Function at 0x180001970
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xe8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x60], 0xfffffffffffffffe
movzx eax, byte [0x183a6efa0]
mov edx, 0xd
xor ecx, ecx
call fcn.180022710
test rax, rax
je 0x180001b52
mov rsi, rax
movabs rax, 0x69777265726f6c70
mov qword [rsi + 5], rax
movabs rax, 0x6f6c7078652f3a43
mov qword [rsi], rax
lea rdx, [0x18005a50a]
lea rcx, [rbp - 0x50]
mov r8d, 0x1a
call fcn.180021d90
cmp dword [rbp - 0x50], 2
jne 0x180001a81
mov rcx, qword [rbp - 0x48]
call fcn.1800014a0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 1
mov qword [rbp + 0x58], 0
lea rcx, [rbp + 0x48]
mov r8d, 0x39fe15e
xor edx, edx
call fcn.1800585e0
mov rdi, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x50]
add rcx, rdi
lea rdx, [0x18005a524]
mov r8d, 0x39fe15e
call sub.VCRUNTIME140.dll_memcpy
add rdi, 0x39fe15e
mov qword [rbp + 0x58], rdi
mov qword [rbp - 0x40], rdi
movups xmm0, xmmword [rbp + 0x48]
movaps xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x38], 0
lea rcx, [rbp + 8]
lea rdx, [rbp - 0x50]
mov r9d, 0xd
mov r8, rsi
call int.180006ec0
movabs rax, 0x8000000000000002
cmp qword [rbp + 0x28], rax
jne 0x180001bdd
lea rdx, [0x183a586a8]
lea rcx, [rbp + 8]
mov r8d, 4
call fcn.180001e30
movabs rbx, 0x8000000000000000
cmp qword [rbp + 8], rbx
jne 0x180001b66
mov rdi, qword [rbp + 0x10]
mov r14, qword [rbp + 0x18]
lea rdx, [0x18005a50a]
lea rcx, [rbp + 8]
mov r8d, 0x1a
call fcn.180001e30
cmp qword [rbp + 8], rbx
jne 0x180001ba3
mov rbx, qword [rbp + 0x10]
mov r15, qword [rbp + 0x18]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rdi
mov r8, rbx
xor r9d, r9d
call sub.SHELL32.dll_ShellExecuteA
mov byte [rbx], 0
test r15, r15
je 0x180001b16
mov rcx, qword [0x183a6ef38]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [rdi], 0
test r14, r14
je 0x180001b30
mov rcx, qword [0x183a6ef38]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x183a6ef38]
xor edx, edx
mov r8, rsi
add rsp, 0xe8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 1
mov edx, 0xd
call fcn.1800573a0
jmp 0x180001c25
movups xmm0, xmmword [rbp + 8]
movups xmm1, xmmword [rbp + 0x18]
movaps xmmword [rbp - 0x40], xmm1
movaps xmmword [rbp - 0x50], xmm0
lea rax, [0x183a586c0]
mov qword [rsp + 0x20], rax
lea rcx, [0x183a586ac]
lea r9, [0x18005a468]
lea r8, [rbp - 0x50]
mov edx, 0x13
call fcn.180057840
jmp 0x180001c25
movups xmm0, xmmword [rbp + 8]
movups xmm1, xmmword [rbp + 0x18]
movaps xmmword [rbp - 0x40], xmm1
movaps xmmword [rbp - 0x50], xmm0
lea rax, [0x183a586d8]
mov qword [rsp + 0x20], rax
lea rcx, [0x183a586ac]
lea r9, [0x18005a468]
lea r8, [rbp - 0x50]
mov edx, 0x13
call fcn.180057840
jmp 0x180001c25
movups xmm0, xmmword [rbp + 8]
movups xmm1, xmmword [rbp + 0x18]
movups xmm2, xmmword [rbp + 0x28]
movups xmm3, xmmword [rbp + 0x38]
movaps xmmword [rbp - 0x20], xmm3
movaps xmmword [rbp - 0x30], xmm2
movaps xmmword [rbp - 0x40], xmm1
movaps xmmword [rbp - 0x50], xmm0
lea rax, [0x183a58690]
mov qword [rsp + 0x20], rax
lea rcx, [0x183a62148]
lea r9, fcn.1800015a0
lea r8, [rbp - 0x50]
mov edx, 0x2b
call fcn.180057840
ud2