Function at 0x1801a7e10
Capabilities:
Create process on windows

Disassembly:
jmp 0x180329250
push rbp
push rdi
sub rsp, 0xc88
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x21e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1805d8740]
xor rax, rbp
mov qword [rbp + 0xc20], rax
lea rcx, [0x18060f3ff]
call fcn.1801ab3da
nop
xor r8d, r8d
lea rdx, str.Loader.exe
lea rcx, [rbp + 0x5a8]
call fcn.1801aad77
nop
lea rcx, [rbp + 0x5a8]
call fcn.1801a6281
mov byte [rbp + 0x584], al
lea rcx, [rbp + 0x5a8]
call fcn.1801aa679
movzx eax, byte [rbp + 0x584]
test eax, eax
je 0x180329829
xor r8d, r8d
lea rdx, str.Load.sys
lea rcx, [rbp + 0x608]
call fcn.1801a843c
nop
lea rcx, [rbp + 0x608]
call fcn.1801a6281
mov byte [rbp + 0x5e4], al
lea rcx, [rbp + 0x608]
call fcn.1801aa679
movzx eax, byte [rbp + 0x5e4]
test eax, eax
je 0x1803297ca
lea rdx, str.loader.exe
lea rcx, [rbp + 8]
call fcn.1801a62a9
nop
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x48]
call fcn.1801a337e
nop
lea rcx, [rbp + 0x644]
call fcn.1801a6e8e
mov qword [rbp + 0xbf8], rax
lea rax, [rbp + 0x668]
mov qword [rbp + 0x698], rax
mov rdx, qword [rbp + 0x698]
lea rcx, [rbp + 0x48]
call fcn.1801a322a
mov qword [rbp + 0xc00], rax
mov rax, qword [rbp + 0xc00]
mov qword [rbp + 0xc08], rax
lea rax, [rbp + 0x6b8]
mov qword [rbp + 0x6e8], rax
mov rdx, qword [rbp + 0x6e8]
lea rcx, [rbp + 0x48]
call fcn.1801ab718
mov qword [rbp + 0xc10], rax
mov rax, qword [rbp + 0xc10]
mov qword [rbp + 0xc18], rax
mov r9, qword [rbp + 0xbf8]
mov r8, qword [rbp + 0xc08]
mov rdx, qword [rbp + 0xc18]
lea rcx, [rbp + 0x148]
call fcn.1801a4f6c
nop
xor eax, eax
mov word [rbp + 0x704], ax
lea rdx, [rbp + 0x704]
lea rcx, [rbp + 0x148]
call fcn.1801a90e4
nop
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x90]
call fcn.1801a8eaf
nop
mov dword [rbp + 0x90], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x118]
call fcn.1801a8eaf
nop
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, [0x180562420]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x188], rax
cmp qword [rbp + 0x188], 0xffffffffffffffff
jne 0x1803294f6
lea rax, [rbp + 0x728]
mov qword [rbp + 0x768], rax
lea rdx, [rbp + 0x7a8]
lea rcx, [rbp + 0x784]
call fcn.18031ecb0
mov qword [rbp + 0xbf8], rax
xor edx, edx
mov rcx, qword [rbp + 0xbf8]
call fcn.1801a573c
mov rdx, rax
mov rcx, qword [rbp + 0x768]
call fcn.1801a62a9
mov qword [rbp + 0xc00], rax
mov rcx, qword [rbp + 0xc00]
call fcn.1801a68d5
nop
mov byte [rbp + 0x804], 0
lea rcx, [rbp + 0x148]
call fcn.1801a21b3
nop
lea rcx, [rbp + 0x48]
call fcn.1801a3b8f
nop
lea rcx, [rbp + 8]
call fcn.1801a3b8f
movzx eax, byte [rbp + 0x804]
jmp 0x180329888
mov eax, dword [rbp + 0xcc]
bts eax, 8
mov dword [rbp + 0xcc], eax
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0xf0], rax
lea rcx, [rbp + 0x148]
call fcn.1801a6ca4
lea rcx, [rbp + 0x118]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x90]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x18032970b
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
lea rdx, [rbp + 0x1a4]
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x18032965e
cmp dword [rbp + 0x1a4], 0
jne 0x18032960a
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov byte [rbp + 0x824], 1
lea rcx, [rbp + 0x148]
call fcn.1801a21b3
nop
lea rcx, [rbp + 0x48]
call fcn.1801a3b8f
nop
lea rcx, [rbp + 8]
call fcn.1801a3b8f
movzx eax, byte [rbp + 0x824]
jmp 0x180329888
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov byte [rbp + 0x844], 0
lea rcx, [rbp + 0x148]
call fcn.1801a21b3
nop
lea rcx, [rbp + 0x48]
call fcn.1801a3b8f
nop
lea rcx, [rbp + 8]
call fcn.1801a3b8f
movzx eax, byte [rbp + 0x844]
jmp 0x180329888
lea rax, [rbp + 0x868]
mov qword [rbp + 0x8a8], rax
lea rdx, [rbp + 0x8e8]
lea rcx, [rbp + 0x8c4]
call fcn.18031f4e0
mov qword [rbp + 0xbf8], rax
xor edx, edx
mov rcx, qword [rbp + 0xbf8]
call fcn.1801aaec1
mov rdx, rax
mov rcx, qword [rbp + 0x8a8]
call fcn.1801a62a9
mov qword [rbp + 0xc00], rax
mov rcx, qword [rbp + 0xc00]
call fcn.1801a68d5
nop
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov byte [rbp + 0x924], 0
lea rcx, [rbp + 0x148]
call fcn.1801a21b3
nop
lea rcx, [rbp + 0x48]
call fcn.1801a3b8f
nop
lea rcx, [rbp + 8]
call fcn.1801a3b8f
movzx eax, byte [rbp + 0x924]
jmp 0x180329888
lea rax, [rbp + 0x948]
mov qword [rbp + 0x988], rax
lea rdx, [rbp + 0x9c8]
lea rcx, [rbp + 0x9a4]
call fcn.18031f990
mov qword [rbp + 0xbf8], rax
xor edx, edx
mov rcx, qword [rbp + 0xbf8]
call fcn.1801a4fda
mov rdx, rax
mov rcx, qword [rbp + 0x988]
call fcn.1801a62a9
mov qword [rbp + 0xc00], rax
mov rcx, qword [rbp + 0xc00]
call fcn.1801a68d5
nop
mov byte [rbp + 0xa24], 0
lea rcx, [rbp + 0x148]
call fcn.1801a21b3
nop
lea rcx, [rbp + 0x48]
call fcn.1801a3b8f
nop
lea rcx, [rbp + 8]
call fcn.1801a3b8f
movzx eax, byte [rbp + 0xa24]
jmp 0x180329888
lea rax, [rbp + 0xa68]
mov qword [rbp + 0xaa8], rax
lea rdx, [rbp + 0xae8]
lea rcx, [rbp + 0xac4]
call fcn.18031fd60
mov qword [rbp + 0xbf8], rax
xor edx, edx
mov rcx, qword [rbp + 0xbf8]
call fcn.1801aafb6
mov rdx, rax
mov rcx, qword [rbp + 0xaa8]
call fcn.1801a62a9
mov qword [rbp + 0xc00], rax
mov rcx, qword [rbp + 0xc00]
call fcn.1801a68d5
nop
xor al, al
jmp 0x180329888
lea rax, [rbp + 0xb38]
mov qword [rbp + 0xb78], rax
lea rdx, [rbp + 0xbb8]
lea rcx, [rbp + 0xb94]
call fcn.1803205b0
mov qword [rbp + 0xbf8], rax
xor edx, edx
mov rcx, qword [rbp + 0xbf8]
call fcn.1801a653d
mov rdx, rax
mov rcx, qword [rbp + 0xb78]
call fcn.1801a62a9
mov qword [rbp + 0xc00], rax
mov rcx, qword [rbp + 0xc00]
call fcn.1801a68d5
nop
xor al, al
jmp 0x180329888
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x18055ae00]
call fcn.1801a99ef
mov rax, rdi
mov rcx, qword [rbp + 0xc20]
xor rcx, rbp
call fcn.1801a66be
lea rsp, [rbp + 0xc38]
pop rdi
pop rbp
ret