Function at 0x180039350
Capabilities:
Create process on windows
Get common file path

Disassembly:
push rbp
push rbx
push rdi
push r12
lea rbp, [rsp - 0x1f88]
mov eax, 0x2088
call fcn.1801109a0
sub rsp, rax
mov rax, qword [0x180166040]
xor rax, rsp
mov qword [rbp + 0x1f70], rax
xor bl, bl
mov qword [rsp + 0x58], rdx
cmp dword [rdx + 0xc], 0
movzx edi, r8b
je 0x180039ab1
mov rcx, qword [rdx]
mov r12, 0xffffffffffffffff
mov rax, r12
nop
inc rax
cmp byte [rcx + rax], bl
jne 0x1800393a0
test eax, eax
je 0x180039ab1
mov edx, 0x1000
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, eax
test eax, eax
je 0x180039ab1
cmp ecx, 0x102
ja 0x180039ab1
mov edx, 0x5c
mov word [rsp + rcx*2 + 0x70], dx
inc ecx
add rcx, rcx
cmp rcx, 0x2000
jae 0x180039ad0
mov qword [rsp + 0x20b0], rsi
mov qword [rsp + 0x20c0], r13
mov qword [rsp + 0x20c8], r14
xor r14d, r14d
mov qword [rsp + 0x2080], r15
mov ebx, r14d
mov dword [rsp + 0x44], ebx
mov esi, r14d
mov word [rsp + rcx + 0x70], r14w
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x48], 0x80
test dil, dil
je 0x180039473
xor r8d, r8d
lea rcx, [rsp + 0x38]
mov edx, 9
call fcn.1800126d0
mov ebx, dword [rsp + 0x44]
mov rsi, qword [rsp + 0x38]
cmp ebx, 9
jl 0x180039473
mov rax, qword [str._select_]
test ebx, ebx
mov ecx, r14d
cmovne rcx, rsi
mov qword [rcx], rax
mov byte [rcx + 8], r14b
lea r13, [0x180132d6c]
mov r10d, 0x400000
test ebx, ebx
je 0x18003949a
mov rdi, r12
inc rdi
cmp byte [rsi + rdi], r14b
jne 0x180039487
test edi, edi
js 0x180039640
jmp 0x18003949d
mov edi, r14d
lea r9d, [rdi + 1]
mov dword [rsp + 0x50], ebx
lea r15d, [r9 + 1]
mov dword [rsp + 0x34], r9d
mov r8d, r15d
sub r8d, ebx
mov dword [rsp + 0x30], r8d
test r8d, r8d
jle 0x180039521
test ebx, ebx
lea rcx, [rsp + 0x38]
mov rax, r14
mov edx, r15d
cmovne rax, rsi
xor r8d, r8d
mov qword [rsp + 0x60], rax
call fcn.1800126d0
mov ebx, dword [rsp + 0x44]
mov rdx, r14
mov rcx, qword [rsp + 0x60]
cmp ebx, r15d
cmove rdx, rax
cmp rdx, rcx
je 0x18003950c
cmp r13, rcx
jb 0x18003950c
movsxd rax, dword [rsp + 0x50]
add rax, rcx
cmp r13, rax
jae 0x18003950c
sub rdx, rcx
add r13, rdx
mov r9d, dword [rsp + 0x34]
mov r10d, 0x400000
mov r8d, dword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
cmp ebx, r15d
jl 0x180039640
test ebx, ebx
mov rdx, r14
cmovne rdx, rsi
test r13, r13
je 0x180039542
movzx eax, byte [r13]
mov ecx, edi
mov byte [rcx + rdx], al
movsxd rax, r9d
mov byte [rax + rdx], r14b
test r8d, r8d
jns 0x180039640
test r15d, r15d
cmovs r15d, r14d
cmp r15d, ebx
je 0x180039640
cmp r15d, dword [rsp + 0x40]
jg 0x180039572
test r15d, r15d
jns 0x180039639
mov eax, r15d
cdq
sub eax, edx
mov edx, dword [rsp + 0x48]
sar eax, 1
mov ecx, edx
cmp eax, edx
cmovge ecx, eax
cmp r15d, 1
jge 0x180039590
mov edi, r14d
jmp 0x1800395c3
mov eax, 0x1000
cmp edx, eax
jge 0x18003959f
lea edi, [rcx + r15]
jmp 0x1800395c3
and ecx, 0xfffff000
cmp ecx, eax
jge 0x1800395ad
mov ecx, eax
jmp 0x1800395b4
cmp ecx, r10d
cmovg ecx, r10d
lea edi, [rcx + 0x60]
add edi, r15d
and edi, 0xfffff000
sub edi, 0x60
cmp edi, dword [rsp + 0x40]
je 0x180039639
mov rcx, rsi
test edi, edi
jg 0x1800395e7
call fcn.1800e1170
mov rsi, r14
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x40], r14d
mov ebx, r14d
jmp 0x18003963c
movsxd rdx, edi
call fcn.1800e1168
mov r13, rax
test rax, rax
jne 0x18003962d
movsxd rcx, edi
call fcn.1800e1184
mov r13, rax
test rax, rax
je 0x180039640
test rsi, rsi
je 0x18003962d
cmp r15d, ebx
cmovl ebx, r15d
test ebx, ebx
jle 0x180039625
movsxd r8, ebx
mov rdx, rsi
mov rcx, rax
call fcn.1801188c0
mov rcx, rsi
call fcn.1800e1170
mov rsi, r13
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x40], edi
mov ebx, r15d
mov dword [rsp + 0x44], ebx
mov r13, qword [rsp + 0x58]
cmp dword [r13 + 0xc], r14d
je 0x180039659
mov r13, qword [r13]
mov r15d, r14d
test r13, r13
je 0x180039679
jmp 0x180039667
mov byte [0x180186048], r14b
lea r13, [0x180186048]
mov r15, r12
nop word [rax + rax]
inc r15
cmp byte [r15 + r13], r14b
jne 0x180039670
test ebx, ebx
je 0x18003968b
mov rdi, r12
inc rdi
cmp byte [rsi + rdi], r14b
jne 0x180039680
jmp 0x18003968e
mov edi, r14d
test r15d, r15d
jne 0x1800396d1
test edi, edi
jne 0x180039895
xor r8d, r8d
lea rcx, [rsp + 0x38]
mov edx, 1
call fcn.1800126d0
mov ebx, dword [rsp + 0x44]
mov rcx, r14
mov rsi, qword [rsp + 0x38]
cmp ebx, 1
cmove rcx, rax
test rcx, rcx
je 0x180039895
mov byte [rcx], r14b
jmp 0x180039895
jle 0x180039895
test edi, edi
js 0x180039895
lea eax, [rdi + r15]
mov dword [rsp + 0x50], ebx
lea r12d, [rax + 1]
mov dword [rsp + 0x34], eax
mov eax, r12d
sub eax, ebx
mov dword [rsp + 0x30], eax
test eax, eax
jle 0x180039754
test ebx, ebx
lea rcx, [rsp + 0x38]
mov rax, r14
mov edx, r12d
cmovne rax, rsi
xor r8d, r8d
mov qword [rsp + 0x58], rax
call fcn.1800126d0
mov ebx, dword [rsp + 0x44]
mov rcx, r14
cmp ebx, r12d
cmove rcx, rax
test r13, r13
je 0x18003974f
mov rdx, qword [rsp + 0x58]
cmp rcx, rdx
je 0x18003974f
cmp r13, rdx
jb 0x18003974f
movsxd rax, dword [rsp + 0x50]
add rax, rdx
cmp r13, rax
jae 0x18003974f
sub rcx, rdx
add r13, rcx
mov rsi, qword [rsp + 0x38]
cmp ebx, r12d
jl 0x18003988e
test ebx, ebx
mov rax, r14
cmovne rax, rsi
mov qword [rsp + 0x58], rax
test r13, r13
je 0x180039781
movsxd rcx, edi
mov rdx, r13
add rcx, rax
movsxd r8, r15d
call fcn.1801188c0
movsxd rax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x58]
mov byte [rax + rcx], r14b
cmp dword [rsp + 0x30], r14d
jge 0x18003988e
test r12d, r12d
cmovs r12d, r14d
cmp r12d, ebx
je 0x18003988e
cmp r12d, dword [rsp + 0x40]
jg 0x1800397ba
test r12d, r12d
jns 0x180039887
mov eax, r12d
cdq
sub eax, edx
mov edx, dword [rsp + 0x48]
sar eax, 1
mov ecx, edx
cmp eax, edx
cmovge ecx, eax
cmp r12d, 1
jge 0x1800397d8
mov edi, r14d
jmp 0x18003980e
mov eax, 0x1000
cmp edx, eax
jge 0x1800397e7
lea edi, [rcx + r12]
jmp 0x18003980e
and ecx, 0xfffff000
cmp ecx, eax
jge 0x1800397f5
mov ecx, eax
jmp 0x1800397ff
mov eax, 0x400000
cmp ecx, eax
cmovg ecx, eax
lea edi, [rcx + 0x60]
add edi, r12d
and edi, 0xfffff000
sub edi, 0x60
cmp edi, dword [rsp + 0x40]
je 0x180039887
mov rcx, rsi
test edi, edi
jg 0x180039832
call fcn.1800e1170
mov rsi, r14
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x40], r14d
mov ebx, r14d
jmp 0x18003988a
movsxd r13, edi
mov rdx, r13
call fcn.1800e1168
mov r15, rax
test rax, rax
jne 0x18003987b
mov rcx, r13
call fcn.1800e1184
mov r15, rax
test rax, rax
je 0x18003988e
test rsi, rsi
je 0x18003987b
cmp r12d, ebx
cmovl ebx, r12d
test ebx, ebx
jle 0x180039873
movsxd r8, ebx
mov rdx, rsi
mov rcx, rax
call fcn.1801188c0
mov rcx, rsi
call fcn.1800e1170
mov rsi, r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x40], edi
mov ebx, r12d
mov dword [rsp + 0x44], ebx
mov r12, 0xffffffffffffffff
lea r15, [0x180132d70]
test ebx, ebx
je 0x1800398b4
inc r12
cmp byte [rsi + r12], r14b
jne 0x1800398a0
test r12d, r12d
js 0x180039a27
jmp 0x1800398b7
mov r12d, r14d
lea r9d, [r12 + 2]
mov dword [rsp + 0x50], ebx
lea edi, [r9 + 1]
mov dword [rsp + 0x30], r9d
mov r8d, edi
sub r8d, ebx
mov dword [rsp + 0x34], r8d
test r8d, r8d
jle 0x18003992a
test ebx, ebx
lea rcx, [rsp + 0x38]
mov r13, r14
mov edx, edi
cmovne r13, rsi
xor r8d, r8d
call fcn.1800126d0
mov ebx, dword [rsp + 0x44]
mov rcx, r14
cmp ebx, edi
cmove rcx, rax
cmp rcx, r13
je 0x18003991b
cmp r15, r13
jb 0x18003991b
movsxd rax, dword [rsp + 0x50]
add rax, r13
cmp r15, rax
jae 0x18003991b
sub rcx, r13
add r15, rcx
mov r9d, dword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov rsi, qword [rsp + 0x38]
cmp ebx, edi
jl 0x180039a27
test ebx, ebx
mov rdx, r14
cmovne rdx, rsi
test r15, r15
je 0x18003994b
movzx eax, word [r15]
mov ecx, r12d
mov word [rcx + rdx], ax
movsxd rax, r9d
mov byte [rax + rdx], r14b
test r8d, r8d
jns 0x180039a27
test edi, edi
cmovs edi, r14d
cmp edi, ebx
je 0x180039a27
cmp edi, dword [rsp + 0x40]
jg 0x180039977
test edi, edi
jns 0x180039a25
mov eax, edi
cdq
sub eax, edx
mov edx, dword [rsp + 0x48]
sar eax, 1
mov ecx, edx
cmp eax, edx
cmovge ecx, eax
cmp edi, 1
jge 0x180039993
mov eax, r14d
jmp 0x1800399c4
mov eax, 0x1000
cmp edx, eax
jge 0x1800399a1
lea eax, [rcx + rdi]
jmp 0x1800399c4
and ecx, 0xfffff000
cmp ecx, eax
jl 0x1800399b7
mov edx, 0x400000
mov eax, ecx
cmp ecx, edx
cmovg eax, edx
add eax, 0x60
add eax, edi
and eax, 0xfffff000
sub eax, 0x60
cmp eax, dword [rsp + 0x40]
je 0x180039a25
mov rcx, rsi
test eax, eax
jg 0x1800399db
call fcn.1800e1170
mov rsi, r14
jmp 0x180039a2e
movsxd r12, eax
mov rdx, r12
call fcn.1800e1168
mov r15, rax
test rax, rax
jne 0x180039a22
mov rcx, r12
call fcn.1800e1184
mov r15, rax
test rax, rax
je 0x180039a27
test rsi, rsi
je 0x180039a22
cmp edi, ebx
cmovl ebx, edi
test ebx, ebx
jle 0x180039a1a
movsxd r8, ebx
mov rdx, rsi
mov rcx, rax
call fcn.1801188c0
mov rcx, rsi
call fcn.1800e1170
mov rsi, r15
mov ebx, edi
mov rdx, rsi
test ebx, ebx
jne 0x180039a35
lea rdx, [0x18012f730]
lea rcx, [rsp + 0x38]
call fcn.18001f0e0
cmp dword [rsp + 0x44], r14d
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 1
lea r8, str.explorer.exe
cmovne r14, qword [rsp + 0x38]
lea rdx, [0x180132d98]
mov r9, r14
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x38]
mov rbx, rax
call fcn.1800e1170
mov rcx, rsi
call fcn.1800e1170
mov r15, qword [rsp + 0x2080]
cmp rbx, 0x20
mov r14, qword [rsp + 0x20c8]
mov r13, qword [rsp + 0x20c0]
setbe bl
mov rsi, qword [rsp + 0x20b0]
movzx eax, bl
mov rcx, qword [rbp + 0x1f70]
xor rcx, rsp
call fcn.1800b6030
add rsp, 0x2088
pop r12
pop rdi
pop rbx
pop rbp
ret
call fcn.1800b6764
int3