Function at 0x180021730
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x268
mov rax, qword [0x1800842c0]
xor rax, rsp
mov qword [rsp + 0x258], rax
lea rcx, [rsp + 0x53]
call fcn.180002740
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x288]
call fcn.180024700
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0xd8]
mov rcx, qword [rsp + 0x288]
call fcn.1800247c0
mov rcx, qword [rsp + 0x70]
mov r9, rcx
mov rcx, qword [rsp + 0x78]
mov r8, qword [rcx]
mov rdx, qword [rax]
lea rcx, [rsp + 0x198]
call fcn.180025850
nop
lea rax, [rsp + 0x110]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov dword [rsp + 0x110], 0x68
lea rdx, str..exe
lea rcx, [rsp + 0x1b8]
call fcn.1800245b0
nop
lea rcx, [rsp + 0x198]
call fcn.180012a20
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x1b8]
call fcn.180012a20
mov rcx, qword [rsp + 0x80]
cmp rcx, rax
jb 0x18002193e
lea rcx, [rsp + 0x1b8]
call fcn.180012a20
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x198]
call fcn.180012a20
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x1b8]
call fcn.180012a20
mov rcx, qword [rsp + 0x88]
sub rcx, rax
mov rax, rcx
lea r9, [rsp + 0x1b8]
mov rcx, qword [rsp + 0x90]
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0x198]
call fcn.180024520
test eax, eax
jne 0x18002193e
lea rcx, [rsp + 0x198]
call fcn.180006b20
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x110]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x180021939
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov byte [rsp + 0x50], 1
lea rcx, [rsp + 0x1b8]
call fcn.180006cb0
nop
lea rcx, [rsp + 0x198]
call fcn.180006cb0
movzx eax, byte [rsp + 0x50]
jmp 0x180021c27
jmp 0x180021c02
lea rcx, [rsp + 0x218]
call fcn.1800099e0
nop
mov byte [rsp + 0x180], 0x63
mov byte [rsp + 0x181], 0x6d
mov byte [rsp + 0x182], 0x64
mov byte [rsp + 0x183], 0x2e
mov byte [rsp + 0x184], 0x65
mov byte [rsp + 0x185], 0x78
mov byte [rsp + 0x186], 0x65
mov byte [rsp + 0x187], 0x20
mov byte [rsp + 0x188], 0x2f
mov byte [rsp + 0x189], 0x63
mov byte [rsp + 0x18a], 0x20
mov byte [rsp + 0x18b], 0x73
mov byte [rsp + 0x18c], 0x74
mov byte [rsp + 0x18d], 0x61
mov byte [rsp + 0x18e], 0x72
mov byte [rsp + 0x18f], 0x74
mov byte [rsp + 0x190], 0x20
lea rax, [rsp + 0x191]
mov r8, rax
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x100]
call fcn.180004ea0
lea rcx, [rsp + 0xf0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x54]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0xb8]
call fcn.180004f90
nop
lea r8, [rsp + 0xb8]
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0x218]
call fcn.18003d170
nop
lea rcx, [rsp + 0x55]
call fcn.180002740
mov qword [rsp + 0x98], rax
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x1d8]
call fcn.180024760
mov qword [rsp + 0xa0], rax
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x1d8]
call fcn.180024820
mov rcx, qword [rsp + 0x98]
mov r9, rcx
mov rcx, qword [rsp + 0xa0]
mov r8, qword [rcx]
mov rdx, qword [rax]
lea rcx, [rsp + 0x238]
call fcn.180025850
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xb0], rax
lea r8, [rsp + 0x198]
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0x1f8]
call fcn.180025930
nop
lea rcx, [rsp + 0x238]
call fcn.180006cb0
nop
lea rcx, [rsp + 0x1f8]
call fcn.180006b20
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x110]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x180021bca
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov byte [rsp + 0x51], 1
lea rcx, [rsp + 0x1f8]
call fcn.180006cb0
nop
lea rcx, [rsp + 0x1d8]
call fcn.180004630
nop
lea rcx, [rsp + 0xb8]
call fcn.180003930
nop
lea rcx, [rsp + 0x218]
call fcn.180010c60
nop
lea rcx, [rsp + 0x1b8]
call fcn.180006cb0
nop
lea rcx, [rsp + 0x198]
call fcn.180006cb0
movzx eax, byte [rsp + 0x51]
jmp 0x180021c27
lea rcx, [rsp + 0x1f8]
call fcn.180006cb0
nop
lea rcx, [rsp + 0x1d8]
call fcn.180004630
nop
lea rcx, [rsp + 0xb8]
call fcn.180003930
nop
lea rcx, [rsp + 0x218]
call fcn.180010c60
nop
mov byte [rsp + 0x52], 0
lea rcx, [rsp + 0x1b8]
call fcn.180006cb0
nop
lea rcx, [rsp + 0x198]
call fcn.180006cb0
movzx eax, byte [rsp + 0x52]
mov rcx, qword [rsp + 0x258]
xor rcx, rsp
call fcn.1800412e0
add rsp, 0x268
pop rdi
pop rsi
ret