Function at 0x180031570
Capabilities:
Create process on windows

Disassembly:
push rdi
mov eax, 0x1990
call fcn.18006ba40
sub rsp, rax
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [rsp + 0x19a0], rbx
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x1980], rax
mov edi, ecx
mov byte [rsp + 0x180], 0
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rsp + 0x181]
call fcn.180055310
mov byte [rsp + 0x580], 0
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rsp + 0x581]
call fcn.180055310
cmp edi, 1
jne 0x1800315f4
mov rax, qword [0x1800a5998]
mov qword [rsp + 0x58], rax
jmp 0x180031604
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rsp + 0x58]
xor ebx, ebx
mov dword [0x1800a5424], ebx
mov qword [rsp + 0x20], rax
mov r9d, 0x400
lea r8, [rsp + 0x580]
mov edx, r9d
lea rcx, [rsp + 0x180]
call fcn.180031150
test eax, eax
je 0x180031abd
xor edx, edx
lea rcx, [rsp + 0x180]
call fcn.180054f78
test eax, eax
jne 0x180031abd
lea edx, [rbx + 0x5c]
lea rcx, [rsp + 0x180]
call fcn.180051920
lea rdx, [rax + 1]
lea rcx, str._knbmenu.exe_ssgamerun.exe_barclientview.exe_HintClient.exe_Recreation.exe_openie.exe_SW_PlayPlay.exe_Rungame.exe_
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
jne 0x1800318f4
lea rdx, str..vbs
lea rcx, [rsp + 0x180]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
jne 0x1800318f4
lea rdx, str..bat
lea rcx, [rsp + 0x180]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
jne 0x1800318f4
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x54], eax
lea rcx, [rsp + 0x180]
call fcn.180004800
test eax, eax
je 0x18003172d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x180]
call fcn.180007840
test eax, eax
je 0x18003172d
lea rax, [0x18009f3c4]
lea rdi, [0x18009f404]
mov ecx, dword [rsp + 0x54]
mov edx, dword [rsp + 0x50]
nop dword [rax]
cmp edx, dword [rax - 4]
jne 0x180031709
cmp ecx, dword [rax]
je 0x180031714
add rax, 8
cmp rax, rdi
jge 0x18003172d
jmp 0x180031700
cmp dword [0x1800a2754], ebx
je 0x18003172d
lea rcx, [0x1800a3510]
call fcn.18002de80
jmp 0x180031ac9
mov qword [rsp + 0x80], select
mov qword [rsp + 0x78], rbx
mov byte [rsp + 0x68], bl
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x180]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x60]
call fcn.1800026a0
nop
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x158]
call fcn.18000ac80
nop
cmp qword [rsp + 0x80], 0x10
jb 0x180031794
mov rcx, qword [rsp + 0x68]
call fcn.180050528
mov qword [rsp + 0x80], select
mov qword [rsp + 0x78], rbx
mov byte [rsp + 0x68], 0
mov qword [rsp + 0xa8], select
mov qword [rsp + 0xa0], rbx
mov byte [rsp + 0x90], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x180]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x88]
call fcn.1800026a0
nop
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x130]
call fcn.18000afb0
nop
cmp qword [rsp + 0xa8], 0x10
jb 0x180031821
mov rcx, qword [rsp + 0x90]
call fcn.180050528
mov qword [rsp + 0xa8], select
mov qword [rsp + 0xa0], rbx
mov byte [rsp + 0x90], 0
lea rcx, [rsp + 0x138]
cmp qword [rsp + 0x150], 0x10
cmovae rcx, qword [rsp + 0x138]
call fcn.180031320
test eax, eax
jne 0x180031891
lea rcx, [rsp + 0x160]
cmp qword [rsp + 0x178], 0x10
cmovae rcx, qword [rsp + 0x160]
call fcn.180031400
test eax, eax
jne 0x180031891
lea rcx, [0x1800a3510]
call fcn.18002de80
jmp 0x18003189f
lea rcx, [rsp + 0x180]
call fcn.18002de80
nop
cmp qword [rsp + 0x150], 0x10
jb 0x1800318b7
mov rcx, qword [rsp + 0x138]
call fcn.180050528
mov qword [rsp + 0x150], select
mov qword [rsp + 0x148], rbx
mov byte [rsp + 0x138], 0
cmp qword [rsp + 0x178], 0x10
jb 0x180031ac9
mov rcx, qword [rsp + 0x160]
call fcn.180050528
jmp 0x180031ac9
mov byte [rsp + 0x980], bl
xor edx, edx
mov r8d, 0x7ff
lea rcx, [rsp + 0x981]
call fcn.180055310
mov rdx, rbx
nop word [rax + rax]
movzx eax, byte [rsp + rdx + 0x180]
mov byte [rsp + rdx + 0x980], al
inc rdx
test al, al
jne 0x180031920
cmp byte [rsp + 0x580], bl
je 0x18003198f
lea rdi, [rsp + 0x980]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x1800817d4]
mov word [rdi - 1], ax
lea rdi, [rsp + 0x980]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x580]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x180031980
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0xc0]
call fcn.180055310
mov dword [rsp + 0xc0], WSAGetLastError
mov edi, 1
mov dword [rsp + 0xfc], edi
mov word [rsp + 0x100], di
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
lea rdx, str..vbs
lea rcx, [rsp + 0x180]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
jne 0x180031a5f
lea rdx, str..bat
lea rcx, [rsp + 0x180]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
jne 0x180031a5f
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x980]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x180031a5b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1800a3510]
call fcn.18002de80
mov eax, edi
jmp 0x180031acb
mov byte [rsp + 0x1180], bl
xor edx, edx
mov r8d, 0x7ff
lea rcx, [rsp + 0x1181]
call fcn.180055310
mov rdx, rbx
nop
movzx eax, byte [rsp + rdx + 0x180]
mov byte [rsp + rdx + 0x1180], al
inc rdx
test al, al
jne 0x180031a80
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x1180]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, edi
jmp 0x180031acb
lea rcx, [0x1800a3510]
call fcn.18002de80
xor eax, eax
mov rcx, qword [rsp + 0x1980]
xor rcx, rsp
call fcn.180050540
mov rbx, qword [rsp + 0x19a0]
add rsp, 0x1990
pop rdi
ret