Function at 0x180016db0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x18007b130]
xor rax, rsp
mov qword [rbp + 0x250], rax
mov edi, edx
mov rsi, rcx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
xor r13d, r13d
mov qword [rbp - 0x80], r13
lea r15d, [rdx + 0x659]
cmp edx, r15d
jae 0x180017182
mov r12, qword [rsp + 0x68]
mov r14d, dword [rsp + 0x68]
nop word [rax + rax]
cmp edi, 0x30b
ja 0x180016feb
je 0x180016f5e
cmp edi, 0x194
ja 0x180016eb3
je 0x180016ea1
mov eax, edi
sub eax, 0x9a
je 0x180016e6b
sub eax, 0x53
je 0x18001711f
cmp eax, 0x2a
jne 0x180017112
mov edx, 0xffffffff
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x180017112
mov r12, 0xffffffffffffffff
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x4e
lea r9, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180040420
test al, al
jne 0x180017112
mov byte [rsp + 0x68], al
jmp 0x180017182
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rax
jmp 0x180017112
mov eax, edi
sub eax, 0x211
je 0x180016ed1
cmp eax, 0x7d
jne 0x180017112
mov dword [rbp - 0x40], 0x68
jmp 0x180017112
lea rcx, [rsi + 0x18]
lea rdx, [rsp + 0x70]
call fcn.180003320
movzx ebx, al
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test bl, bl
jne 0x18001717d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rax
lea rax, [rsp + 0x60]
mov qword [rbp - 0x60], rax
mov ecx, 0x40
mov rax, 0xffffffffffffffff
nop word [rax + rax]
dec rcx
shr rax, 1
cmp rax, 0x7fff
ja 0x180016f30
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x58], rcx
lea r8, [rbp - 0x60]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.180001b30
jmp 0x180017112
mov edx, 0xffffffff
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x30]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x140]
lea rax, [rbp + 0x30]
mov edx, 2
nop
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x180016f90
mov eax, dword [rax]
mov dword [rcx], eax
jmp 0x180017112
cmp edi, 0x4ff
ja 0x1800170fd
je 0x1800170eb
mov eax, edi
sub eax, 0x388
je 0x18001705d
sub eax, 0x7d
je 0x18001702c
cmp eax, 0x7d
jne 0x180017112
mov rax, qword [rsi + 0x30]
test rax, rax
je 0x180017112
mov rcx, qword [rsi + 0x38]
call rax
jmp 0x180017112
test r14d, r14d
je 0x180017112
mov rcx, qword [rbp - 0x78]
cmp rcx, 0xffffffffffffffff
je 0x180017112
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180017112
lea rbx, [rsi + 0x18]
lea rax, [rsp + 0x70]
cmp rbx, rax
je 0x180017099
mov rcx, rbx
call fcn.18001e720
mov rax, qword [rsp + 0x70]
mov qword [rbx], rax
mov rax, qword [rsp + 0x78]
mov qword [rbx + 8], rax
mov rax, qword [rbp - 0x80]
mov qword [rbx + 0x10], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
lea rax, [rbp - 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rbp + 0x140]
xor edx, edx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov r14d, eax
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x180017112
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x180017112
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180017112
mov eax, edi
sub eax, 0x57c
je 0x18001710d
cmp eax, 0x7d
je 0x180017182
jmp 0x180017112
mov byte [rsp + 0x68], 1
add edi, 0x7d
cmp edi, r15d
jae 0x180017182
jmp 0x180016e20
mov ecx, dword [rsi]
lea eax, [rcx - 0xa]
cmp eax, 0xa
jae 0x180017132
lea rbx, [0x18005b2d0]
jmp 0x180017187
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
sub ecx, 1
je 0x180017174
sub ecx, 1
je 0x18001716b
cmp ecx, 1
je 0x180017162
lea rbx, [0x18005b2d0]
jmp 0x180017187
lea rbx, [0x18005b2d8]
jmp 0x180017187
lea rbx, [0x18005b2d4]
jmp 0x180017187
lea rbx, [0x180059f80]
jmp 0x180017187
mov byte [rsp + 0x68], 1
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x18001724d
mov rsi, qword [rsp + 0x78]
cmp rdi, rsi
je 0x1800171f3
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x1800171d6
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1800171d1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001723e
mov rcx, r8
call fcn.1800434d8
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
add rdi, 0x28
cmp rdi, rsi
jne 0x1800171a0
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rbp - 0x80]
sub rcx, rdi
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rdi
cmp rdx, 0x1000
jb 0x180017245
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180017245
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1800434d8
mov rax, rbx
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.1800439f0
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret