Function at 0x180026610
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb30
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0xb80], rbx
mov rax, qword [0x1800ac2b8]
xor rax, rsp
mov qword [rsp + 0xb20], rax
mov rdi, rdx
mov r14, rcx
test rdx, rdx
jne 0x18002665b
mov eax, 0x80070057
jmp 0x180026abe
mov eax, reloc.WS2_32.dll_ntohs
mov word [rsp + 0x48], ax
xor ebp, ebp
mov qword [rsp + 0x50], rbp
mov r13d, 1
mov dword [rsp + 0x58], r13d
or rsi, 0xffffffffffffffff
mov dword [rsp + 0x5c], esi
mov dword [rsp + 0x60], r13d
mov dword [rsp + 0x28], r13d
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov rax, qword [rdx]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [rax + Ordinal_26]
test eax, eax
jns 0x1800266b6
mov eax, 0x80070057
jmp 0x180026abe
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r12, rax
mov qword [rsp + 0x40], rax
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
mov r15d, eax
lea rcx, case.0x180034a3c.6
mov rdx, qword [case.0x180034a3c.6]
call qword [rdx + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
xor eax, eax
mov rcx, rsi
lea rdi, [0x18008d5d0]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x180026771
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x180026806
cmp dword [rdx + 0x10], eax
jge 0x180026744
cmp dword [rbx - 0xc], eax
jge 0x180026739
mov ecx, 0x80070057
call fcn.180002fb0
int3
mov dword [rbx - 0x10], ebp
mov word [rbx], bp
jmp 0x180026806
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18002675a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x20], rax
jmp 0x180026806
mov r12d, dword [rbx - 0x10]
lea rbp, [0x18008d5d0]
sub rbp, rbx
sar rbp, 1
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1800267a2
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.180003fe0
mov rbx, qword [rsp + 0x20]
cmp rbp, r12
ja 0x1800267c6
movsxd rax, edi
lea r12, [rax + rax]
lea r8, [rbx + rbp*2]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r12
mov rcx, rbx
call fcn.18005f71c
jmp 0x1800267e6
movsxd rax, edi
lea r12, [rax + rax]
movsxd rdx, dword [rbx - 0xc]
add rdx, rdx
mov r9, r12
lea r8, [0x18008d5d0]
mov rcx, rbx
call fcn.18005f078
test edi, edi
js 0x180026ab3
cmp edi, dword [rbx - 0xc]
jg 0x180026ab3
mov dword [rbx - 0x10], edi
xor ebp, ebp
mov word [r12 + rbx], bp
mov r12, qword [rsp + 0x40]
xor eax, eax
mov rcx, rsi
lea rdi, [0x18008d5d8]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x18008d5d8]
lea rcx, [rsp + 0x20]
call fcn.1800113a0
xor eax, eax
mov rcx, rsi
lea rdi, [0x18008d5d4]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x18008d5d4]
lea rcx, [rsp + 0x20]
call fcn.1800113a0
cmp qword [r14 + 0x30], 8
jb 0x180026861
mov rdx, qword [r14 + 0x18]
jmp 0x180026865
lea rdx, [r14 + 0x18]
test rdx, rdx
jne 0x18002686e
mov ecx, ebp
jmp 0x18002687f
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rsp + 0x20]
call fcn.1800113a0
xor eax, eax
mov rcx, rsi
lea rdi, [0x18008d5e4]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x18008d5e4]
lea rcx, [rsp + 0x20]
call fcn.1800113a0
mov rdi, qword [rsp + 0x20]
mov ebp, dword [rdi - 0x10]
lea ebx, [rbp + 1]
sub r13d, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, r13d
jge 0x1800268dd
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.180003fe0
mov rdi, qword [rsp + 0x20]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + rbp*2], cx
test ebx, ebx
js 0x180026aa8
cmp ebx, dword [rdi - 0xc]
jg 0x180026aa8
mov dword [rdi - 0x10], ebx
movsxd rax, ebx
xor ebp, ebp
mov word [rdi + rax*2], bp
mov ebx, ebp
test r15d, r15d
je 0x18002697b
nop word [rax + rax]
mov r9d, 0x104
lea r8, [rsp + 0x500]
mov edx, ebx
mov rcx, r12
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
lea r8, [rsp + 0x500]
lea rdx, [0x18008d5e8]
lea rcx, [rsp + 0x710]
call qword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x710]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x710]
lea rcx, [rsp + 0x20]
call fcn.1800113a0
inc ebx
cmp ebx, r15d
jb 0x180026910
mov rdi, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ole32.dll_ReleaseStgMedium]
mov r11d, dword [rdi - 0x10]
test r11d, r11d
je 0x180026a8c
test r11d, r11d
jns 0x1800269ae
mov ecx, 0x80070057
call fcn.180002fb0
int3
movzx r8d, word [rdi]
mov edx, 0x104
lea rcx, [rsp + 0x2f0]
call fcn.180018540
test eax, eax
je 0x180026a8c
lea r8, [rsp + 0x2f0]
mov edx, 0x104
lea rcx, [rsp + 0xe0]
call fcn.180060e8c
lea rcx, [rsp + 0xe0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov word [rax], bp
mov dword [rsp + reloc.WS2_32.dll_WSASetLastError], 0x70
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0x74]
call fcn.18005f790
mov dword [rsp + 0xa0], 5
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rdi
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x180026a6d
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x180026a69
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
xor eax, eax
jmp 0x180026abe
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x180026a85
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov eax, 0x80004005
jmp 0x180026abe
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x180026aa4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
xor eax, eax
jmp 0x180026abe
mov ecx, 0x80070057
call fcn.180002fb0
int3
mov ecx, 0x80070057
call fcn.180002fb0
nop
mov rcx, qword [rsp + 0xb20]
xor rcx, rsp
call fcn.18005f4d0
mov rbx, qword [rsp + 0xb80]
add rsp, 0xb30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret