Function at 0x1400783f0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x880
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x1400bdbf0]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov r13, rcx
mov rdi, rdx
call fcn.140077e90
test eax, eax
jne 0x140078446
mov r12d, 0x426
jmp 0x140078a82
xor r15d, r15d
mov word [rsp + 0x70], r15w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x72]
call sub.MSVCR90.dll_memset
mov dword [rsp + 0x60], CDHtmlElementEventSink::AddRef
mov eax, r15d
test rdi, rdi
setne al
test eax, eax
jne 0x140078481
mov ecx, 0x80004005
call fcn.140001340
int3
mov dword [rsp + 0x20], 0xc0
mov r9d, CDHtmlElementEventSink::AddRef
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.140006400
test eax, eax
jne 0x1400784b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x140078a82
mov word [rsp + 0x30], r15w
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.140077ff0
mov r12d, eax
test eax, eax
jne 0x140078a82
lea rcx, str.__a_t_
mov rax, qword [str.__a_t_]
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x38], rsi
lea rcx, str.__a_t_
mov rax, qword [str.__a_t_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rdx, qword [r13 + 8]
lea rcx, [rdx - 0x18]
lea rdi, [rsi - 0x18]
or rbp, 0xffffffffffffffff
cmp rcx, rdi
je 0x140078567
cmp dword [rdi + 0x10], r12d
jl 0x140078554
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140078554
call fcn.1400020e0
mov rsi, rax
mov ecx, ebp
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140078549
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
add rsi, 0x18
mov qword [rsp + 0x38], rsi
jmp 0x140078567
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140001f70
mov rsi, qword [rsp + 0x38]
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x14007858f
mov edx, 0x104
lea rcx, [rsp + 0x38]
call fcn.140002070
mov rsi, qword [rsp + 0x38]
lea rdx, str.AnalysisRpt.exe
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
movsxd rdx, dword [rsi - 0xc]
mov rcx, rsi
call qword [sym.imp.MSVCR90.dll_wcsnlen]
test eax, eax
js 0x140078a77
cmp eax, dword [rsi - 0xc]
jg 0x140078a77
mov dword [rsi - 0x10], eax
cdqe
mov word [rsi + rax*2], r15w
mov rdi, qword [r13 + 0x10]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x1400785f4
cmp rax, qword [rdi - 0x18]
jne 0x1400785f4
lea rbx, [rdi - 0x18]
lock add dword [rdi - 8], 1
mov rsi, qword [rsp + 0x38]
jmp 0x140078632
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x140078610
call fcn.140002240
int3
mov eax, dword [rdi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rdi - 0x10]
inc eax
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rbx + 0x18]
call qword [sym.imp.MSVCR90.dll_memcpy_s]
add rbx, 0x18
mov qword [rsp + 0x48], rbx
lea rcx, str.__a_t_
mov rax, qword [str.__a_t_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov r9, qword [r13 + 0x10]
mov r8, qword [r13 + 8]
lea rdx, str._sHtmlDoc_s
lea rcx, [rsp + 0x50]
call fcn.140002360
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140078798
xor eax, eax
mov rcx, rbp
lea rdi, str.en_us
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x140078701
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140078798
cmp dword [rdx + 0x10], eax
jge 0x1400786cf
cmp dword [rbx - 0xc], eax
jge 0x1400786c2
mov ecx, 0x80070057
call fcn.140001340
int3
mov dword [rbx - 0x10], r15d
mov word [rbx], r15w
jmp 0x140078798
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400786e5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov rsi, qword [rsp + 0x38]
jmp 0x140078798
mov r14d, dword [rbx - 0x10]
lea r13, str.en_us
sub r13, rbx
sar r13, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140078734
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.140002070
mov rbx, qword [rsp + 0x48]
cmp r13, r14
ja 0x140078759
movsxd rax, edi
lea r14, [rax + rax]
lea r8, [rbx + r13*2]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r14
mov rcx, rbx
call qword [sym.imp.MSVCR90.dll_memmove_s]
jmp 0x14007877a
movsxd rax, edi
lea r14, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r14
lea r8, str.en_us
mov rcx, rbx
call qword [sym.imp.MSVCR90.dll_memcpy_s]
test edi, edi
js 0x14007878d
cmp edi, dword [rbx - 0xc]
jg 0x14007878d
mov dword [rbx - 0x10], edi
mov word [r14 + rbx], r15w
jmp 0x140078798
mov ecx, 0x80070057
call fcn.140001340
int3
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400787ce
movzx r8d, word [rsp + 0x30]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea rdx, str.http:__localhost:_u__s_url_report.htm_url_s
lea rcx, [rsp + 0x40]
call fcn.140002360
jmp 0x140078937
lea rcx, str.__a_t_
mov rax, qword [str.__a_t_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
movzx r8d, word [rsp + 0x30]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea rdx, str.http:__localhost:_u__s_url_report.htm_url_s
lea rcx, [rsp + 0x58]
call fcn.140002360
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xa]
call fcn.140050000
cmp eax, 1
jne 0x1400788b4
xor eax, eax
mov rcx, rbp
lea rdi, str.iexplore
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.iexplore
lea rcx, [rsp + 0x38]
call fcn.140001f70
mov rdx, qword [rsp + 0x58]
lea rdi, [rdx - 0x18]
mov rbx, qword [rsp + 0x40]
add rbx, 0xffffffffffffffe8
cmp rdi, rbx
je 0x140078912
cmp dword [rbx + 0x10], 0
jl 0x1400788a4
mov rax, qword [rbx]
cmp qword [rdi], rax
jne 0x1400788a4
mov rcx, rdi
call fcn.1400020e0
mov rsi, rax
mov ecx, ebp
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140078899
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x40], rax
jmp 0x140078912
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140001f70
jmp 0x140078912
mov rdx, qword [rsp + 0x58]
lea rdi, [rdx - 0x18]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x140078912
cmp dword [rsi + 0x10], 0
jl 0x140078903
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x140078903
mov rcx, rdi
call fcn.1400020e0
mov rbx, rax
mov ecx, ebp
lock xadd dword [rsi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400788f8
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x140078912
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140001f70
nop
mov eax, ebp
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x140078932
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
mov rsi, qword [rsp + 0x38]
jmp 0x140078937
mov rsi, qword [rsp + 0x38]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9, qword [rsp + 0x40]
mov r8, rsi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x1400789f8
mov r12d, eax
mov ecx, 8
test eax, eax
cmove r12d, ecx
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140078992
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400789b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400789d2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
dec ebp
test ebp, ebp
jg 0x140078a82
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140078a82
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140078a18
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140078a38
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140078a58
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
dec ebp
test ebp, ebp
jg 0x140078a82
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140078a82
mov ecx, 0x80070057
call fcn.140001340
nop
mov eax, r12d
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.14004d770
mov rbx, qword [rsp + 0x8d0]
add rsp, 0x880
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret