Function at 0x180074760
Capabilities:
Create process on windows

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0x20c0]
mov eax, 0x21c0
call fcn.180389480
sub rsp, rax
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x21e8], rbx
mov qword [rsp + 0x21f0], rsi
mov qword [rsp + 0x21f8], rdi
mov rax, qword [0x1804cd010]
xor rax, rsp
mov qword [rbp + 0x20b0], rax
mov rbx, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
cmp qword [rcx + 8], r15
je 0x180075381
mov rcx, qword [rcx]
test rcx, rcx
je 0x180075381
mov rax, qword [rcx]
call qword [rax + 0x78]
mov rdi, rax
test rax, rax
je 0x180075381
xor edx, edx
mov r8d, 0x201b
lea rcx, [rbp - 0x3c]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x1fe3], r15d
mov dword [rbp - 0x40], 0x2027
mov rax, qword [rbx + 8]
mov qword [rbp + 0xfcc], rax
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x30]
mov byte [rbp + 0xfdd], al
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x20]
mov byte [rbp + 0xfdc], al
mov byte [rbp + 0xfde], 1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2080], xmm0
movdqa xmm1, xmmword [0x1803e8770]
movdqu xmmword [rbp + 0x2080], xmm1
mov word [rbp + 0x2070], r15w
mov rax, qword [rdi]
lea rdx, [rbp + 0x2070]
mov rcx, rdi
call qword [rax + 0x50]
lea rax, [rbp + 0x2070]
cmp qword [rbp + 0x2088], 8
cmovae rax, qword [rbp + 0x2070]
movzx eax, byte [rax]
mov byte [rbp + 0x1fe2], al
mov word [rbp + 0x1fdf], 0x101
mov byte [rbp + 0x1fe1], r15b
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2040], xmm0
movdqa xmm1, xmmword [0x1803e8770]
movdqu xmmword [rbp + 0x2040], xmm1
mov word [rbp + 0x2030], r15w
mov rcx, qword [rbp + 0x2040]
mov rdx, qword [rbp + 0x2048]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x180074907
lea rdi, [rcx + 6]
mov qword [rbp + 0x2040], rdi
lea rbx, [rbp + 0x2030]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x2030]
lea rcx, [rbx + rcx*2]
lea r8d, [r15 + 0xc]
lea rdx, [0x1803c1e50]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x18007492a
mov qword [rsp + 0x20], 6
lea r9, [0x1803c1e50]
xor r8d, r8d
lea edx, [r8 + 6]
lea rcx, [rbp + 0x2030]
call fcn.180009e30
lea rdx, [rbp + 0x2010]
lea rcx, [rbp - 0x40]
call fcn.180074510
nop
mov r9, rax
cmp qword [rax + 0x18], 8
jb 0x180074948
mov r9, qword [rax]
mov rdx, qword [rax + 0x10]
mov rcx, qword [rbp + 0x2040]
mov r8, qword [rbp + 0x2048]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x18007499a
lea rdi, [rcx + rdx]
mov qword [rbp + 0x2040], rdi
lea rbx, [rbp + 0x2030]
cmp r8, 8
cmovae rbx, qword [rbp + 0x2030]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x1800749af
mov qword [rsp + 0x20], rdx
xor r8d, r8d
lea rcx, [rbp + 0x2030]
call fcn.180009e30
nop
mov rdx, qword [rbp + 0x2028]
cmp rdx, 8
jb 0x1800749f8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2010]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800749f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800749f3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
movdqa xmm0, xmmword [0x1803e8770]
movdqu xmmword [rbp + 0x2020], xmm0
mov word [rbp + 0x2010], r15w
lea rcx, [rbp + 0x2030]
cmp qword [rbp + 0x2048], 8
cmovae rcx, qword [rbp + 0x2030]
lea rdx, [rbp + 0xfdf]
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180074a40
xor bl, bl
cmp byte [0x1804de064], bl
jne 0x1800752ba
mov byte [0x1804de064], 1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20a0], xmm0
movdqa xmm1, xmmword [0x1803e8770]
movdqu xmmword [rbp + 0x20a0], xmm1
mov word [rbp + 0x2090], r15w
mov r8d, 0x12
lea rdx, str.2345PicCapture.exe
lea rcx, [rbp + 0x2090]
call fcn.180004ea0
nop
lea rdx, [rbp + 0x2090]
lea rcx, [rbp + 0x2050]
call fcn.1801fe2a0
nop
mov rdx, qword [rbp + 0x20a8]
cmp rdx, 8
jb 0x180074aff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2090]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180074afa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180074afa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
movdqa xmm0, xmmword [0x1803e8770]
movdqu xmmword [rbp + 0x20a0], xmm0
mov word [rbp + 0x2090], r15w
lea rcx, [rbp + 0x2050]
call fcn.180156070
test al, al
je 0x180075257
lea rcx, [rbp + 0x2050]
cmp qword [rbp + 0x2068], 8
cmovae rcx, qword [rbp + 0x2050]
mov r8b, 1
call fcn.1802005e0
test al, al
je 0x180075257
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2000], xmm0
movdqa xmm1, xmmword [0x1803e8770]
movdqu xmmword [rbp + 0x2000], xmm1
mov word [rbp + 0x1ff0], r15w
mov rdx, qword [rbp + 0xfcc]
lea rcx, [rbp + 0x2010]
call fcn.180154930
mov rbx, rax
lea rax, [rbp + 0x1ff0]
cmp rax, rbx
je 0x180074bc8
lea rcx, [rbp + 0x1ff0]
call fcn.180004e20
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x1ff0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x2000], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rbp + 0x2028]
cmp rdx, 8
jb 0x180074c11
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2010]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180074c0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180074c0c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
movdqa xmm0, xmmword [0x1803e8770]
movdqu xmmword [rbp + 0x2020], xmm0
mov word [rbp + 0x2010], r15w
lea rdx, [rbp + 0x2050]
lea rcx, [rbp + 0x2010]
call fcn.18015b370
mov rbx, rax
lea rax, [rbp + 0x2050]
cmp rax, rbx
je 0x180074c7c
lea rcx, [rbp + 0x2050]
call fcn.180004e20
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x2050], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x2060], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rbp + 0x2028]
cmp rdx, 8
jb 0x180074cc5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2010]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180074cc0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180074cc0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
movdqa xmm0, xmmword [0x1803e8770]
movdqu xmmword [rbp + 0x2020], xmm0
mov word [rbp + 0x2010], r15w
mov rcx, qword [rbp + 0x2000]
mov rdx, qword [rbp + 0x2008]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180074d32
lea rdi, [rcx + 1]
mov qword [rbp + 0x2000], rdi
lea rbx, [rbp + 0x1ff0]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1803c4b80]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x180074d56
mov qword [rsp + 0x20], 1
lea r9, [0x1803c4b80]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0x1ff0]
call fcn.180009e30
nop
mov rdx, r15
cmp byte [rbp + 0xfdd], r15b
setne dl
lea rcx, [rbp + 0x2010]
call fcn.180154930
mov esi, 4
mov dword [rsp + 0x30], esi
and esi, 0xfffffffb
mov dword [rsp + 0x30], esi
or esi, 2
mov dword [rsp + 0x30], esi
lea r9, [rbp + 0x2010]
cmp qword [rbp + 0x2028], 8
cmovae r9, qword [rbp + 0x2010]
mov rdi, qword [rbp + 0x2020]
mov r14, qword [rbp + 0x2000]
mov rcx, qword [rbp + 0x2008]
mov rax, rcx
sub rax, r14
cmp rdi, rax
ja 0x180074df6
lea rax, [r14 + rdi]
mov qword [rbp + 0x2000], rax
lea rbx, [rbp + 0x1ff0]
cmp rcx, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea r8, [rdi + rdi]
lea rcx, [rbx + r14*2]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r15w
jmp 0x180074e0d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x1ff0]
call fcn.180009e30
and esi, 0xfffffffd
mov dword [rsp + 0x30], esi
mov rdx, qword [rbp + 0x2028]
cmp rdx, 8
jb 0x180074e5d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2010]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180074e58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180074e58
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
movdqa xmm0, xmmword [0x1803e8770]
movdqu xmmword [rbp + 0x2020], xmm0
mov word [rbp + 0x2010], r15w
mov rcx, qword [rbp + 0x2000]
mov rdx, qword [rbp + 0x2008]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180074eca
lea rdi, [rcx + 1]
mov qword [rbp + 0x2000], rdi
lea rbx, [rbp + 0x1ff0]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1803c4b80]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x180074eee
mov qword [rsp + 0x20], 1
lea r9, [0x1803c4b80]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0x1ff0]
call fcn.180009e30
nop
mov rdx, r15
cmp byte [rbp + 0xfdc], r15b
setne dl
lea rcx, [rbp + 0x2010]
call fcn.180154930
or esi, 0x10
mov dword [rsp + 0x30], esi
and esi, 0xffffffef
mov dword [rsp + 0x30], esi
or esi, 8
mov dword [rsp + 0x30], esi
lea r9, [rbp + 0x2010]
cmp qword [rbp + 0x2028], 8
cmovae r9, qword [rbp + 0x2010]
mov rdi, qword [rbp + 0x2020]
mov r14, qword [rbp + 0x2000]
mov rcx, qword [rbp + 0x2008]
mov rax, rcx
sub rax, r14
cmp rdi, rax
ja 0x180074f8c
lea rax, [r14 + rdi]
mov qword [rbp + 0x2000], rax
lea rbx, [rbp + 0x1ff0]
cmp rcx, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea r8, [rdi + rdi]
