Function at 0x1401806b0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rbx, rdx
mov r14, rcx
mov rsi, qword [rcx]
mov rdi, qword [rsi + 0x2e8]
cmp dword [rdx + 0x48], 0xf
je 0x14018072b
mov dword [rdx + 0x48], 0xf
movzx eax, byte [rdx + 0x40]
shr al, 4
test al, 1
jne 0x14018070a
mov rcx, rdx
call fcn.1400d9610
mov dl, 1
mov rcx, rax
call fcn.1400e3810
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], 4
lea rcx, [rsi + 0x388]
lea r8, [rsp + 0x48]
mov rdx, rsi
call fcn.140119b60
lea r15, [0x140348ca0]
mov qword [rsp + 0x58], r15
xor ebp, ebp
mov qword [rsp + 0x60], rbp
lea r8, [rsp + 0x58]
mov rdx, rbx
mov rcx, r14
call fcn.140180960
mov esi, eax
lea edx, [rax + 2]
cmp edx, 1
jbe 0x14018088c
test eax, eax
jne 0x1401807d0
cmp qword [rdi + 8], rbp
je 0x140180793
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov rcx, rax
mov dword [rsp + 0x30], 0x13
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 2]
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x14018079a
mov byte [rdi + 0xaf], 0
mov r8, qword [r14]
xor edx, edx
mov rcx, rbx
call fcn.1400d9f70
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov r8, qword [rsp + 0x58]
lea rdx, [0x14034d978]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x140180929
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], rbp
lea r8, [rsp + 0x48]
mov rdx, rbx
mov rcx, r14
call fcn.1401811e0
mov esi, eax
test eax, eax
jne 0x14018087b
cmp qword [rdi + 8], 0
je 0x140180828
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov rcx, rax
mov dword [rsp + 0x30], 0x13
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
lea rdx, [r9 - 2]
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x14018082f
mov byte [rdi + 0xaf], 0
mov r8, qword [r14]
xor edx, edx
mov rcx, rbx
call fcn.1400d9f70
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov r8, qword [rsp + 0x48]
lea rdx, [0x14034d978]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
cmp dword [rsp + 0x50], 0
jle 0x140180929
mov rcx, qword [rsp + 0x48]
call fcn.1402b9c20
jmp 0x140180929
cmp dword [rsp + 0x50], 0
jle 0x14018088c
mov rcx, qword [rsp + 0x48]
call fcn.1402b9c20
mov rdi, qword [r14]
cmp dword [rbx + 0x48], 6
je 0x1401808da
mov dword [rbx + 0x48], 6
movzx eax, byte [rbx + 0x40]
shr al, 4
test al, 1
jne 0x1401808b9
mov rcx, rbx
call fcn.1400d9610
mov dl, 1
mov rcx, rax
call fcn.1400e3810
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], 4
lea rcx, [rdi + 0x388]
lea r8, [rsp + 0x48]
mov rdx, rdi
call fcn.140119b60
cmp esi, 0xffffffff
jne 0x1401808f7
mov rax, qword [r14]
mov rcx, qword [rax + 0x2e8]
mov rax, qword [rcx]
call qword [rax]
lea rdx, str.API_key_invalid__result__1_
jmp 0x140180912
cmp esi, 0xfffffffe
jne 0x140180929
mov rax, qword [r14]
mov rcx, qword [rax + 0x2e8]
mov rax, qword [rcx]
call qword [rax]
lea rdx, str.Quota_exceeded__result__2__r_n_r_nVirusTotal_allows_20_requests_of_any_nature_in_a_given_5_minutes_time_frame._r_n_r_nTry_again_in_a_few_minutes.
mov r9d, 0x30
lea r8, str.VirusTotal
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
cmp dword [rsp + 0x60], 0
jle 0x14018093a
mov rcx, qword [rsp + 0x58]
call fcn.1402b9c20
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret