Function at 0x180035940
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x6c8]
sub rsp, 0x7a0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x180143158]
xor rax, rsp
mov qword [rbp + 0x690], rax
mov r12d, ecx
mov dword [rsp + 0x38], 0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x480]
call fcn.18009b770
mov r8d, 0x104
lea rdx, [rbp + 0x480]
mov rcx, qword [0x1801534b8]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x480]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, str.UtilsExtention.exe
lea rcx, [rbp + 0x480]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x480]
call fcn.180074870
test eax, eax
jne 0x180035ba4
call fcn.18007a540
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + 0x10]
cmp al, 1
jne 0x1800361be
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rbp + 0x410], xmm0
mov byte [rbp + 0x400], 0
mov r8d, 0x5c
lea rdx, str.d:jenkins.jenkinsworkspacemaster_lucomputerz_band_win10computerz7_band_win10utils.cpp
lea rcx, [rbp + 0x400]
call fcn.18000fec0
nop
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rbp + 0x390], xmm0
mov byte [rbp + 0x380], 0
mov r8d, 3
lea rdx, [0x1800f4ed4]
lea rcx, [rbp + 0x380]
call fcn.18000fec0
nop
call fcn.18007a540
mov rdi, rax
lea r9, [rbp + 0x480]
lea r8, str.SignCheck_error:_s
mov edx, 1
lea rcx, [rsp + 0x50]
call fcn.18007a0d0
nop
mov r9d, 0x12b
lea r8, [rbp + 0x400]
lea rdx, [rbp + 0x380]
lea rcx, [rbp - 0x20]
call fcn.180014970
mov rbx, rax
mov rcx, qword [rsp + 0x50]
lea rdx, [0x1800f4e38]
test rcx, rcx
cmovne rdx, rcx
mov rcx, rax
call fcn.180013fb0
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r8 + 0x38]
nop
lea rcx, [rbp - 0x20]
call fcn.180014d70
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov esi, 0xffffffff
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x180035b02
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x398]
cmp rdx, 0x10
jb 0x180035b43
inc rdx
mov rcx, qword [rbp + 0x380]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180035b3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800361ef
call fcn.180050b00
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rbp + 0x390], xmm0
mov byte [rbp + 0x380], 0
mov rdx, qword [rbp + 0x418]
cmp rdx, 0x10
jb 0x1800361be
inc rdx
mov rcx, qword [rbp + 0x400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180035b9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800361f5
call fcn.180050b00
jmp 0x1800361be
call fcn.1800121e0
mov rcx, rax
test rax, rax
je 0x1800361fb
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea r9, [0x1800f9cc0]
lea r8, [0x1800f9ce8]
lea rdx, str.__dll_s___entry_s
lea rcx, [rsp + 0x30]
call fcn.18002c4f0
call fcn.18007a540
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + 0x10]
lea r14, [0x1800f4e38]
mov esi, 0xffffffff
cmp al, 1
jne 0x180035de7
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rbp + 0x430], xmm0
mov byte [rbp + 0x420], 0
lea r8d, [rsi + 0x5d]
lea rdx, str.d:jenkins.jenkinsworkspacemaster_lucomputerz_band_win10computerz7_band_win10utils.cpp
lea rcx, [rbp + 0x420]
call fcn.18000fec0
nop
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rbp + 0x3b0], xmm0
mov byte [rbp + 0x3a0], 0
lea r8d, [rsi + 4]
lea rdx, [0x1800f4ed4]
lea rcx, [rbp + 0x3a0]
call fcn.18000fec0
nop
call fcn.18007a540
mov rdi, rax
mov rcx, qword [rsp + 0x30]
add rcx, 0xffffffffffffffe8
call fcn.180013800
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x480]
lea r8, [0x1800f9d30]
lea edx, [rsi + 3]
lea rcx, [rsp + 0x60]
call fcn.18007a0d0
mov r15, rax
mov dword [rsp + 0x38], 2
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x180035cdc
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov r9d, 0x131
lea r8, [rbp + 0x420]
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0xc8]
call fcn.180014970
mov rbx, rax
mov rcx, qword [r15]
mov rdx, r14
test rcx, rcx
cmovne rdx, rcx
mov rcx, rax
call fcn.180013fb0
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r8 + 0x38]
nop
lea rcx, [rbp + 0xc8]
call fcn.180014d70
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180035d4e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x3b8]
cmp rdx, 0x10
jb 0x180035d8f
inc rdx
mov rcx, qword [rbp + 0x3a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180035d8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180036206
call fcn.180050b00
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rbp + 0x3b0], xmm0
mov byte [rbp + 0x3a0], 0
mov rdx, qword [rbp + 0x438]
cmp rdx, 0x10
jb 0x180035de7
inc rdx
mov rcx, qword [rbp + 0x420]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180035de2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003620c
call fcn.180050b00
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x70]
call fcn.18009b770
mov dword [rsp + 0x70], 0x70
lea rax, [rbp + 0x480]
mov qword [rbp - 0x78], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x60], 0
mov dword [rsp + 0x74], 0x440
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1800361a2
call fcn.18007a540
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + 0x10]
cmp al, 1
jne 0x180035fdc
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rbp + 0x450], xmm0
mov byte [rbp + 0x440], 0
mov r8d, 0x5c
lea rdx, str.d:jenkins.jenkinsworkspacemaster_lucomputerz_band_win10computerz7_band_win10utils.cpp
lea rcx, [rbp + 0x440]
call fcn.18000fec0
nop
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rbp + 0x3d0], xmm0
mov byte [rbp + 0x3c0], 0
mov r8d, 3
lea rdx, [0x1800f4ed4]
lea rcx, [rbp + 0x3c0]
call fcn.18000fec0
nop
call fcn.18007a540
mov rdi, rax
lea r8, str.rundll.exe_shell_Execute_success_
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.18007a0d0
nop
mov r9d, 0x13d
lea r8, [rbp + 0x440]
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x1b0]
call fcn.180014970
mov rbx, rax
mov rcx, qword [rsp + 0x58]
mov rdx, r14
test rcx, rcx
cmovne rdx, rcx
mov rcx, rax
call fcn.180013fb0
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r8 + 0x38]
nop
lea rcx, [rbp + 0x1b0]
call fcn.180014d70
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180035f43
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x3d8]
cmp rdx, 0x10
jb 0x180035f84
inc rdx
mov rcx, qword [rbp + 0x3c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180035f7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180036212
call fcn.180050b00
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rbp + 0x3d0], xmm0
mov byte [rbp + 0x3c0], 0
mov rdx, qword [rbp + 0x458]
cmp rdx, 0x10
jb 0x180035fdc
inc rdx
mov rcx, qword [rbp + 0x440]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180035fd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180036218
call fcn.180050b00
mov edx, r12d
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x180036197
call fcn.18007a540
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + 0x10]
cmp al, 1
jne 0x180036197
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rbp + 0x470], xmm0
mov byte [rbp + 0x460], 0
mov r8d, 0x5c
lea rdx, str.d:jenkins.jenkinsworkspacemaster_lucomputerz_band_win10computerz7_band_win10utils.cpp
lea rcx, [rbp + 0x460]
call fcn.18000fec0
nop
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rbp + 0x3f0], xmm0
mov byte [rbp + 0x3e0], 0
mov r8d, 3
lea rdx, [0x1800f4ed4]
lea rcx, [rbp + 0x3e0]
call fcn.18000fec0
nop
call fcn.18007a540
mov rdi, rax
lea r8, str.ShellExecuteEx_timeout
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.18007a0d0
nop
mov r9d, 0x142
lea r8, [rbp + 0x460]
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp + 0x298]
call fcn.180014970
mov rbx, rax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
cmovne r14, rcx
mov rdx, r14
mov rcx, rax
call fcn.180013fb0
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r8 + 0x38]
nop
lea rcx, [rbp + 0x298]
call fcn.180014d70
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180036102
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x3f8]
cmp rdx, 0x10
jb 0x180036143
inc rdx
mov rcx, qword [rbp + 0x3e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003613e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003621e
call fcn.180050b00
movdqa xmm0, xmmword [0x180118170]
movdqu xmmword [rbp + 0x3f0], xmm0
mov byte [rbp + 0x3e0], 0
mov rdx, qword [rbp + 0x478]
cmp rdx, 0x10
jb 0x180036197
inc rdx
mov rcx, qword [rbp + 0x460]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180036192
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800361e9
call fcn.180050b00
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1800361be
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x690]
xor rcx, rsp
call fcn.180050f90
lea r11, [rsp + 0x7a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.18009e87c
nop
call fcn.18009e87c
nop
call fcn.18009e87c
int3
mov ecx, 0x80004005
call fcn.180010a30
nop
call fcn.18009e87c
nop
call fcn.18009e87c
nop
call fcn.18009e87c
nop
call fcn.18009e87c
nop
call fcn.18009e87c
int3