Function at 0x1400527c0
Capabilities:
Create process on windows
Get file attributes
Set current directory

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1690
call fcn.1400eb380
sub rsp, rax
lea rbp, [rsp + 0x50]
mov rsi, rcx
mov qword [rbp + 0x1690], rbx
mov rbx, rdx
lea rcx, [rbp + 0x130]
mov rdx, qword [rbp + 0x16b0]
mov rax, r9
test rdx, rdx
mov r12, r8
cmovne rcx, rdx
xor r15d, r15d
mov qword [rbp + 8], rcx
mov qword [rcx], r15
lea r13, [r15 - 1]
mov rcx, qword [rbp + 0x16c8]
test rcx, rcx
je 0x140052842
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r8, r13
xor edx, edx
call fcn.1400b0830
mov rax, qword [rbp + 0x1698]
test rbx, rbx
je 0x140052dc6
movzx edx, word [rbx]
test dx, dx
je 0x140052dc6
test rax, rax
je 0x14005286b
cmp word [rax], r15w
cmove rax, r15
mov qword [rbp + 0x1698], rax
mov qword [rbp + 0x18], r15
mov r9, r15
mov qword [rbp + 0x10], rbx
mov r14, rbx
mov qword [rbp + 0x20], r15
mov eax, SafeArrayAllocDescriptor
movabs r10, 0xffffffffffffff0
test r12, r12
je 0x140052926
lea rdx, str.find
mov rcx, rbx
call fcn.1400d0944
test eax, eax
je 0x140052913
lea rdx, str.explore
mov rcx, rbx
call fcn.1400d0944
test eax, eax
je 0x140052913
lea rdx, str.open
mov rcx, rbx
call fcn.1400d0944
test eax, eax
je 0x140052913
lea rdx, str.edit
mov rcx, rbx
call fcn.1400d0944
test eax, eax
je 0x140052913
lea rdx, str.print
mov rcx, rbx
call fcn.1400d0944
test eax, eax
je 0x140052913
lea rdx, str.properties
mov rcx, rbx
call fcn.1400d0944
test eax, eax
je 0x140052913
mov qword [rbp + 0x20], r12
mov r9, r15
jmp 0x140052a43
mov r9, rbx
mov qword [rbp + 0x18], rbx
mov r14, r12
mov qword [rbp + 0x10], r12
jmp 0x140052a43
mov r8, rbx
nop dword [rax]
lea rcx, [0x1401108a0]
cmp dx, ax
je 0x140052961
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x140052937
movzx edx, word [r8 + 2]
add r8, 2
mov eax, SafeArrayAllocDescriptor
test dx, dx
jne 0x140052930
jmp 0x140052a43
sub r8, rbx
sar r8, 1
lea rsi, [r8 + r8]
lea rax, [rsi + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14005297b
mov rcx, r10
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400eb380
sub rsp, rcx
mov r8, rsi
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1400cfd20
mov rdi, rax
mov word [rsi + rax], r15w
cmp word [rax], 0x2a
jne 0x1400529ae
lea r9, [rax + 2]
jmp 0x140052a23
lea rdx, str.find
mov rcx, rdi
call fcn.1400d0944
test eax, eax
je 0x140052a20
lea rdx, str.explore
mov rcx, rdi
call fcn.1400d0944
test eax, eax
je 0x140052a20
lea rdx, str.open
mov rcx, rdi
call fcn.1400d0944
test eax, eax
je 0x140052a20
lea rdx, str.edit
mov rcx, rdi
call fcn.1400d0944
test eax, eax
je 0x140052a20
lea rdx, str.print
mov rcx, rdi
call fcn.1400d0944
test eax, eax
je 0x140052a20
lea rdx, str.properties
mov rcx, rdi
call fcn.1400d0944
test eax, eax
jne 0x140052a39
mov r9, rdi
mov qword [rbp + 0x18], r9
test r9, r9
je 0x140052a3c
lea r14, [rbx + 2]
add r14, rsi
mov qword [rbp + 0x10], r14
jmp 0x140052a3c
mov r9, r15
mov rsi, qword [rbp + 0x1680]
mov eax, r15d
mov byte [rbp], r15b
mov dword [rbp + 0x28], eax
cmp byte [rbp + 0x16c0], al
je 0x140052ac0
mov rcx, qword [rsi + 0xbf0]
test rcx, rcx
je 0x140052a67
cmp qword [rcx + 0x10], rax
jne 0x140052a8b
mov rcx, qword [rsi + 0xc08]
test rcx, rcx
je 0x140052a79
cmp qword [rcx + 0x10], rax
jne 0x140052a8b
mov rcx, qword [rsi + 0xc20]
test rcx, rcx
je 0x140052ac0
cmp qword [rcx + 0x10], rax
je 0x140052ac0
mov byte [rbp + 0x1688], 1
test r9, r9
je 0x140052ac6
cmp byte [rbp + 0x16a0], al
je 0x14005324b
lea r8, [0x1400fb87c]
mov rcx, rsi
lea rdx, str.System_verbs_unsupported_with_RunAs.
call fcn.1400515e0
xor eax, eax
jmp 0x140052dcb
mov byte [rbp + 0x1688], al
mov rdi, r13
nop dword [rax]
inc rdi
cmp word [r14 + rdi*2], ax
jne 0x140052ad0
cmp rdi, 0x4001
jb 0x140052b0c
cmp byte [rbp + 0x16a0], al
je 0x14005324b
lea r8, [0x1400fb87c]
mov rcx, rsi
lea rdx, str.String_too_long.
call fcn.1400515e0
xor eax, eax
jmp 0x140052dcb
mov rsi, qword [rbp + 0x16a8]
mov r15d, 6
test r9, r9
jne 0x140052ded
mov qword [rbp + 0x120], rax
xorps xmm0, xmm0
mov r14d, 1
movups xmmword [rbp + 0xc0], xmm0
mov dword [rbp + 0xc0], WSAGetLastError
movups xmmword [rbp + 0xf0], xmm0
mov dword [rbp + 0xfc], r14d
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
test rsi, rsi
je 0x140052bd6
cmp word [rsi], ax
je 0x140052bd6
lea rdx, [0x1401121e0]
mov rcx, rsi
call fcn.1400ad2f0
test rax, rax
je 0x140052b95
mov word [rbp + 0x100], r15w
jmp 0x140052bde
lea rdx, [0x1401121e8]
mov rcx, rsi
call fcn.1400ad2f0
test rax, rax
je 0x140052bb7
mov eax, 3
mov word [rbp + 0x100], ax
jmp 0x140052bde
lea rdx, str.HIDE
mov rcx, rsi
call fcn.1400ad2f0
test rax, rax
je 0x140052bd6
xor eax, eax
mov word [rbp + 0x100], ax
jmp 0x140052bde
mov word [rbp + 0x100], r14w
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x40], rax
movups xmmword [rbp + 0x30], xmm0
test r12, r12
je 0x140052c54
cmp word [r12], ax
je 0x140052c54
mov rax, r13
nop word [rax + rax]
inc rax
cmp word [r12 + rax*2], 0
jne 0x140052c00
add rax, rdi
lea rax, [rax*2 + 0x14]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140052c29
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400eb380
sub rsp, rcx
lea rdx, str.__s___s
mov r9, r12
mov r8, rbx
lea r14, [rsp + 0x50]
mov rcx, r14
call fcn.140006c50
jmp 0x140052ca0
lea rax, [rdi*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140052c6f
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400eb380
sub rsp, rcx
lea r14, [rsp + 0x50]
mov rcx, r14
sub rcx, rbx
nop dword [rax]
movzx eax, word [rbx]
mov word [rbx + rcx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x140052c90
movzx ebx, byte [rbp + 0x1688]
mov rdx, r14
mov r12, qword [rbp + 0x1698]
test bl, bl
je 0x140052d22
movzx r9d, byte [rbp + 0x16a0]
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x1680]
mov r8, r12
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 8]
mov qword [rsp + 0x40], rax
lea rax, [rbp]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x16c8]
mov qword [rsp + 0x28], rax
movzx eax, word [rbp + 0x100]
mov word [rsp + 0x20], ax
call fcn.14007e680
test eax, eax
je 0x14005324b
cmp byte [rbp], 0
jne 0x140052d95
mov eax, dword [rbp + 0x28]
mov r14, qword [rbp + 0x10]
jmp 0x140052dfb
lea rax, [rbp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp + 0xc0]
xor ecx, ecx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140052de5
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x140052d70
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x30]
mov rcx, qword [rbp + 8]
mov qword [rcx], rax
mov rax, qword [rbp + 0x16c8]
test rax, rax
je 0x140052d99
mov edx, dword [rbp + 0x40]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rax
call fcn.1400014b0
mov rcx, qword [rbp + 8]
xor esi, esi
cmp byte [rbp + 0x16b8], 0
je 0x140052dae
mov rax, qword [0x14012fc08]
mov dword [rax + 0x40], esi
cmp qword [rbp + 0x16b0], 0
jne 0x140052dc6
mov rcx, qword [rcx]
test rcx, rcx
je 0x140052dc6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rbp + 0x1690]
lea rsp, [rbp + 0x1640]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140052e03
mov r12, qword [rbp + 0x1698]
movzx ebx, byte [rbp + 0x1688]
test bl, bl
jne 0x14005311e
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x50], reloc.WSOCK32.dll_WSASetLastError
mov dword [rbp + 0x54], 0x440
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x78], r12
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
test rsi, rsi
je 0x140052e99
cmp word [rsi], 0
je 0x140052e99
lea rdx, [0x1401121e0]
mov rcx, rsi
call fcn.1400ad2f0
test rax, rax
jne 0x140052e9f
lea rdx, [0x1401121e8]
mov rcx, rsi
call fcn.1400ad2f0
test rax, rax
je 0x140052e7b
mov r15d, 3
jmp 0x140052e9f
lea rdx, str.HIDE
mov rcx, rsi
call fcn.1400ad2f0
xor r14d, r14d
test rax, rax
mov r15d, r14d
sete r15b
jmp 0x140052ea2
mov r15d, 1
xor r14d, r14d
mov dword [rbp + 0x80], r15d
mov r15, qword [rbp + 0x18]
test r15, r15
je 0x140052ecd
lea rdx, str.properties
mov qword [rbp + 0x60], r15
mov rcx, r15
call fcn.1400d0944
test eax, eax
jne 0x140052ecd
or dword [rbp + 0x54], 0xc
cmp qword [rbp + 0x20], 0
jne 0x1400530c3
lea rax, [rdi*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140052ef3
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400eb380
sub rsp, rcx
mov rcx, qword [rbp + 0x10]
lea rdi, [rsp + 0x50]
mov rdx, rdi
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rcx + rdx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140052f20
cmp word [rdi], 0x22
lea rbx, [rdi + 2]
jne 0x140052f80
mov edx, SafeArrayAllocDescriptor
mov rcx, rbx
call fcn.1400cbb24
test rax, rax
je 0x140052f80
xor esi, esi
mov r14, rbx
mov word [rax], si
movzx ecx, word [rax + 2]
test cx, cx
je 0x140053065
lea rbx, [rax + 2]
mov qword [rbp + 0x20], rbx
cmp cx, 0x20
jne 0x140053065
add rbx, 2
mov qword [rbp + 0x20], rbx
jmp 0x140053065
test r12, r12
je 0x140052f8e
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edx, SafeArrayAllocDescriptor
mov rcx, rbx
call fcn.1400cbb24
mov rsi, rax
test rax, rax
je 0x140053037
lea rbx, [rax - 2]
cmp rbx, rdi
jbe 0x140052fcd
movzx edx, word [rbx]
lea rcx, [0x140117d18]
call fcn.1400cbb24
test rax, rax
jne 0x140052fcd
sub rbx, 2
cmp rbx, rdi
ja 0x140052fb0
cmp word [rbx], 0x2e
jne 0x14005301b
mov rax, rsi
mov word [rsi], r14w
sub rax, rbx
and rax, 0xfffffffffffffffe
cmp rax, 8
jne 0x140052ffb
mov rdx, rbx
lea rcx, str..exe.bat.com.cmd.hta
call fcn.1400ad2f0
test rax, rax
jne 0x14005302b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x14005302b
mov eax, SafeArrayAllocDescriptor
lea rcx, [rsi + 2]
mov word [rsi], ax
mov edx, eax
jmp 0x140052f96
mov eax, SafeArrayAllocDescriptor
lea rcx, [rsi + 2]
mov edx, eax
jmp 0x140052f96
lea rax, [rsi + 2]
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x20], rax
test r12, r12
je 0x14005305f
mov rax, qword [0x1401320f0]
lea rcx, [0x1400fb87c]
test rax, rax
je 0x140053059
mov rax, qword [rax]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov r14, qword [rbp + 0x10]
xor esi, esi
movzx ebx, byte [rbp + 0x1688]
mov rdi, qword [rbp + 0x20]
lea rcx, [rbp + 0x50]
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x68], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140053116
mov eax, dword [0x140138fa0]
test al, 1
jne 0x1400530cb
or eax, 1
lea rcx, str.kernel32.dll
mov dword [0x140138fa0], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetProcessId
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140138fa8], rax
jmp 0x1400530d2
mov r14, qword [rbp + 0x10]
xor esi, esi
jmp 0x14005306c
mov rax, qword [0x140138fa8]
mov rcx, qword [rbp + 0xb8]
mov rdx, qword [rbp + 8]
mov qword [rdx], rcx
test rcx, rcx
je 0x14005310e
mov rbx, qword [rbp + 0x16c8]
test rbx, rbx
je 0x14005310e
test rax, rax
je 0x14005310e
call rax
mov edx, eax
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.1400014b0
mov rcx, qword [rbp + 8]
jmp 0x140052d9b
mov rcx, rdx
jmp 0x140052d9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140053126
mov r15, qword [rbp + 0x18]
mov rdi, qword [rbp + 0x20]
cmp byte [rbp + 0x16b8], 0
je 0x140053139
mov rcx, qword [0x14012fc08]
mov dword [rcx + 0x40], eax
cmp byte [rbp + 0x16a0], 0
je 0x14005324b
lea rcx, [rbp + 0x240]
xor esi, esi
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x1ff
mov r8d, eax
mov qword [rsp + 0x20], rcx
xor edx, edx
mov ecx, 0x1200
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test r15, r15
je 0x140053196
mov r9, r15
lea r8, str._nVerb:___s_
mov edx, 0x80
lea rcx, [rbp + 0x140]
call fcn.1400acf50
jmp 0x14005319d
mov word [rbp + 0x140], si
lea rcx, [0x1400fb87c]
test rdi, rdi
mov rdx, rcx
mov rax, r13
cmovne rdx, rdi
inc rax
cmp word [rdx + rax*2], si
jne 0x1400531b1
cmp rax, 0x190
lea r9, [0x140111310]
mov r8, rcx
cmova r8, r9
nop
inc r13
cmp word [r14 + r13*2], si
jne 0x1400531d0
mov qword [rsp + 0x40], r8
lea rax, str.Launch_Error__possibly_related_to_RunAs_:
mov qword [rsp + 0x38], rdx
lea r8, str._s_nAction:____0.400s_s__s_nParams:____0.400s_s_
cmp r13, 0x190
mov edx, 0x800
cmova rcx, r9
test bl, bl
lea r9, str.Failed_attempt_to_launch_program_or_document:
cmovne r9, rax
lea rax, [rbp + 0x140]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x640]
mov qword [rsp + 0x20], r14
call fcn.1400acf50
mov rcx, qword [rbp + 0x1680]
lea r8, [rbp + 0x240]
lea rdx, [rbp + 0x640]
call fcn.1400515e0
xor eax, eax
jmp 0x140052dcb