Function at 0x180001520
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x18000b040]
xor rax, rsp
mov qword [rbp + 0x340], rax
xor r15d, r15d
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r15
mov r14, rcx
mov qword [rsp + 0x70], r15
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rcx + rbx], r15b
jne 0x180001570
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x180001815
mov qword [rsp + 0x478], rsi
mov qword [rsp + 0x70], 0xf
cmp rbx, 0xf
ja 0x1800015c2
mov r8, rbx
mov qword [rsp + 0x68], rbx
mov rdx, r14
lea rcx, [rsp + 0x58]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x58], r15b
jmp 0x180001659
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x1800015fb
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.180005844
test rax, rax
je 0x180001737
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x180001638
mov ecx, 0x16
mov rdi, rax
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x180001626
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000181b
jmp 0x1800015dc
test rcx, rcx
je 0x180001635
call fcn.180005844
mov rsi, rax
jmp 0x180001638
mov rsi, r15
mov r8, rbx
mov qword [rsp + 0x58], rsi
mov rdx, r14
mov qword [rsp + 0x68], rbx
mov rcx, rsi
mov qword [rsp + 0x70], rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], r15b
xor edx, edx
mov edi, r15d
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800016fa
lea rdx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1800016fa
nop dword [rax]
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], r15
lea r8, [rbp + 0x1c]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp qword [rsp + 0x70], 0xf
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x230]
cmova rdx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1800016f7
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180001690
jmp 0x1800016fa
mov edi, dword [rbp - 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x180001743
mov rcx, qword [rsp + 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000173e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000173e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180005810
test edi, edi
je 0x18000174e
mov eax, edi
jmp 0x1800017e5
xorps xmm0, xmm0
mov dword [rbp - 0x80], 0x68
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, str.C:Program_Files__x86_AssaultCube_assaultcube.bat
lea rax, [rbp - 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
lea rax, str.C:Program_Files__x86_AssaultCube_
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1800017e3
mov rcx, qword [rsp + 0x58]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x68]
jmp 0x1800017e5
xor eax, eax
mov rsi, qword [rsp + 0x478]
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.1800057f0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.180001220
int3
call fcn.180001180
int3