Function at 0x1400648c0
Capabilities:
Create process on windows
Get file attributes
Set current directory

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1680
call fcn.1401119a0
sub rsp, rax
lea rbp, [rsp + 0x50]
mov rsi, rcx
mov qword [rbp + 0x1680], rbx
mov rdi, rdx
lea rcx, [rbp + 0xb0]
mov rdx, qword [rbp + 0x16a0]
mov r15, r8
test rdx, rdx
mov rax, r9
cmovne rcx, rdx
xor r8d, r8d
mov qword [rbp + 8], rcx
mov qword [rcx], r8
lea r12, [r8 - 1]
mov rcx, qword [rbp + 0x16b8]
test rcx, rcx
je 0x140064945
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r8, r12
xor edx, edx
call fcn.1400d5e90
mov rax, qword [rbp + 0x1688]
xor r8d, r8d
test rdi, rdi
je 0x140065143
movzx edx, word [rdi]
test dx, dx
je 0x140065143
test rax, rax
je 0x14006496e
cmp word [rax], 0
cmove rax, r8
mov qword [rbp + 0x1688], rax
mov qword [rbp + 0x10], r8
mov r9, r8
mov qword [rbp + 0x18], r8
mov r13, rdi
mov eax, SafeArrayAllocDescriptor
movabs r10, 0xffffffffffffff0
test r15, r15
je 0x140064a1e
lea rdx, str.find
mov rcx, rdi
call fcn.1400f55a0
test eax, eax
je 0x140064a0f
lea rdx, str.explore
mov rcx, rdi
call fcn.1400f55a0
test eax, eax
je 0x140064a0f
lea rdx, str.open
mov rcx, rdi
call fcn.1400f55a0
test eax, eax
je 0x140064a0f
lea rdx, str.edit
mov rcx, rdi
call fcn.1400f55a0
test eax, eax
je 0x140064a0f
lea rdx, str.print
mov rcx, rdi
call fcn.1400f55a0
test eax, eax
je 0x140064a0f
lea rdx, str.properties
mov rcx, rdi
call fcn.1400f55a0
test eax, eax
je 0x140064a0f
mov qword [rbp + 0x18], r15
jmp 0x140064b36
mov r9, rdi
mov qword [rbp + 0x10], rdi
mov r13, r15
jmp 0x140064b3a
mov r8, rdi
lea rcx, [0x1401373a0]
cmp dx, ax
je 0x140064a52
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x140064a28
movzx edx, word [r8 + 2]
add r8, 2
mov eax, SafeArrayAllocDescriptor
test dx, dx
jne 0x140064a21
jmp 0x140064b3a
sub r8, rdi
sar r8, 1
lea r14, [r8 + r8]
lea rax, [r14 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140064a6c
mov rcx, r10
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401119a0
sub rsp, rcx
mov r8, r14
mov rdx, rdi
lea rbx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400f1320
xor ecx, ecx
mov word [r14 + rbx], cx
cmp word [rbx], 0x2a
jne 0x140064aa1
lea r9, [rbx + 2]
jmp 0x140064b16
lea rdx, str.find
mov rcx, rbx
call fcn.1400f55a0
test eax, eax
je 0x140064b13
lea rdx, str.explore
mov rcx, rbx
call fcn.1400f55a0
test eax, eax
je 0x140064b13
lea rdx, str.open
mov rcx, rbx
call fcn.1400f55a0
test eax, eax
je 0x140064b13
lea rdx, str.edit
mov rcx, rbx
call fcn.1400f55a0
test eax, eax
je 0x140064b13
lea rdx, str.print
mov rcx, rbx
call fcn.1400f55a0
test eax, eax
je 0x140064b13
lea rdx, str.properties
mov rcx, rbx
call fcn.1400f55a0
test eax, eax
jne 0x140064b2f
mov r9, rbx
mov rsi, qword [rbp + 0x1670]
mov qword [rbp + 0x10], r9
test r9, r9
je 0x140064b3a
lea r13, [rdi + 2]
add r13, r14
jmp 0x140064b3a
mov rsi, qword [rbp + 0x1670]
mov r9, qword [rbp + 0x10]
xor eax, eax
mov byte [rbp], 0
mov dword [rbp + 0x20], eax
cmp byte [rbp + 0x16b0], al
je 0x140064bb6
mov rcx, qword [rsi + 0xc10]
test rcx, rcx
je 0x140064b5d
cmp qword [rcx + 0x10], rax
jne 0x140064b81
mov rcx, qword [rsi + 0xc28]
test rcx, rcx
je 0x140064b6f
cmp qword [rcx + 0x10], rax
jne 0x140064b81
mov rcx, qword [rsi + 0xc40]
test rcx, rcx
je 0x140064bb6
cmp qword [rcx + 0x10], rax
je 0x140064bb6
mov byte [rbp + 0x1678], 1
test r9, r9
je 0x140064bbc
cmp byte [rbp + 0x1690], al
je 0x1400652a9
lea r8, [0x14012046c]
mov rcx, rsi
lea rdx, str.System_verbs_unsupported_with_RunAs.
call fcn.140063260
xor eax, eax
jmp 0x140065148
mov byte [rbp + 0x1678], al
mov rbx, r12
nop
inc rbx
cmp word [r13 + rbx*2], ax
jne 0x140064bc0
cmp rbx, 0x4001
jb 0x140064bfd
cmp byte [rbp + 0x1690], al
je 0x1400652a9
lea r8, [0x14012046c]
mov rcx, rsi
lea rdx, str.String_too_long.
call fcn.140063260
xor eax, eax
jmp 0x140065148
mov r14, qword [rbp + 0x1698]
test r9, r9
jne 0x140064e49
mov qword [rbp + 0x120], rax
xorps xmm0, xmm0
mov eax, 1
movups xmmword [rbp + 0xc0], xmm0
mov dword [rbp + 0xc0], WSAGetLastError
movups xmmword [rbp + 0xf0], xmm0
mov dword [rbp + 0xfc], eax
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
test r14, r14
je 0x140064c69
cmp word [r14], r9w
je 0x140064c69
mov rcx, r14
call fcn.140035d80
mov word [rbp + 0x100], ax
xorps xmm0, xmm0
xor eax, eax
mov qword [rbp + 0x38], rax
movups xmmword [rbp + 0x28], xmm0
test r15, r15
je 0x140064ce4
cmp word [r15], ax
je 0x140064ce4
mov rax, r12
nop dword [rax + rax]
inc rax
cmp word [r15 + rax*2], 0
jne 0x140064c90
add rax, rbx
lea rax, [rax*2 + 0x14]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140064cb9
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401119a0
sub rsp, rcx
lea rdx, str._s__s
mov r9, r15
mov r8, rdi
lea rsi, [rsp + 0x50]
mov rcx, rsi
call fcn.1400071a0
jmp 0x140064d30
lea rax, [rbx*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140064cff
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401119a0
sub rsp, rcx
lea rsi, [rsp + 0x50]
mov rcx, rsi
sub rcx, rdi
nop dword [rax]
movzx eax, word [rdi]
mov word [rdi + rcx], ax
lea rdi, [rdi + 2]
test ax, ax
jne 0x140064d20
movzx edi, byte [rbp + 0x1678]
mov rdx, rsi
test dil, dil
je 0x140064db7
movzx r15d, byte [rbp + 0x1690]
lea rax, [rbp + 0x20]
mov rsi, qword [rbp + 0x1670]
movzx r9d, r15b
mov r8, qword [rbp + 0x1688]
mov rcx, rsi
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 8]
mov qword [rsp + 0x40], rax
lea rax, [rbp]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x16b8]
mov qword [rsp + 0x28], rax
movzx eax, word [rbp + 0x100]
mov word [rsp + 0x20], ax
call fcn.140095650
test eax, eax
je 0x1400652a9
cmp byte [rbp], 0
jne 0x140065110
mov eax, dword [rbp + 0x20]
jmp 0x140064e58
xor r15d, r15d
lea rax, [rbp + 0x28]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp + 0xc0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov rax, qword [rbp + 0x1688]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140064e39
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140064e0b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 8]
mov qword [rcx], rax
mov rax, qword [rbp + 0x16b8]
test rax, rax
je 0x140065117
mov edx, dword [rbp + 0x38]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rax
call fcn.140001570
jmp 0x140065113
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r15d, byte [rbp + 0x1690]
jmp 0x140064e61
movzx r15d, byte [rbp + 0x1690]
movzx edi, byte [rbp + 0x1678]
test dil, dil
jne 0x140065179
mov rsi, qword [rbp + 0x1688]
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov dword [rbp + 0x40], reloc.WSOCK32.dll_WSASetLastError
mov dword [rbp + 0x44], 0x440
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x68], rsi
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
test r14, r14
je 0x140064ebb
cmp word [r14], 0
je 0x140064ebb
mov rcx, r14
call fcn.140035d80
mov dword [rbp + 0x70], eax
jmp 0x140064ec2
mov dword [rbp + 0x70], 1
mov r14, qword [rbp + 0x10]
test r14, r14
je 0x140064ee6
lea rdx, str.properties
mov qword [rbp + 0x50], r14
mov rcx, r14
call fcn.1400f55a0
test eax, eax
jne 0x140064ee6
or dword [rbp + 0x44], 0xc
cmp qword [rbp + 0x18], 0
jne 0x14006507f
lea rax, [rbx*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140064f0c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401119a0
sub rsp, rcx
mov rcx, r13
lea rdi, [rsp + 0x50]
mov rdx, rdi
sub rdx, r13
nop dword [rax]
movzx eax, word [rcx]
mov word [rcx + rdx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140064f30
cmp word [rdi], 0x22
lea rbx, [rdi + 2]
jne 0x140064f8f
mov edx, SafeArrayAllocDescriptor
mov rcx, rbx
call fcn.1400f0a4c
test rax, rax
je 0x140064f8f
movzx edi, byte [rbp + 0x1678]
xor ecx, ecx
mov word [rax], cx
mov r13, rbx
movzx ecx, word [rax + 2]
test cx, cx
je 0x14006507f
lea rbx, [rax + 2]
cmp cx, 0x20
jne 0x140065083
add rbx, 2
jmp 0x140065083
test rsi, rsi
je 0x140064f9d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edx, SafeArrayAllocDescriptor
mov rcx, rbx
call fcn.1400f0a4c
mov rsi, rax
test rax, rax
je 0x140065045
lea rbx, [rax - 2]
cmp rbx, rdi
jbe 0x140064fdd
nop
movzx edx, word [rbx]
lea rcx, [0x140140528]
call fcn.1400f0a4c
test rax, rax
jne 0x140064fdd
sub rbx, 2
cmp rbx, rdi
ja 0x140064fc0
cmp word [rbx], 0x2e
jne 0x14006502c
xor eax, eax
mov word [rsi], ax
mov rax, rsi
sub rax, rbx
and rax, 0xfffffffffffffffe
cmp rax, 8
jne 0x14006500c
mov rdx, rbx
lea rcx, str..exe.bat.com.cmd.hta
call fcn.1400d0d80
test rax, rax
jne 0x14006503c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x14006503c
mov eax, SafeArrayAllocDescriptor
lea rcx, [rsi + 2]
mov word [rsi], ax
mov edx, eax
jmp 0x140064fa5
mov eax, SafeArrayAllocDescriptor
lea rcx, [rsi + 2]
mov edx, eax
jmp 0x140064fa5
mov r13, rdi
lea rbx, [rsi + 2]
jmp 0x140065049
mov rbx, qword [rbp + 0x18]
cmp qword [rbp + 0x1688], 0
je 0x140065076
mov rax, qword [0x14015e420]
lea rcx, [0x14012046c]
test rax, rax
je 0x140065070
mov rax, qword [rax]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
movzx edi, byte [rbp + 0x1678]
jmp 0x140065083
mov rbx, qword [rbp + 0x18]
lea rcx, [rbp + 0x40]
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14006516a
mov eax, dword [0x140166830]
test al, 1
jne 0x1400650d6
or eax, 1
lea rcx, str.kernel32.dll
mov dword [0x140166830], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetProcessId
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140166838], rax
jmp 0x1400650dd
mov rax, qword [0x140166838]
mov rcx, qword [rbp + 0xa8]
mov rdx, qword [rbp + 8]
mov qword [rdx], rcx
test rcx, rcx
je 0x140065162
mov rbx, qword [rbp + 0x16b8]
test rbx, rbx
je 0x140065162
test rax, rax
je 0x140065162
call rax
mov edx, eax
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.140001570
xor r15d, r15d
mov rcx, qword [rbp + 8]
cmp byte [rbp + 0x16a8], 0
je 0x14006512b
mov rax, qword [0x14015bc10]
mov dword [rax + 0x40], r15d
cmp qword [rbp + 0x16a0], 0
jne 0x140065143
mov rcx, qword [rcx]
test rcx, rcx
je 0x140065143
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rbp + 0x1680]
lea rsp, [rbp + 0x1630]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdx
xor r15d, r15d
jmp 0x140065117
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [rbp + 0x1670]
jmp 0x140065181
mov r14, qword [rbp + 0x10]
mov rbx, qword [rbp + 0x18]
cmp byte [rbp + 0x16a8], 0
je 0x140065194
mov rcx, qword [0x14015bc10]
mov dword [rcx + 0x40], eax
test r15b, r15b
je 0x1400652a9
lea rcx, [rbp + 0x230]
xor r15d, r15d
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x1ff
mov r8d, eax
mov qword [rsp + 0x20], rcx
xor edx, edx
mov ecx, 0x1200
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test r14, r14
je 0x1400651ee
mov r9, r14
lea r8, str._nVerb:___s_
mov edx, 0x80
lea rcx, [rbp + 0x130]
call fcn.1400d08d0
jmp 0x1400651f6
mov word [rbp + 0x130], r15w
lea rcx, [0x14012046c]
test rbx, rbx
mov rdx, rcx
mov rax, r12
cmovne rdx, rbx
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140065210
cmp rax, 0x190
lea r9, [0x1401394f0]
mov r8, rcx
cmova r8, r9
nop
inc r12
cmp word [r13 + r12*2], r15w
jne 0x140065230
mov qword [rsp + 0x40], r8
lea rax, str.Launch_Error__possibly_related_to_RunAs_:
mov qword [rsp + 0x38], rdx
lea r8, str._s_nAction:____0.400s_s__s_nParams:____0.400s_s_
cmp r12, 0x190
mov edx, 0x800
cmova rcx, r9
test dil, dil
lea r9, str.Failed_attempt_to_launch_program_or_document:
cmovne r9, rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x630]
mov qword [rsp + 0x20], r13
call fcn.1400d08d0
lea r8, [rbp + 0x230]
mov rcx, rsi
lea rdx, [rbp + 0x630]
call fcn.140063260
xor eax, eax
jmp 0x140065148