Function at 0x18000d5d0
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x130
mov qword [rsp + 0xa0], 0xfffffffffffffffe
xor r12d, r12d
mov rax, qword [0x18006f2f8]
test rax, rax
jne 0x18000d624
mov ecx, 0x150
call fcn.1800379d0
mov qword [rsp + 0x160], rax
test rax, rax
je 0x18000d61a
mov rcx, rax
call fcn.180014110
jmp 0x18000d61d
mov rax, r12
mov qword [0x18006f2f8], rax
movzx ebp, byte [rax + 0xc8]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x160], rax
lea rdx, [0x1800575dc]
lea rcx, [rsp + 0x78]
call fcn.180005ba0
mov rbx, rax
lea rdx, str.isFirstInstall
lea rcx, [rsp + 0xb0]
call fcn.180005ba0
nop
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call fcn.18000b4f0
mov edi, eax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x178], rax
lea rax, [rsp + 0x168]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x60], rax
lea rcx, [0x18006af50]
mov rdx, qword [0x18006af50]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x160], rax
lea rdx, [0x1800574b8]
test rdx, 0xffffffffffff0000
jne 0x18000d6f1
movzx ebx, dx
xor edx, edx
mov ecx, ebx
call fcn.180005550
test rax, rax
je 0x18000d6ff
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x160]
call fcn.180005780
jmp 0x18000d6ff
lea rcx, [rsp + 0x160]
call fcn.180013fc0
nop
lea rcx, [0x18006af50]
mov rax, qword [0x18006af50]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x168], rax
lea rdx, [0x180057244]
test rdx, 0xffffffffffff0000
jne 0x18000d752
movzx ebx, dx
xor edx, edx
mov ecx, ebx
call fcn.180005550
test rax, rax
je 0x18000d760
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x168]
call fcn.180005780
jmp 0x18000d760
lea rcx, [rsp + 0x168]
call fcn.180013fc0
nop
lea rcx, [0x18006af50]
mov rax, qword [0x18006af50]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x170], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
test rdx, 0xffffffffffff0000
jne 0x18000d7b3
movzx ebx, dx
xor edx, edx
mov ecx, ebx
call fcn.180005550
test rax, rax
je 0x18000d7c1
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x170]
call fcn.180005780
jmp 0x18000d7c1
lea rcx, [rsp + 0x170]
call fcn.180013fc0
nop
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x168]
lea r8, [rsp + 0x170]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x58]
call fcn.18000c210
nop
lea rcx, [0x18006af50]
mov rax, qword [0x18006af50]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x178], rbx
or esi, 0xffffffff
test bpl, bpl
je 0x18000da9f
test edi, edi
je 0x18000da9f
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
lea rdx, [0x1800575dc]
lea rcx, [rsp + 0x80]
call fcn.180005ba0
mov rdi, rax
lea rdx, str.isFirstInstall
lea rcx, [rsp + 0xb8]
call fcn.180005ba0
nop
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.18000b8f0
mov rax, qword [0x18006f2f8]
test rax, rax
jne 0x18000d89f
mov ecx, 0x150
call fcn.1800379d0
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x18000d895
mov rcx, rax
call fcn.180014110
jmp 0x18000d898
mov rax, r12
mov qword [0x18006f2f8], rax
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.180016310
mov rdi, rax
lea r8, [0x180057508]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.1800019a0
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1800018f0
nop
lea r8, [0x180057504]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1800019a0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x18000d94c
cmp dword [rbx + 0x10], 0
jl 0x18000d93a
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x18000d93a
call fcn.180005340
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x18000d92c
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x178], rax
jmp 0x18000d94c
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x178]
call fcn.180005a60
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000d96c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000d98c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000d9ac
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000d9cb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0xc0]
call fcn.180036ea0
mov dword [rsp + 0xc0], 0x68
xor eax, eax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [rsp + 0x178]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x18000da8a
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000da69
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x58]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x18000da86
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x18000dad9
mov edx, dword [rsp + 0x98]
lea rcx, [0x18000d580]
call qword [sym.imp.USER32.dll_EnumWindows]
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000daba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x58]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x18000dad7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
add rsp, 0x130
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret