Function at 0x180023b50
Capabilities:
Create process on windows

Disassembly:
jmp 0x180023b50
mov rax, rsp
push rbp
lea rbp, [rax - 0x2b8]
sub rsp, 0x3b0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1800b75c0]
xor rax, rsp
mov qword [rbp + 0x2a0], rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x90]
call fcn.180002d29
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x48]
call fcn.1800029d7
nop
xor esi, esi
cmp qword [0x1800b8b40], rsi
jne 0x180023be9
call fcn.1800026e4
test al, al
je 0x180023bc6
call fcn.180001965
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x180003b25]
xor edx, edx
xor ecx, ecx
call fcn.1800038a5
mov qword [0x1800b8b40], rax
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], rsi
mov word [rbp - 0x78], si
lea r9, str.QuYatools.exe
lea r8, [rbp + 0x90]
lea rdx, str._s_s
lea rcx, [rbp - 0x18]
call fcn.180003a21
mov rbx, rax
lea rax, [rbp - 0x78]
cmp rax, rbx
je 0x180023c5a
mov r8, qword [rbp - 0x60]
cmp r8, 8
jb 0x180023c3d
inc r8
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp - 0x78]
call fcn.180004a93
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], rsi
mov word [rbp - 0x78], si
mov rdx, rbx
lea rcx, [rbp - 0x78]
call fcn.1800041d3
nop
mov r8, qword [rbp]
cmp r8, 8
jb 0x180023c74
inc r8
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 0x18]
call fcn.180004a93
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rcx, qword [rbp - 0x78]
call fcn.180001e97
test eax, eax
je 0x180023f23
xor ecx, ecx
call fcn.180001e6a
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov eax, 0xcccccccd
mul ebx
shr edx, 3
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub ebx, ecx
movabs rax, 0x346dc5d63886594b
imul rdi
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x2710
sub ebx, eax
add ebx, edi
mov r8d, ebx
lea rdx, [0x1800960c0]
lea rcx, [rbp - 0x18]
call fcn.180001c03
nop
mov r9, rdi
mov r8d, ebx
lea rdx, str._d__d
lea rcx, [rbp + 0x68]
call fcn.180001c03
nop
mov qword [rbp + 0x20], 0xf
mov qword [rbp + 0x18], rsi
mov byte [rbp + 8], 0
mov r8d, 0x10
lea rdx, str.tCPVyzefszsGmWO3
lea rcx, [rbp + 8]
call fcn.18000130c
nop
lea rax, [rsp + 0x58]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x70], 0xf
mov qword [rsp + 0x68], rsi
mov byte [rsp + 0x58], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x58]
call fcn.180002743
nop
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], rsi
mov byte [rsp + 0x30], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x30]
call fcn.180002743
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x28]
call fcn.1800034f9
nop
lea r9, [rbp + 0x28]
cmp qword [rbp + 0x40], 0x10
cmovae r9, qword [rbp + 0x28]
lea r8, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae r8, qword [rbp - 0x18]
lea rdx, str.task_s_s:_s
lea rcx, [rbp - 0x38]
call fcn.180001c03
nop
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x30], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x30]
call fcn.180003ec7
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x58]
call fcn.180001677
lea r9, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae r9, qword [rbp - 0x38]
lea r8, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae r8, qword [rbp - 0x58]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword [rbp - 0x40]
cmp rax, 0x10
jb 0x180023e85
inc rax
mov rcx, qword [rbp - 0x58]
cmp rax, 0x1000
jb 0x180023e80
test cl, 0x1f
je 0x180023e53
call fcn.180004426
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180023e62
call fcn.180004426
int3
sub rcx, rax
cmp rcx, 8
jae 0x180023e71
call fcn.180004426
int3
cmp rcx, 0x27
jbe 0x180023e7d
call fcn.180004426
int3
mov rcx, rax
call fcn.180001b95
mov qword [rbp - 0x40], 0xf
mov qword [rbp - 0x48], rsi
mov byte [rbp - 0x58], 0
mov rax, qword [rbp - 0x20]
cmp rax, 0x10
jb 0x180023eeb
inc rax
mov rcx, qword [rbp - 0x38]
cmp rax, 0x1000
jb 0x180023ee6
test cl, 0x1f
je 0x180023eb9
call fcn.180004426
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180023ec8
call fcn.180004426
int3
sub rcx, rax
cmp rcx, 8
jae 0x180023ed7
call fcn.180004426
int3
cmp rcx, 0x27
jbe 0x180023ee3
call fcn.180004426
int3
mov rcx, rax
call fcn.180001b95
mov qword [rbp - 0x20], 0xf
mov qword [rbp - 0x28], rsi
mov byte [rbp - 0x38], 0
lea rcx, [rbp + 0x28]
call fcn.180001b72
nop
lea rcx, [rbp + 8]
call fcn.180001b72
nop
lea rcx, [rbp + 0x68]
call fcn.180001b72
nop
lea rcx, [rbp - 0x18]
call fcn.180001b72
nop
mov r8, qword [rbp - 0x60]
cmp r8, 8
jb 0x180023f3d
inc r8
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp - 0x78]
call fcn.180004a93
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], rsi
mov word [rbp - 0x78], si
mov r8, qword [rbp + 0x60]
cmp r8, 8
jb 0x180023f67
inc r8
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x48]
call fcn.180004a93
mov rcx, qword [rbp + 0x2a0]
xor rcx, rsp
call fcn.18000411a
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret