Function at 0x14003eaa0
Capabilities:
Create process on windows
Get file attributes
Set current directory

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1680
call fcn.1401110b0
sub rsp, rax
lea rbp, [rsp + 0x50]
mov r14, rcx
mov qword [rbp + 0x1680], rbx
mov rbx, rdx
mov rdx, qword [rbp + 0x16a0]
lea rcx, [rbp + 0x40]
mov rax, r9
test rdx, rdx
mov r13, r8
cmovne rcx, rdx
xor r15d, r15d
mov qword [rcx], r15
mov qword [rbp + 8], rcx
mov rcx, qword [rbp + 0x16b8]
test rcx, rcx
je 0x14003eb0e
call fcn.140023100
mov rax, qword [rbp + 0x1688]
test rbx, rbx
je 0x14003f493
movzx edx, word [rbx]
test dx, dx
je 0x14003f493
test rax, rax
je 0x14003eb37
cmp word [rax], r15w
cmove rax, r15
mov qword [rbp + 0x1688], rax
mov r9, r15
mov qword [rbp + 0x10], r15
mov rdi, rbx
mov qword [rbp], rbx
mov qword [rbp + 0x18], r15
mov eax, SafeArrayAllocDescriptor
movabs r8, 0xffffffffffffff0
test r13, r13
je 0x14003ebf2
lea rdx, str.find
mov rcx, rbx
call fcn.140108424
test eax, eax
je 0x14003ebdf
lea rdx, str.explore
mov rcx, rbx
call fcn.140108424
test eax, eax
je 0x14003ebdf
lea rdx, str.open
mov rcx, rbx
call fcn.140108424
test eax, eax
je 0x14003ebdf
lea rdx, str.edit
mov rcx, rbx
call fcn.140108424
test eax, eax
je 0x14003ebdf
lea rdx, [0x1401352c8]
mov rcx, rbx
call fcn.140108424
test eax, eax
je 0x14003ebdf
lea rdx, str.properties
mov rcx, rbx
call fcn.140108424
test eax, eax
je 0x14003ebdf
mov qword [rbp + 0x18], r13
mov r9, r15
jmp 0x14003ed06
mov r9, rbx
mov qword [rbp + 0x10], rbx
mov rdi, r13
mov qword [rbp], r13
jmp 0x14003ed06
lea rcx, [0x14012ed90]
nop dword [rax]
cmp dx, ax
je 0x14003ec29
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14003ec00
movzx edx, word [rdi + 2]
add rdi, 2
mov eax, SafeArrayAllocDescriptor
test dx, dx
jne 0x14003ebf2
jmp 0x14003ed03
sub rdi, rbx
sar rdi, 1
lea r12, [rdi + rdi]
lea rax, [r12 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14003ec44
mov rcx, r8
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401110b0
sub rsp, rcx
mov r8, r12
lea rdi, [rsp + 0x50]
mov rdx, rbx
mov rcx, rdi
call fcn.140109100
mov word [r12 + rdi], r15w
cmp word [rdi], 0x2a
jne 0x14003ec77
lea r9, [rdi + 2]
jmp 0x14003ecec
lea rdx, str.find
mov rcx, rdi
call fcn.140108424
test eax, eax
je 0x14003ece9
lea rdx, str.explore
mov rcx, rdi
call fcn.140108424
test eax, eax
je 0x14003ece9
lea rdx, str.open
mov rcx, rdi
call fcn.140108424
test eax, eax
je 0x14003ece9
lea rdx, str.edit
mov rcx, rdi
call fcn.140108424
test eax, eax
je 0x14003ece9
lea rdx, [0x1401352c8]
mov rcx, rdi
call fcn.140108424
test eax, eax
je 0x14003ece9
lea rdx, str.properties
mov rcx, rdi
call fcn.140108424
test eax, eax
jne 0x14003ed00
mov r9, rdi
mov qword [rbp + 0x10], r9
test r9, r9
je 0x14003ed03
lea rdi, [r12 + rbx + 2]
mov qword [rbp], rdi
jmp 0x14003ed06
mov r9, r15
mov rdi, rbx
mov r8d, r15d
mov byte [rbp + 0x1678], r15b
mov dword [rbp + 0x20], r15d
cmp byte [rbp + 0x16b0], r8b
je 0x14003ed89
mov rax, qword [r14 + 0xbd8]
test rax, rax
je 0x14003ed2f
cmp qword [rax + 0x10], r8
jne 0x14003ed53
mov rax, qword [r14 + 0xbf0]
test rax, rax
je 0x14003ed41
cmp qword [rax + 0x10], r8
jne 0x14003ed53
mov rax, qword [r14 + 0xc08]
test rax, rax
je 0x14003ed89
cmp qword [rax + 0x10], r8
je 0x14003ed89
mov r15b, 1
test r9, r9
je 0x14003ed89
cmp byte [rbp + 0x1690], r8b
je 0x14003ed82
lea rcx, str._t_._7z___8_z_4__5_.__z_3.2z_b_4e_t
call fcn.1400dd2e0
lea r8, [0x1401295d4]
mov rcx, r14
mov rdx, rax
call fcn.1400a5580
xor eax, eax
jmp 0x14003f498
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r12, rcx
cmp rcx, 0x4001
jb 0x14003edb5
cmp byte [rbp + 0x1690], al
je 0x14003ed82
lea rcx, str._t._34z.55z654t
jmp 0x14003ed6b
mov rsi, qword [rbp + 0x1698]
mov r14d, 1
test r9, r9
jne 0x14003f05c
lea r8d, [r14 + 0x5f]
lea rcx, [rbp + 0xc8]
xor edx, edx
call fcn.14010ec60
mov dword [rbp + 0xc0], 0x68
mov dword [rbp + 0xfc], r14d
test rsi, rsi
je 0x14003ee0a
cmp word [rsi], 0
je 0x14003ee0a
mov rcx, rsi
call fcn.1400249e0
mov word [rbp + 0x100], ax
jmp 0x14003ee12
mov word [rbp + 0x100], r14w
xor eax, eax
xor edx, edx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rax
test r13, r13
je 0x14003ee83
cmp word [r13], ax
je 0x14003ee83
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
dec rcx
add rcx, r12
lea rcx, [rcx + rcx + 0x14]
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x14003ee59
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1401110b0
sub rsp, rax
lea rdx, str._s__s
lea rdi, [rsp + 0x50]
mov r9, r13
mov r8, rbx
mov rcx, rdi
call fcn.140108924
xor edx, edx
jmp 0x14003eed1
lea rax, [r12 + r12 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14003ee9b
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401110b0
sub rsp, rcx
lea rdi, [rsp + 0x50]
mov rcx, rdi
sub rcx, rbx
nop word [rax + rax]
movzx eax, word [rbx]
add rbx, 2
mov word [rcx + rbx - 2], ax
test ax, ax
jne 0x14003eec0
mov r13, qword [rbp + 0x1688]
test r15b, r15b
je 0x14003ef54
movzx r9d, byte [rbp + 0x1690]
mov rcx, qword [rbp + 0x1670]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 8]
mov r8, r13
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x1678]
mov rdx, rdi
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x16b8]
mov qword [rsp + 0x28], rax
movzx eax, word [rbp + 0x100]
mov word [rsp + 0x20], ax
call fcn.140072b00
test eax, eax
je 0x14003ed82
cmp byte [rbp + 0x1678], 0
jne 0x14003efd8
mov r8d, dword [rbp + 0x20]
jmp 0x14003f063
cmp qword [rbp + 0x16c0], 0
je 0x14003f01b
test rdi, rdi
je 0x14003ef80
lea r9, [rbp + 0x28]
lea r8, [rbp + 0xc0]
mov rdx, r13
mov rcx, rdi
call fcn.1400b61f0
mov rdx, rax
mov rax, qword [rbp + 0x16d0]
mov qword [rax], rdx
test rdx, rdx
je 0x14003f013
mov rcx, qword [rbp + 0x16c8]
mov rax, qword [rbp + 0x118]
mov qword [rcx], rax
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14003efb3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x28]
mov rdx, qword [rbp + 8]
mov qword [rdx], rax
mov rax, qword [rbp + 0x16b8]
test rax, rax
je 0x14003efdc
mov edx, dword [rbp + 0x38]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rax
call fcn.140001370
mov rdx, qword [rbp + 8]
xor r12d, r12d
cmp byte [rbp + 0x16a8], 0
je 0x14003eff3
mov rcx, qword [0x140169c00]
mov dword [rcx + 0x40], r12d
cmp qword [rbp + 0x16a0], 0
jne 0x14003f00b
mov rcx, qword [rdx]
test rcx, rcx
je 0x14003f00b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
jmp 0x14003f498
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14003f06c
lea rax, [rbp + 0x28]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xc0]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14003f013
jmp 0x14003efa4
mov r13, qword [rbp + 0x1688]
test r15b, r15b
jne 0x14003f339
xor edx, edx
lea rcx, [rbp + 0x54]
lea r8d, [rdx + 0x6c]
call fcn.14010ec60
mov dword [rbp + 0x50], WSAStartup
mov dword [rbp + 0x54], 0x440
mov qword [rbp + 0x78], r13
test rsi, rsi
je 0x14003f0a8
cmp word [rsi], 0
je 0x14003f0a8
mov rcx, rsi
call fcn.1400249e0
mov dword [rbp + 0x80], eax
jmp 0x14003f0af
mov dword [rbp + 0x80], r14d
mov rax, qword [rbp + 0x10]
test rax, rax
je 0x14003f0d3
lea rdx, str.properties
mov rcx, rax
mov qword [rbp + 0x60], rax
call fcn.140108424
test eax, eax
jne 0x14003f0d3
or dword [rbp + 0x54], 0xc
mov rdi, qword [rbp + 0x18]
test rdi, rdi
jne 0x14003f284
lea rax, [r12 + r12 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14003f0f8
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401110b0
mov r12, qword [rbp]
sub rsp, rcx
lea rbx, [rsp + 0x50]
mov rcx, r12
mov rdx, rbx
sub rdx, r12
nop dword [rax]
movzx eax, word [rcx]
add rcx, 2
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x14003f120
cmp word [rbx], 0x22
jne 0x14003f17f
lea rdi, [rbx + 2]
mov edx, SafeArrayAllocDescriptor
mov rcx, rdi
call fcn.140109434
test rax, rax
je 0x14003f17b
xor r12d, r12d
mov qword [rbp], rdi
mov word [rax], r12w
cmp word [rax + 2], r12w
je 0x14003f27e
cmp word [rax + 2], 0x20
lea rdi, [rax + 2]
jne 0x14003f287
add rdi, 2
jmp 0x14003f287
mov rdi, qword [rbp + 0x18]
test r13, r13
je 0x14003f18d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [rbx + 2]
mov edx, SafeArrayAllocDescriptor
call fcn.140109434
xor r12d, r12d
mov rsi, rax
test rax, rax
je 0x14003f24a
nop word [rax + rax]
lea rdi, [rsi - 2]
cmp rdi, rbx
jbe 0x14003f1dd
nop dword [rax]
movzx edx, word [rdi]
lea rcx, [0x140135398]
call fcn.140109434
test rax, rax
jne 0x14003f1dd
sub rdi, 2
cmp rdi, rbx
ja 0x14003f1c0
cmp word [rdi], 0x2e
jne 0x14003f22a
mov rax, rsi
mov word [rsi], r12w
sub rax, rdi
and rax, 0xfffffffffffffffe
cmp rax, 8
jne 0x14003f213
lea rcx, str.t___t8_.t957t97_t2._
call fcn.1400dd2e0
mov rdx, rdi
mov rcx, rax
call fcn.1400e6540
test rax, rax
jne 0x14003f274
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x14003f274
mov eax, SafeArrayAllocDescriptor
mov word [rsi], ax
jmp 0x14003f22f
mov eax, SafeArrayAllocDescriptor
lea rcx, [rsi + 2]
mov edx, eax
call fcn.140109434
mov rsi, rax
test rax, rax
jne 0x14003f1b0
mov rdi, qword [rbp + 0x18]
test r13, r13
je 0x14003f287
mov rax, qword [0x140169c30]
lea rcx, [0x1401295d4]
test rax, rax
je 0x14003f26c
mov rax, qword [rax]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x14003f287
mov qword [rbp], rbx
lea rdi, [rsi + 2]
jmp 0x14003f24a
mov rdi, qword [rbp + 0x18]
jmp 0x14003f287
xor r12d, r12d
mov rax, qword [rbp]
lea rcx, [rbp + 0x50]
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x68], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14003f32e
mov eax, dword [0x1401764b8]
test r14b, al
jne 0x14003f2df
or eax, r14d
lea rcx, str.kernel32.dll
mov dword [0x1401764b8], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetProcessId
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401764b0], rax
jmp 0x14003f2e6
mov rax, qword [0x1401764b0]
mov rcx, qword [rbp + 0xb8]
mov rdx, qword [rbp + 8]
mov qword [rdx], rcx
test rcx, rcx
je 0x14003efdf
mov rdi, qword [rbp + 0x16b8]
test rdi, rdi
je 0x14003efdf
test rax, rax
je 0x14003efdf
call rax
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rdi
mov edx, eax
call fcn.140001370
mov rdx, qword [rbp + 8]
jmp 0x14003efdf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
jmp 0x14003f340
mov rdi, qword [rbp + 0x18]
xor r12d, r12d
cmp byte [rbp + 0x16a8], 0
je 0x14003f354
mov rcx, qword [0x140169c00]
mov dword [rcx + 0x40], r8d
cmp byte [rbp + 0x1690], 0
je 0x14003ed82
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor edx, edx
mov ecx, 0x1200
mov dword [rsp + 0x28], 0x1ff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rbx, qword [rbp + 0x10]
test rbx, rbx
je 0x14003f3b8
lea rcx, str.P_f__8_zf
call fcn.1400dd2e0
lea rcx, [rbp + 0x130]
mov r9, rbx
mov r8, rax
mov edx, pe_nt_image_headers64
call fcn.1400e6100
jmp 0x14003f3c0
mov word [rbp + 0x130], r12w
test rdi, rdi
lea rsi, [0x1401295d4]
lea rcx, [0x140135440]
mov r12, rsi
cmovne r12, rdi
test r15b, r15b
jne 0x14003f3e4
lea rcx, [0x1401354b0]
call fcn.1400dd2e0
mov r14, qword [rbp]
or rcx, 0xffffffffffffffff
lea rdx, [0x14012fb30]
mov r13, rax
xor eax, eax
mov rbx, rsi
mov rdi, r12
repne scasw ax, word [rdi]
mov rdi, r14
not rcx
dec rcx
cmp rcx, 0x190
cmova rbx, rdx
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 0x190
lea rcx, [0x140135520]
cmova rsi, rdx
call fcn.1400dd2e0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r12
mov r8, rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x630]
mov r9, r13
mov edx, 0x800
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r14
call fcn.1400e6100
mov rcx, qword [rbp + 0x1670]
lea r8, [rbp + 0x230]
lea rdx, [rbp + 0x630]
call fcn.1400a5580
xor eax, eax
jmp 0x14003f498
mov eax, 1
mov rbx, qword [rbp + 0x1680]
lea rsp, [rbp + 0x1630]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret