Function at 0x18003f570
Capabilities:
Create process on windows

Disassembly:
jmp 0x18003f570
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18015a118]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x30], 0xf
mov qword [rbp - 0x38], 8
movabs rax, 0x6c31326279683259
mov qword [rbp - 0x48], rax
mov byte [rbp - 0x40], 0
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.180002a2c
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x18003f5d9
mov rax, qword [rax]
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x18003f5ea
mov rcx, qword [rbx]
cmp r8, rdx
jne 0x18003f600
mov rdx, rax
call fcn.18000321f
test eax, eax
jne 0x18003f600
mov dil, 1
jmp 0x18003f603
xor dil, dil
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x18003f63e
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003f639
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003fa12
call fcn.180005989
xor esi, esi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], sil
mov rax, qword [rbp - 0x30]
cmp rax, 0x10
jb 0x18003f68c
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003f687
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003fa18
call fcn.180005989
test dil, dil
je 0x18003f69d
lea rcx, str.taskkill__f__IM_chrome.exe
jmp 0x18003f996
mov qword [rbp - 0x30], 0xf
mov qword [rbp - 0x38], 8
movabs rax, 0x3456475a75465765
mov qword [rbp - 0x48], rax
mov byte [rbp - 0x40], 0
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.180002a2c
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x18003f6da
mov rax, qword [rax]
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x18003f6eb
mov rcx, qword [rbx]
cmp r8, rdx
jne 0x18003f701
mov rdx, rax
call fcn.18000321f
test eax, eax
jne 0x18003f701
mov dil, 1
jmp 0x18003f704
xor dil, dil
mov rax, qword [rbp - 0x10]
cmp rax, 0x10
jb 0x18003f740
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003f73b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003fa1e
call fcn.180005989
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
mov rax, qword [rbp - 0x30]
cmp rax, 0x10
jb 0x18003f78c
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003f787
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003fa24
call fcn.180005989
test dil, dil
je 0x18003f79d
lea rcx, str.taskkill__f__IM_browser.exe
jmp 0x18003f996
mov qword [rbp - 0x30], 0xf
mov qword [rbp - 0x38], 8
movabs rax, 0x3d456d636c423362
mov qword [rbp - 0x48], rax
mov byte [rbp - 0x40], 0
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.180002a2c
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x18003f7da
mov rax, qword [rax]
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x18003f7eb
mov rcx, qword [rbx]
cmp r8, rdx
jne 0x18003f801
mov rdx, rax
call fcn.18000321f
test eax, eax
jne 0x18003f801
mov dil, 1
jmp 0x18003f804
xor dil, dil
mov rax, qword [rbp - 0x10]
cmp rax, 0x10
jb 0x18003f840
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003f83b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003fa2a
call fcn.180005989
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
mov rax, qword [rbp - 0x30]
cmp rax, 0x10
jb 0x18003f88c
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003f887
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003fa30
call fcn.180005989
test dil, dil
je 0x18003f89d
lea rcx, str.taskkill__f__IM_opera.exe
jmp 0x18003f996
mov qword [rbp - 0x30], 0xf
mov qword [rbp - 0x38], 8
movabs rax, 0x3d3d515a6e52575a
mov qword [rbp - 0x48], rax
mov byte [rbp - 0x40], 0
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.180002a2c
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x18003f8da
mov rax, qword [rax]
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x18003f8eb
mov rcx, qword [rbx]
cmp r8, rdx
jne 0x18003f901
mov rdx, rax
call fcn.18000321f
test eax, eax
jne 0x18003f901
mov dil, 1
jmp 0x18003f904
xor dil, dil
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x18003f93f
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003f93a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003fa36
call fcn.180005989
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x18003f98a
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003f985
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003fa06
call fcn.180005989
test dil, dil
je 0x18003f99f
lea rcx, str.taskkill__f__IM_msedge.exe
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x18003f9d5
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x18003f9d0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18003fa0c
mov rcx, r8
call fcn.180005989
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180003bd4
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.180002db0
nop
call fcn.180002db0
nop
call fcn.180002db0
nop
call fcn.180002db0
nop
call fcn.180002db0
nop
call fcn.180002db0
nop
call fcn.180002db0
nop
call fcn.180002db0
nop
call fcn.180002db0
int3