Function at 0x180002a70
Capabilities:
Create process on windows
Create thread

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x508]
sub rsp, 0x600
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x180033008]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x2e0]
call fcn.18000bdf0
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0x68]
call fcn.180003570
nop
xor esi, esi
cmp qword [0x1800351d8], rsi
jne 0x180002b0d
call fcn.180002070
test al, al
je 0x180002aea
call fcn.180002420
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x1800029a0]
xor edx, edx
xor ecx, ecx
call fcn.18000cc04
mov qword [0x1800351d8], rax
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], rsi
mov word [rbp - 0x78], si
lea r9, str.lghydsmgr.exe
lea r8, [rbp + 0x2e0]
lea rdx, str._s_s
lea rcx, [rbp + 0x28]
call fcn.180008430
mov rbx, rax
lea rax, [rbp - 0x78]
movabs r14, 0x7fffffffffffffff
cmp rax, rbx
je 0x180002bd8
mov rcx, qword [rbp - 0x60]
cmp rcx, 8
jb 0x180002bbb
lea rax, [rcx + 1]
mov rcx, qword [rbp - 0x78]
cmp rax, r14
jbe 0x180002b72
call fcn.180010dc4
int3
add rax, rax
cmp rax, 0x1000
jb 0x180002bb6
test byte [rbp - 0x78], 0x1f
je 0x180002b89
call fcn.180010dc4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180002b98
call fcn.180010dc4
int3
sub rcx, rax
cmp rcx, 8
jae 0x180002ba7
call fcn.180010dc4
int3
cmp rcx, 0x27
jbe 0x180002bb3
call fcn.180010dc4
int3
mov rcx, rax
call fcn.180008748
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], rsi
mov word [rbp - 0x78], si
mov rdx, rbx
lea rcx, [rbp - 0x78]
call fcn.180003e90
nop
mov rax, qword [rbp + 0x40]
cmp rax, 8
jb 0x180002c3c
inc rax
mov rcx, qword [rbp + 0x28]
cmp rax, r14
jbe 0x180002bf4
call fcn.180010dc4
int3
add rax, rax
cmp rax, 0x1000
jb 0x180002c37
test cl, 0x1f
je 0x180002c0a
call fcn.180010dc4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180002c19
call fcn.180010dc4
int3
sub rcx, rax
cmp rcx, 8
jae 0x180002c28
call fcn.180010dc4
int3
cmp rcx, 0x27
jbe 0x180002c34
call fcn.180010dc4
int3
mov rcx, rax
call fcn.180008748
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rcx, qword [rbp - 0x78]
lea rdx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x18000305f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
xor ecx, ecx
call fcn.180010b50
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov eax, 0xcccccccd
mul ebx
shr edx, 3
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub ebx, ecx
movabs rax, 0x346dc5d63886594b
imul rdi
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x2710
sub ebx, eax
add ebx, edi
mov r8d, ebx
lea rdx, [0x18002da04]
lea rcx, [rbp + 0x28]
call fcn.180008520
nop
mov r9, rdi
mov r8d, ebx
lea rdx, str._d__d
lea rcx, [rbp + 0x48]
call fcn.180008520
nop
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x48], rsi
mov byte [rbp - 0x58], 0
mov r8d, 0x10
lea rdx, str.tCPVyzefszsGmWO3
lea rcx, [rbp - 0x58]
call fcn.180003f20
nop
lea rax, [rsp + 0x58]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x70], 0xf
mov qword [rsp + 0x68], rsi
mov byte [rsp + 0x58], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rsp + 0x58]
call fcn.180004050
nop
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], rsi
mov byte [rsp + 0x30], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x30]
call fcn.180004050
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 8]
call fcn.180003170
nop
lea r9, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae r9, qword [rbp + 8]
lea r8, [rbp + 0x28]
cmp qword [rbp + 0x40], 0x10
cmovae r8, qword [rbp + 0x28]
lea rdx, str.task_s_s:_s
lea rcx, [rbp - 0x18]
call fcn.180008520
nop
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x30], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x30]
call fcn.180003d50
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x38]
call fcn.180007fe0
lea r9, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae r9, qword [rbp - 0x18]
lea r8, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae r8, qword [rbp - 0x38]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword [rbp - 0x20]
cmp rax, 0x10
jb 0x180002e60
inc rax
mov rcx, qword [rbp - 0x38]
cmp rax, 0x1000
jb 0x180002e5b
test cl, 0x1f
je 0x180002e2e
call fcn.180010dc4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180002e3d
call fcn.180010dc4
int3
sub rcx, rax
cmp rcx, 8
jae 0x180002e4c
call fcn.180010dc4
int3
cmp rcx, 0x27
jbe 0x180002e58
call fcn.180010dc4
int3
mov rcx, rax
call fcn.180008748
mov qword [rbp - 0x20], 0xf
mov qword [rbp - 0x28], rsi
mov byte [rbp - 0x38], 0
mov rax, qword [rbp]
cmp rax, 0x10
jb 0x180002ec6
inc rax
mov rcx, qword [rbp - 0x18]
cmp rax, 0x1000
jb 0x180002ec1
test cl, 0x1f
je 0x180002e94
call fcn.180010dc4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180002ea3
call fcn.180010dc4
int3
sub rcx, rax
cmp rcx, 8
jae 0x180002eb2
call fcn.180010dc4
int3
cmp rcx, 0x27
jbe 0x180002ebe
call fcn.180010dc4
int3
mov rcx, rax
call fcn.180008748
mov qword [rbp], 0xf
mov qword [rbp - 8], rsi
mov byte [rbp - 0x18], 0
mov rax, qword [rbp + 0x20]
cmp rax, 0x10
jb 0x180002f2c
inc rax
mov rcx, qword [rbp + 8]
cmp rax, 0x1000
jb 0x180002f27
test cl, 0x1f
je 0x180002efa
call fcn.180010dc4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180002f09
call fcn.180010dc4
int3
sub rcx, rax
cmp rcx, 8
jae 0x180002f18
call fcn.180010dc4
int3
cmp rcx, 0x27
jbe 0x180002f24
call fcn.180010dc4
int3
mov rcx, rax
call fcn.180008748
mov qword [rbp + 0x20], 0xf
mov qword [rbp + 0x18], rsi
mov byte [rbp + 8], 0
mov rax, qword [rbp - 0x40]
cmp rax, 0x10
jb 0x180002f92
inc rax
mov rcx, qword [rbp - 0x58]
cmp rax, 0x1000
jb 0x180002f8d
test cl, 0x1f
je 0x180002f60
call fcn.180010dc4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180002f6f
call fcn.180010dc4
int3
sub rcx, rax
cmp rcx, 8
jae 0x180002f7e
call fcn.180010dc4
int3
cmp rcx, 0x27
jbe 0x180002f8a
call fcn.180010dc4
int3
mov rcx, rax
call fcn.180008748
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x48], rsi
mov byte [rbp - 0x58], 0
mov rax, qword [rbp + 0x60]
cmp rax, 0x10
jb 0x180002ff8
inc rax
mov rcx, qword [rbp + 0x48]
cmp rax, 0x1000
jb 0x180002ff3
test cl, 0x1f
je 0x180002fc6
call fcn.180010dc4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180002fd5
call fcn.180010dc4
int3
sub rcx, rax
cmp rcx, 8
jae 0x180002fe4
call fcn.180010dc4
int3
cmp rcx, 0x27
jbe 0x180002ff0
call fcn.180010dc4
int3
mov rcx, rax
call fcn.180008748
mov qword [rbp + 0x60], 0xf
mov qword [rbp + 0x58], rsi
mov byte [rbp + 0x48], 0
mov rax, qword [rbp + 0x40]
cmp rax, 0x10
jb 0x18000305f
inc rax
mov rcx, qword [rbp + 0x28]
cmp rax, 0x1000
jb 0x180003059
test cl, 0x1f
je 0x18000302c
call fcn.180010dc4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18000303b
call fcn.180010dc4
int3
sub rcx, rax
cmp rcx, 8
jae 0x18000304a
call fcn.180010dc4
int3
cmp rcx, 0x27
jbe 0x180003056
call fcn.180010dc4
int3
mov rcx, rax
call fcn.180008748
nop
mov rax, qword [rbp - 0x60]
cmp rax, 8
jb 0x1800030c4
inc rax
mov rcx, qword [rbp - 0x78]
cmp rax, r14
jbe 0x18000307b
call fcn.180010dc4
int3
add rax, rax
cmp rax, 0x1000
jb 0x1800030bf
test byte [rbp - 0x78], 0x1f
je 0x180003092
call fcn.180010dc4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800030a1
call fcn.180010dc4
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800030b0
call fcn.180010dc4
int3
cmp rcx, 0x27
jbe 0x1800030bc
call fcn.180010dc4
int3
mov rcx, rax
call fcn.180008748
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], rsi
mov word [rbp - 0x78], si
mov rax, qword [rbp + 0x80]
cmp rax, 8
jb 0x18000313b
inc rax
mov rcx, qword [rbp + 0x68]
cmp rax, r14
jbe 0x1800030f3
call fcn.180010dc4
int3
add rax, rax
cmp rax, 0x1000
jb 0x180003136
test cl, 0x1f
je 0x180003109
call fcn.180010dc4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180003118
call fcn.180010dc4
int3
sub rcx, rax
cmp rcx, 8
jae 0x180003127
call fcn.180010dc4
int3
cmp rcx, 0x27
jbe 0x180003133
call fcn.180010dc4
int3
mov rcx, rax
call fcn.180008748
mov rcx, qword [rbp + 0x4f0]
xor rcx, rsp
call fcn.1800086e0
lea r11, [rsp + 0x600]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret