx, [rsp + 0x30]
call fcn.14000d920
nop
call fcn.1400e97a0
mov r8, qword [rax]
mov edx, r12d
mov rcx, rax
call qword [r8 + InitCommonControls]
cmp al, 1
jne 0x14006ddfb
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 0x3d0], xmm0
mov byte [rbp + 0x3c0], 0
mov r8d, 0x53
lea rdx, str.d:jenkins.jenkinsworkspacehalodeskcoral_desktopclouddesktopcloudloginwnd.cpp
lea rcx, [rbp + 0x3c0]
call fcn.14000c230
nop
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 0x350], xmm0
mov byte [rbp + 0x340], 0
mov r8d, 3
lea rdx, [0x1402ecb4c]
lea rcx, [rbp + 0x340]
call fcn.14000c230
nop
call fcn.1400e97a0
mov rdi, rax
mov r9d, 0x10d
lea r8, [rbp + 0x3c0]
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x120]
call fcn.14000e2f0
mov rbx, rax
lea rdx, str.CCloudLoginWnd_WebCall_OpenURL2
mov rcx, rax
call fcn.14000f730
mov rcx, qword [rsp + 0x30]
test rcx, rcx
cmovne rsi, rcx
mov rdx, rsi
mov rcx, rbx
call fcn.14000c3d0
mov rax, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x38]
nop
lea rcx, [rbp + 0x120]
call fcn.14000f8a0
nop
mov rdx, qword [rbp + 0x358]
cmp rdx, 0x10
jb 0x14006dda3
inc rdx
mov rcx, qword [rbp + 0x340]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006dd9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006e0b1
call fcn.140171af0
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 0x350], xmm0
mov byte [rbp + 0x340], 0
mov rdx, qword [rbp + 0x3d8]
cmp rdx, 0x10
jb 0x14006ddfb
inc rdx
mov rcx, qword [rbp + 0x3c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ddf6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006e0b7
call fcn.140171af0
mov rcx, qword [rsp + 0x30]
mov edx, dword [rcx - 0x10]
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rbx, rax
test rax, rax
je 0x14006e0bd
mov dword [rsp + 0x28], 5
xor esi, esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, rax
lea rdx, [0x1402ed2c8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
jmp 0x14006dc36
test r14, r14
je 0x14006e06d
cmp qword [r14], 0
je 0x14006e06d
mov ecx, 8
call fcn.140171ab4
mov qword [rsp + 0x30], rax
xor esi, esi
test rax, rax
je 0x14006de8e
mov rdx, qword [r14]
mov rdx, qword [rdx + 8]
mov rcx, rax
call fcn.14000d920
mov r14, rax
jmp 0x14006de91
mov r14, rsi
mov qword [rsp + 0x48], r14
call fcn.1400e97a0
mov r8, qword [rax]
mov edx, r12d
mov rcx, rax
call qword [r8 + InitCommonControls]
cmp al, 1
jne 0x14006e00b
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 0x3f0], xmm0
mov byte [rbp + 0x3e0], 0
mov r8d, 0x53
lea rdx, str.d:jenkins.jenkinsworkspacehalodeskcoral_desktopclouddesktopcloudloginwnd.cpp
lea rcx, [rbp + 0x3e0]
call fcn.14000c230
nop
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 0x370], xmm0
mov byte [rbp + 0x360], 0
mov r8d, 3
lea rdx, [0x1402ecb4c]
lea rcx, [rbp + 0x360]
call fcn.14000c230
nop
call fcn.1400e97a0
mov rdi, rax
mov r9d, 0x117
lea r8, [rbp + 0x3e0]
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x208]
call fcn.14000e2f0
mov rbx, rax
lea rdx, str.CCloudLoginWnd_WebCall_OpenCommonUrlWindow
mov rcx, rax
call fcn.14000f730
mov rdx, r14
mov rcx, rbx
call fcn.14000f570
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r8 + 0x38]
nop
lea rcx, [rbp + 0x208]
call fcn.14000f8a0
nop
mov rdx, qword [rbp + 0x378]
cmp rdx, 0x10
jb 0x14006dfb3
inc rdx
mov rcx, qword [rbp + 0x360]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006dfae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006e0c3
call fcn.140171af0
movdqa xmm0, xmmword [0x1402eb9c0]
movdqu xmmword [rbp + 0x370], xmm0
mov byte [rbp + 0x360], 0
mov rdx, qword [rbp + 0x3f8]
cmp rdx, 0x10
jb 0x14006e00b
inc rdx
mov rcx, qword [rbp + 0x3e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006e006
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006e093
call fcn.140171af0
xor r9d, r9d
mov r8, r14
mov edx, 0x42c
mov rcx, qword [r15 + 0x78]
call qword [sym.imp.USER32.dll_PostMessageW]
test eax, eax
cmovne r14, rsi
test r14, r14
je 0x14006e06d
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006e04a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edx, 8
mov rcx, r14
call fcn.140171af0
jmp 0x14006e06d
mov r9, rbx
mov r8, r14
mov edx, r13d
mov rcx, r15
call fcn.1400db9a0
mov r12d, eax
mov eax, r12d
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.140172190
add rsp, 0x518
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
nop
call fcn.14028c66c
int3
call fcn.14000bf60
nop
call fcn.14028c66c
int3