Function at 0x18005b150
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xc8]
sub rsp, 0x190
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov r15, r8
mov r13, rdx
mov r12, rcx
xor edi, edi
mov dword [rsp + 0x50], edi
mov rax, qword [rdx + 0x28]
cmp dword [rax - 0x10], edi
je 0x18005b1ad
mov rcx, rdx
call fcn.18004d7f0
shr eax, 4
not al
test al, 1
je 0x18005b666
call fcn.180039cb0
mov rcx, rax
test rax, rax
je 0x18005b681
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 0xd8], rbx
mov rcx, qword [r13 + 0x28]
or rsi, 0xffffffffffffffff
cmp dword [rcx - 0x10], 0
jne 0x18005b256
mov rcx, r15
call fcn.18000b370
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
lea r14, [rbx - 0x18]
cmp rcx, r14
je 0x18005b3e8
cmp dword [r14 + 0x10], 0
jl 0x18005b23a
mov rax, qword [r14]
cmp qword [rcx], rax
jne 0x18005b23a
call fcn.18003a990
mov rbx, rax
mov ecx, esi
lock xadd dword [r14 + 0x10], ecx
sub ecx, 1
jg 0x18005b22a
mov rcx, qword [r14]
mov r8, qword [rcx]
mov rdx, r14
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
add rbx, 0x18
mov qword [rbp + 0xd8], rbx
jmp 0x18005b3e4
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0xd8]
call fcn.18003a350
mov rbx, qword [rbp + 0xd8]
jmp 0x18005b3e8
add rcx, 0xffffffffffffffe8
call fcn.18003a990
mov rcx, rax
lea rdi, [rax + 0x18]
mov qword [rbp + 0x38], rdi
add rbx, 0xffffffffffffffe8
cmp rax, rbx
je 0x18005b2c3
cmp dword [rbx + 0x10], 0
jl 0x18005b2af
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x18005b2af
call fcn.18003a990
mov r14, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x18005b2a2
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r14 + 0x18]
mov qword [rbp + 0xd8], rax
jmp 0x18005b2c3
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
lea rcx, [rbp + 0xd8]
call fcn.18003a350
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18005b2dc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [0x1800ff5b4]
mov rbx, qword [rbp + 0xd8]
mov rcx, rbx
call fcn.1800c3040
test rax, rax
je 0x18005b343
sub rax, rbx
sar rax, 1
test eax, eax
js 0x18005b343
lea rbx, [0x180118a5c]
mov r8, rbx
xor edx, edx
lea rcx, [rbp + 0xd8]
call fcn.18005d0e0
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x18005b320
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0xd8]
call fcn.18003fd10
mov rbx, qword [rbp + 0xd8]
mov ecx, dword [r15 + 0x20]
test ecx, ecx
je 0x18005b3e4
sub ecx, 1
je 0x18005b37e
sub ecx, 1
je 0x18005b364
cmp ecx, 1
jne 0x18005b69c
jmp 0x18005b37e
mov rcx, r15
call fcn.18000ae80
test rax, rax
je 0x18005b3e4
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov eax, eax
jmp 0x18005b385
mov rax, qword [r15]
movsxd rax, dword [rax - 0x10]
test rax, rax
je 0x18005b3e4
lea rdx, [0x18011a2d4]
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x18005b394
mov r8d, eax
lea rcx, [rbp + 0xd8]
call fcn.18003fd10
mov rcx, r15
call fcn.180042300
test rax, rax
jne 0x18005b3be
xor ecx, ecx
jmp 0x18005b3cb
mov rcx, rsi
inc rcx
cmp word [rax + rcx*2], 0
jne 0x18005b3c1
mov r8d, ecx
mov rdx, rax
lea rcx, [rbp + 0xd8]
call fcn.18003fd10
mov rbx, qword [rbp + 0xd8]
mov edi, dword [rsp + 0x50]
cmp byte [rbp + 0x100], 0
je 0x18005b417
lea rcx, [rsp + 0x60]
call fcn.18005c460
nop
mov edi, 1
mov dword [rsp + 0x50], edi
mov rcx, rax
call fcn.18005d220
test al, al
jne 0x18005b417
movzx r14d, dil
jmp 0x18005b41a
xor r14b, r14b
test dil, 1
je 0x18005b431
and edi, 0xfffffffe
mov dword [rsp + 0x50], edi
lea rcx, [rsp + 0x60]
call fcn.18003e6e0
test r14b, r14b
je 0x18005b465
mov eax, dword [rbp + 0xf0]
mov dword [rsp + 0x20], eax
mov r9, qword [rbp + 0xe8]
mov r8, r15
mov rdx, r13
mov rcx, r12
call fcn.18005b710
or edi, 2
mov dword [rsp + 0x50], edi
lea rdx, [rbx - 0x18]
jmp 0x18005b635
mov dword [rbp - 0x70], 0x68
xor ecx, ecx
mov qword [rbp - 0x68], rcx
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x40], rcx
mov dword [rbp - 0x38], ecx
mov dword [rbp - 0x34], 0x81
movzx eax, word [rbp + 0xf0]
mov word [rbp - 0x30], ax
mov word [rbp - 0x2e], cx
mov qword [rbp - 0x28], rcx
movdqa xmm0, xmmword [0x1800ff620]
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rsi
movdqa xmm1, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rcx
mov rdx, qword [rbp + 0xe8]
lea rcx, [rbp]
call fcn.18000c990
nop
mov r15, qword [rbp + 0x28]
cmp dword [r15 - 0x10], 0
jne 0x18005b536
lea rcx, [rbp + 0x40]
call fcn.18004f8a0
nop
lea rdx, [rax + 0x28]
lea rcx, [rbp + 0x28]
call fcn.18000c910
nop
lea rax, [rbp + 0x68]
mov qword [rsp + 0x68], rax
mov rdx, qword [rbp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18005b51d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rbx, qword [rbp + 0xd8]
mov r15, qword [rbp + 0x28]
mov edi, dword [rsp + 0x50]
mov r14, qword [r13 + 0x28]
cmp dword [r14 - 0x10], 0
mov r13d, 0
cmove r14, r13
cmp dword [rbx - 8], 1
jle 0x18005b565
mov edx, dword [rbx - 0x10]
lea rcx, [rbp + 0xd8]
call fcn.18003a180
mov rbx, qword [rbp + 0xd8]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r13
mov eax, dword [rbp + 0xf8]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x18005b6b7
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x58], r13
test rbx, rbx
je 0x18005b5d4
lea rcx, [rsp + 0x58]
call fcn.18003e6e0
mov qword [rsp + 0x58], rbx
mov qword [r12], r13
lea rdx, [rsp + 0x58]
mov rcx, r12
call fcn.18005af50
nop
or edi, 2
mov dword [rsp + 0x50], edi
lea rcx, [rsp + 0x58]
call fcn.18003e6e0
nop
lea rax, [rbp + 0x28]
mov qword [rsp + 0x68], rax
mov rdx, qword [rbp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18005b61f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop
mov rdx, qword [rbp + 0xd8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x18005b648
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r12
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor r9d, r9d
mov r8d, 0x1a1
lea rdx, str.NVProcess.cpp
mov ecx, 0x80070057
call fcn.18003abe0
int3
xor r9d, r9d
mov r8d, 0xcd
lea rdx, str.C:dvsp4_build_sw_toolswin32msvc141u5VC_atlmfcinclude_atlsimpstr.h
mov ecx, 0x80004005
call fcn.18003abe0
nop
xor r9d, r9d
mov r8d, 0x12b
lea rdx, str.c:dvsp4_build_sw_relgpu_drvinstaller_coreinstaller_core_vs2017incAutoString.h
mov ecx, 0xe0e00000
call fcn.18003abe0
nop
call fcn.1800391e0
mov ecx, eax
lea r9, str.WinAPI
mov r8d, 0x205
lea rdx, str.NVProcess.cpp
call fcn.1800391c0
lea rax, str.WinAPI_FALSE___NO_ERROR
mov qword [rsp + 0x20], rax
mov r9d, 0x205
lea r8, str.NVProcess.cpp
mov edx, 0x80004005
lea rcx, [rbp + 0x70]
call fcn.18003a640
lea rdx, [0x18015e3c8]
lea rcx, [rbp + 0x70]
call fcn.1800b2060
int3