Function at 0x180021be0
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r12
lea rbp, [rsp - 0x540]
sub rsp, 0x640
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rbp + 0x530], rax
cmp dword [0x1801340b0], 0
mov rsi, rcx
je 0x180021c5c
lea r9, str.CMonitorThread::CheckAgent_1
lea r8, str.WatchDog
lea rcx, [0x180133ff8]
mov edx, 0xf
call fcn.18001ab50
cmp dword [0x1801340b0], 0
je 0x180021c5c
lea r9, str.CMonitorThread::CheckAgent_2
lea r8, str.WatchDog
lea rcx, [0x180133ff8]
mov edx, 0xf
call fcn.18001ab50
lea rcx, [rbp - 0x1f]
xor edx, edx
mov r8d, 0x103
mov byte [rbp - 0x20], 0
call fcn.180043ef0
lea rcx, [rbp + 0xf1]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0xf0], 0
call fcn.180043ef0
lea rcx, [rbp + 0x421]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x420], 0
call fcn.180043ef0
call fcn.180036d30
test eax, eax
jne 0x180021cc1
lea rcx, [rbp - 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x180021cd8
call fcn.180001570
lea rcx, [rbp - 0x20]
mov r8d, 0x103
mov rdx, rax
call fcn.1800441b0
call fcn.180007640
lea r8, [rbp - 0x20]
lea rdx, [0x1800d1c4c]
lea rcx, [rbp + 0xf0]
mov r9, rax
call fcn.180043b88
lea r9, [0x1800d98d0]
lea r8, [rbp + 0xf0]
lea rdx, str._s__s_RunAgent32
lea rcx, [rbp + 0x420]
call fcn.180043b88
lea rcx, [rbp + 0x311]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x310], 0
call fcn.180043ef0
call fcn.180001570
lea rcx, [rbp + 0x310]
mov rdx, rax
mov r8d, 0x103
call fcn.1800441b0
lea rcx, [rbp + 0x201]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x200], 0
call fcn.180043ef0
lea r9, [0x1800d98d0]
lea r8, [rbp + 0x310]
lea rdx, [0x1800d1c4c]
lea rcx, [rbp + 0x200]
call fcn.180043b88
xor r12d, r12d
cmp dword [0x1801340b0], r12d
mov dword [rsp + 0x50], r12d
je 0x180021db9
lea r9, str.CMonitorThread::CheckAgent_3
lea r8, str.WatchDog
lea edx, [r12 + 0xf]
lea rcx, [0x180133ff8]
call fcn.18001ab50
lea r8, [rsp + 0x50]
lea rdx, str.RunAgent32
lea rcx, [rbp + 0x200]
call fcn.18001c000
cmp dword [0x1801340b0], r12d
mov ebx, eax
je 0x180021dfb
lea r9, str.CMonitorThread::CheckAgent_4
lea r8, str.WatchDog
lea rcx, [0x180133ff8]
mov edx, 0xf
call fcn.18001ab50
mov qword [rsp + 0x668], rdi
test ebx, ebx
je 0x180021fa4
lea rcx, [rbp + 0x200]
call fcn.18001c3b0
cmp dword [0x1801340b0], r12d
mov ebx, eax
je 0x180021e45
lea r9, str.CMonitorThread::CheckAgent_5___lu_
lea r8, str.WatchDog
lea rcx, [0x180133ff8]
mov edx, 0xf
mov dword [rsp + 0x20], eax
call fcn.18001ab50
test ebx, ebx
je 0x180021fa4
mov ebx, r12d
inc ebx
cmp dword [0x1801340b0], r12d
je 0x180021e7a
lea r9, str.CMonitorThread::CheckAgent_6
lea r8, str.WatchDog
lea rcx, [0x180133ff8]
mov edx, 0xf
call fcn.18001ab50
xor edx, edx
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x70], r12d
lea r8d, [rdx + 0x60]
call fcn.180043ef0
xor eax, eax
lea rdx, [rbp + 0x420]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x20]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
xor ecx, ecx
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp dword [0x1801340b0], r12d
mov edi, eax
je 0x180021f0e
lea r9, str.CMonitorThread::CheckAgent_7
lea r8, str.WatchDog
lea rcx, [0x180133ff8]
mov edx, 0xf
call fcn.18001ab50
test edi, edi
jne 0x180021f5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x180021f51
lea rcx, [rbp + 0xf0]
xor edx, edx
call fcn.18000d800
cmp dword [0x1801340b0], r12d
je 0x180021f51
lea r9, str.CMonitorThread::CheckAgent_9
lea r8, str.WatchDog
lea edx, [rdi + 0xf]
lea rcx, [0x180133ff8]
call fcn.18001ab50
cmp ebx, 2
jl 0x180021e50
jmp 0x180021fa4
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsi + 0x8c], 1
cmp dword [0x1801340b0], r12d
je 0x180021fcc
lea r9, str.CMonitorThread::CheckAgent_8
lea r8, str.WatchDog
lea rcx, [0x180133ff8]
mov edx, 0xf
call fcn.18001ab50
cmp dword [0x1801340b0], r12d
je 0x180021fcc
lea r9, str.CMonitorThread::CheckAgent_10
lea r8, str.WatchDog
lea rcx, [0x180133ff8]
mov edx, 0xf
call fcn.18001ab50
mov rdi, qword [rsp + 0x668]
mov rcx, qword [rbp + 0x530]
xor rcx, rsp
call fcn.180043ec0
mov rbx, qword [rsp + 0x670]
add rsp, 0x640
pop r12
pop rsi
pop rbp
ret