Function at 0x1800699d0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x2f0
mov rax, qword [0x18018a280]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
xor esi, esi
mov r14d, esi
mov dword [rsp + 0x50], esi
xorps xmm0, xmm0
mov dword [rsp + 0x190], 0x4ff4a1e0
mov dword [rsp + 0x194], 0xe387f610
mov dword [rsp + 0x198], 0x1ee3a5eb
mov dword [rsp + 0x19c], 0xaf666b8e
mov dword [rsp + 0x1a0], 0x41904f75
mov dword [rsp + 0x1a4], 0xae8bcc70
mov dword [rsp + 0x1a8], 0x568f84ce
mov dword [rsp + 0x1ac], 0xe9b92680
mov dword [rsp + 0x1b0], 0xed5809bc
mov dword [rsp + 0x1b4], 0xd265d73d
mov dword [rsp + 0x1b8], 0x239c5d65
mov dword [rsp + 0x1bc], 0x447ef946
mov dword [rsp + 0x1c0], 0x84752ea0
mov dword [rsp + 0x1c4], 0x7a713ee7
mov dword [rsp + 0x1c8], 0x17f56ccc
mov dword [rsp + 0x1cc], 0xfa61c88d
mov dword [rsp + 0x1d0], 0xcf56e5d6
mov dword [rsp + 0x1d4], 0x534981e5
mov dword [rsp + 0x1d8], 0x1695c027
mov dword [rsp + 0x1dc], 0x713bc49e
movdqu xmmword [rsp + 0x218], xmm0
mov qword [rsp + 0x228], rsi
mov edx, 0x50
lea rcx, [rsp + 0x218]
call fcn.18003e850
mov rbx, qword [rsp + 0x218]
mov r8d, 0x50
lea rdx, [rsp + 0x190]
mov rcx, rbx
call fcn.1800c48b0
lea rax, [rbx + 0x50]
mov qword [rsp + 0x220], rax
xorps xmm0, xmm0
mov dword [rsp + 0x60], 0xd676bdab
mov dword [rsp + 0x64], 0xb0161cf4
mov dword [rsp + 0x68], 0xa3b40e0c
mov dword [rsp + 0x6c], 0x2773853d
mov dword [rsp + 0x70], 0x2a857440
mov dword [rsp + 0x74], 0x412460fe
mov dword [rsp + 0x78], 0x9d04ade7
mov dword [rsp + 0x7c], 0x456276fd
mov dword [rsp + 0x80], 0x9ac37582
mov dword [rsp + 0x84], 0x2abb15f9
mov dword [rsp + 0x88], 0x35318c6e
mov dword [rsp + 0x8c], 0xcd6c3a95
mov dword [rsp + 0x90], 0x7ed86e62
mov dword [rsp + 0x94], 0x4fdf96db
mov dword [rsp + 0x98], 0x698bccd6
mov dword [rsp + 0x9c], 0xf6e59daf
mov dword [rsp + 0xa0], 0xa4b6a4be
mov dword [rsp + 0xa4], 0x78828282
mov dword [rsp + 0xa8], 0xb94d0bd9
mov dword [rsp + 0xac], 0x426c9ceb
movdqu xmmword [rsp + 0x200], xmm0
mov qword [rsp + 0x210], rsi
mov edx, 0x50
lea rcx, [rsp + 0x200]
call fcn.18003e850
mov rbx, qword [rsp + 0x200]
mov r8d, 0x50
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1800c48b0
lea rax, [rbx + 0x50]
mov qword [rsp + 0x208], rax
lea rdx, [rsp + 0x218]
lea rcx, [rsp + 0x170]
call fcn.180028b40
nop
mov rdx, rax
lea rcx, [rsp + 0x2a0]
call fcn.18005a470
nop
mov rcx, qword [rsp + 0x170]
test rcx, rcx
je 0x180069cc6
mov rdx, qword [rsp + 0x180]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180069cad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006a3ff
call fcn.18008ed30
mov qword [rsp + 0x170], rsi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x178], xmm0
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0xd0]
call fcn.180028b40
nop
mov rdx, rax
lea rcx, [rsp + 0x2c0]
call fcn.18005a470
nop
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x180069d30
mov rdx, qword [rsp + 0xe0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180069d2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006a405
call fcn.18008ed30
nop
lea rdi, [rsp + 0x2a0]
lea r15, [rsp + 0x2e0]
mov qword [rsp + 0xb8], r15
lea r12, str..exe
movabs rbx, 0xc000000000000010
movabs r13, 0xc000000000000000
mov qword [rsp + 0xb0], rdi
cmp rdi, r15
je 0x18006a061
lea rcx, [rsp + 0x130]
call fcn.1800054d0
mov rdx, rax
mov qword [rsp + 0x120], r12
mov qword [rsp + 0x128], 9
lea rcx, [0x1801917c0]
cmp qword [0x1801917d8], 7
cmova rcx, qword [0x1801917c0]
mov qword [rsp + 0xf0], rcx
mov rax, qword [0x1801917d0]
mov qword [rsp + 0xf8], rax
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rsp + 0x1a0], xmm0
mov qword [rsp + 0x190], r13
mov rcx, rdx
cmp qword [rdx + 0x18], 7
jbe 0x180069deb
mov rcx, qword [rdx]
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x100], rcx
mov qword [rsp + 0x108], rax
movups xmm0, xmmword [rsp + 0x100]
movups xmmword [rsp + 0x1b0], xmm0
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x110], 2
lea rax, [rsp + 0x190]
mov qword [rsp + 0x118], rax
movaps xmm0, xmmword [rsp + 0x110]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x120]
movdqa xmmword [rsp + 0x170], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x1e0]
call fcn.18000d1f0
or r14d, 1
mov dword [rsp + 0x50], r14d
mov rdx, qword [rsp + 0x148]
cmp rdx, 7
jbe 0x180069ec3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180069ebe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006a40b
call fcn.18008ed30
mov qword [rsp + 0x140], rsi
mov qword [rsp + 0x148], 7
mov word [rsp + 0x130], si
lea r8, [rsp + 0x1e0]
mov rdx, rdi
lea rcx, [rsp + 0x190]
call fcn.18002a3c0
cmp byte [rsp + 0x1b0], 0
je 0x18006a0cb
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x234], xmm0
movups xmmword [rsp + 0x244], xmm0
movups xmmword [rsp + 0x254], xmm0
movups xmmword [rsp + 0x264], xmm0
movups xmmword [rsp + 0x274], xmm0
movups xmmword [rsp + 0x284], xmm0
mov dword [rsp + 0x294], eax
movups xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], rax
mov dword [rsp + 0x230], Ordinal_106
lea rcx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 7
cmova rcx, qword [rsp + 0x1e0]
lea rax, [rsp + 0x170]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x230]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x18006a0cb
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 0xf
jbe 0x18006a018
inc rdx
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006a012
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006a411
call fcn.18008ed30
nop
mov rdx, qword [rsp + 0x1f8]
cmp rdx, 7
jbe 0x18006a061
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006a05b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006a465
call fcn.18008ed30
nop
lea r9, [fcn.1800067d0]
mov edx, Ordinal_34
mov r8d, 2
lea rcx, [rsp + 0x2a0]
call fcn.18008f134
nop
mov rcx, qword [rsp + 0x200]
test rcx, rcx
je 0x18006a38b
mov rdx, qword [rsp + 0x210]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006a372
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006a417
jmp 0x18006a372
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 0xf
jbe 0x18006a10f
inc rdx
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006a109
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006a41d
call fcn.18008ed30
nop
lea rdx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 7
cmova rdx, qword [rsp + 0x1e0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x190], xmm0
mov qword [rsp + 0x1a0], rsi
mov qword [rsp + 0x1a8], rsi
mov r8, qword [rsp + 0x1f0]
lea rcx, [rsp + 0x190]
call fcn.18000acd0
or r14d, 6
mov dword [rsp + 0x50], r14d
mov r8d, 3
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x160]
call fcn.180021d40
movsd xmm0, qword [rax]
movsd qword [rsp + 0x150], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0xd0], ecx
lea rax, [0x18018b270]
mov qword [rsp + 0xd8], rax
movaps xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0x170], xmm0
mov eax, dword [rsp + 0x150]
test eax, eax
je 0x18006a20a
cmp eax, 1
setne bl
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 7
jbe 0x18006a21b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006a216
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006a423
jmp 0x18006a216
xor bl, bl
test ecx, ecx
jne 0x18006a429
jmp 0x18006a1c5
call fcn.18008ed30
test bl, bl
je 0x18006a2ed
lea rdx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 7
cmova rdx, qword [rsp + 0x1e0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x188], rsi
mov r8, qword [rsp + 0x1f0]
lea rcx, [rsp + 0x170]
call fcn.18000acd0
or r14d, 0x18
mov dword [rsp + 0x50], r14d
lea rcx, [rsp + 0x170]
cmp qword [rsp + 0x188], 7
cmova rcx, qword [rsp + 0x170]
call fcn.18008d9fc
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x18006a446
mov rdx, qword [rsp + 0x188]
cmp rdx, 7
jbe 0x18006a2ed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006a2e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006a45f
call fcn.18008ed30
nop
jmp 0x18006a317
movabs rbx, 0xc000000000000010
mov rdx, qword [rsp + 0x1f8]
cmp rdx, 7
jbe 0x18006a369
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006a364
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006a465
call fcn.18008ed30
add rdi, 0x20
jmp 0x180069d63
call fcn.18008ed30
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x200], xmm0
mov qword [rsp + 0x210], rsi
mov rcx, qword [rsp + 0x218]
test rcx, rcx
je 0x18006a3cd
mov rdx, qword [rsp + 0x228]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006a3c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006a46b
call fcn.18008ed30
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.18008ed10
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.1800a4178
nop
call fcn.1800a4178
nop
call fcn.1800a4178
int3
call fcn.1800a4178
nop
call fcn.1800a4178
nop
call fcn.1800a4178
nop
call fcn.1800a4178
nop
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0x170]
lea rcx, [0x1801030d0]
call fcn.1800212b0
nop
shr rdx, 0x20
lea r8, [rsp + 0x170]
lea rcx, str.remove
call fcn.18002baa0
nop
call fcn.1800a4178
nop
call fcn.1800a4178
nop
call fcn.1800a4178
int3