lea rcx, [rbx + r14*2]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r15w
jmp 0x180074fa3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x1ff0]
call fcn.180009e30
and esi, 0xfffffff7
mov dword [rsp + 0x30], esi
mov rdx, qword [rbp + 0x2028]
cmp rdx, 8
jb 0x180074ff3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2010]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180074fee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180074fee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
movdqa xmm0, xmmword [0x1803e8770]
movdqu xmmword [rbp + 0x2020], xmm0
mov word [rbp + 0x2010], r15w
mov rcx, qword [rbp + 0x2000]
mov rdx, qword [rbp + 0x2008]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180075060
lea rdi, [rcx + 1]
mov qword [rbp + 0x2000], rdi
lea rbx, [rbp + 0x1ff0]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1803c4b80]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x180075083
mov qword [rsp + 0x20], 1
lea r9, [0x1803c4b80]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0x1ff0]
call fcn.180009e30
lea rax, [rbp + 0xfdf]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x180075091
mov rcx, qword [rbp + 0x2000]
mov r8, qword [rbp + 0x2008]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1800750ed
lea rdi, [rdx + rcx]
mov qword [rbp + 0x2000], rdi
lea rbx, [rbp + 0x1ff0]
cmp r8, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
lea rdx, [rbp + 0xfdf]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x180075108
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0xfdf]
xor r8d, r8d
lea rcx, [rbp + 0x1ff0]
call fcn.180009e30
xor eax, eax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov dword [rbp - 0x5c], eax
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x540
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], r15
lea rax, [rbp + 0x2050]
cmp qword [rbp + 0x2068], 8
cmovae rax, qword [rbp + 0x2050]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x1ff0]
cmp qword [rbp + 0x2008], 8
cmovae rax, qword [rbp + 0x1ff0]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 1
mov qword [rbp - 0x58], r15
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne bl
mov byte [0x1804de064], 0
mov rdx, qword [rbp + 0x2008]
cmp rdx, 8
jb 0x1800751f0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1ff0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800751eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800751eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
movdqa xmm0, xmmword [0x1803e8770]
movdqu xmmword [rbp + 0x2000], xmm0
mov word [rbp + 0x1ff0], r15w
mov rdx, qword [rbp + 0x2068]
cmp rdx, 8
jb 0x1800752a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2050]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180075250
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180075250
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
jmp 0x1800752a2
mov rdx, qword [rbp + 0x2068]
cmp rdx, 8
jb 0x1800752a0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2050]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007529b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18007529b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
xor bl, bl
movdqa xmm0, xmmword [0x1803e8770]
mov word [rbp + 0x2050], r15w
movdqu xmmword [rbp + 0x2060], xmm0
mov rdx, qword [rbp + 0x2048]
cmp rdx, 8
jb 0x180075303
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2030]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800752fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800752fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
movdqa xmm0, xmmword [0x1803e8770]
movdqu xmmword [rbp + 0x2040], xmm0
mov word [rbp + 0x2030], r15w
mov rdx, qword [rbp + 0x2088]
cmp rdx, 8
jb 0x180075364
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2070]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007535f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18007535f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
movdqa xmm0, xmmword [0x1803e8770]
movdqu xmmword [rbp + 0x2080], xmm0
mov word [rbp + 0x2070], r15w
movzx eax, bl
jmp 0x180075383
xor al, al
mov rcx, qword [rbp + 0x20b0]
xor rcx, rsp
call fcn.180388400
lea r11, [rsp + 0x21c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret