Function at 0x18004ba90
Capabilities:
Create thread
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x140
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1800a2010]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov rbx, rcx
test edx, edx
je 0x18004bd6a
cmp edx, 1
jne 0x18004bd94
lea rcx, str.Dbg64.exe
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movabs rsi, 0x2b01ceffffff98d3
movabs rdi, 0xeb9e42f9580be7e0
movabs rcx, 0xffb90dfdce6c4c9c
movabs r14, 0xdfd464d2ee0a63bc
movabs r15, 0x8588fc1663a36e3b
movabs r12, 0xb5d2eb50e9c89585
movabs rdx, 0xb4c424ba3a3c1149
movabs r13, 0x476da794948cf9a7
movabs r8, 0xb7a890630d9d4e5e
movabs r9, 0xb5d2eb50e9f9b3bb
test rax, rax
je 0x18004bc25
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xcca10a8e0c5b730d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x20]
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
movdqa xmm2, xmmword [rbp + 0x40]
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
mov qword [rbp + 0x88], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqa xmmword [rbp + 0x40], xmm2
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Dbg32.exe
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18004bd40
mov qword [rbp], rsi
lea rcx, [rbp + 0x20]
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xcca10a88095b730d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0xffb90dfdce6c4c9c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0xb4c424ba3a3c1149
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0xb7a890630d9d4e5e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0xb5d2eb50e9f9b3bb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
movdqa xmm2, xmmword [rbp + 0x40]
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
mov qword [rbp + 0xc8], rax
vxorps xmm2, xmm2, xmmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqa xmmword [rbp + 0x40], xmm2
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x18004ba30]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x18004bd94
cmp dword [0x1800a3bf8], 0
je 0x18004bd94
call fcn.180040920
mov rcx, qword [0x1800a3bf0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov qword [0x1800a3bf0], rax
mov dword [0x1800a3bf8], eax
mov eax, 1
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.1800675e0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret