Function at 0x180069700
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6e0]
sub rsp, 0x7e0
mov r15d, r9d
mov r14, rcx
mov rsi, r8
lea rcx, [0x180000000]
mov r9, rdx
lea eax, [r15 - 0xf]
cmp r15d, eax
jbe 0x18006994a
mov r12, qword [rbp + 0x740]
lea ebx, [r15 - 0x95]
mov edi, 0xf
mov r10d, 0x7475
mov r15d, 0x6f79
lea edx, [rdi + 0x5a]
lea r8d, [rdi + 0x69]
lea r13d, [rdi + 0x60]
lea r11d, [rdi + 0x36]
cmp ebx, 0x21
ja case.default.0x180069799
movzx eax, byte [rcx + rbx + 0x69fb4]
mov ecx, dword [rcx + rax*4 + 0x69f74]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov ecx, 0xfffffed1
lea rdx, [rbp + 0xf0]
call qword [0x1800ce8f0]
movzx eax, word [rbp + 0x64a]
mov word [0x1800ce8f8], ax
test r14, r14
je 0x1800697cb
movzx eax, word [rbp + 0x538]
mov word [r14], ax
mov r9, qword [rbp + 0x728]
mov edx, 0x69
lea rcx, [0x180000000]
mov r10d, 0x7475
lea r8d, [rdx + 0xf]
lea r11d, [rdx - 0x24]
test rsi, rsi
je case.default.0x180069799
movzx eax, word [rbp + 0x53a]
mov word [rsi], ax
jmp case.default.0x180069799
mov word [rbp - 0x6b], r8w
jmp case.0x180069799.15
mov byte [rsp + 0x5a], 0
jmp case.0x180069799.15
mov byte [rsp + 0x59], 0x62
jmp case.0x180069799.15
mov dword [rbp - 0x48], 0x2e0032
mov dword [rbp - 0x44], 0x6c0064
jmp case.0x180069799.15
movzx eax, word [0x180098d4f]
mov word [rsp + 0x50], ax
movzx eax, byte [0x180098d51]
mov byte [rsp + 0x52], al
mov byte [rsp + 0x53], 0
jmp case.0x180069799.15
mov dword [rsp + 0x56], 0x757475
jmp case.0x180069799.15
mov eax, 0x7a
mov word [rbp - 0x6e], ax
mov eax, 0x65
mov word [rbp - 0x6d], ax
jmp case.0x180069799.15
movzx eax, word [r12]
mov word [rbp + 0x538], ax
movzx eax, word [r9]
mov word [rbp + 0x53a], ax
jmp case.0x180069799.15
mov r8d, 4
lea rdx, [0x180098dab]
lea rcx, [rsp + 0x50]
call fcn.180071b90
mov r8d, 1
lea rdx, [0x180098ea9]
lea rcx, [rsp + 0x5e]
call fcn.180071f50
mov r9, qword [rbp + 0x728]
mov edx, 0x69
mov byte [rsp + 0x5f], 0
mov r10d, 0x7475
lea r8d, [rdx + 0xf]
lea r11d, [rdx - 0x24]
jmp case.0x180069799.15
mov dword [rbp - 0x50], 0x6c006f
mov dword [rbp - 0x4c], 0x330065
jmp case.0x180069799.15
mov dword [rbp - 0x71], 0x696c61
jmp case.0x180069799.15
mov word [rbp - 0x6c], r11w
jmp case.0x180069799.15
mov eax, 0x43
mov word [rbp - 0x72], dx
mov word [rbp - 0x78], ax
mov word [rbp - 0x77], r13w
mov dword [rbp - 0x76], 0x74696e49
jmp case.0x180069799.15
mov byte [rsp + 0x53], 0x2e
mov word [rsp + 0x54], r15w
mov byte [rsp + 0x56], 0
lea rcx, [0x180000000]
dec ebx
sub rdi, 1
jne 0x180069777
mov r15d, dword [rbp + 0x738]
lea eax, [r15 - 0x10]
mov dword [rbp - 0x60], eax
cmp r15d, eax
jbe 0x180069f58
mov rsi, qword [rbp - 0x80]
xor ebx, ebx
mov r13, qword [rsp + 0x70]
mov r12, qword [rbp - 0x80]
mov r14, qword [rbp - 0x80]
mov rdi, qword [rbp - 0x80]
lea edx, [rbx + 2]
lea r8d, [rbx + 0x2f]
lea r10d, [rbx + 5]
lea r11d, [rbx + 3]
lea eax, [r15 - 0x9d]
cmp eax, 0x19
ja case.0x1800699a1.167
mov ecx, dword [rcx + rax*4 + 0x69fd8]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov eax, dword [str.atch]
mov dword [rsp + 0x62], eax
movzx eax, byte [0x180098ec4]
mov byte [rsp + 0x66], al
jmp case.0x1800699a1.167
lea r9, [rbp - 0x78]
mov dword [rbp - 0x40], 0x6c
lea r8, [rbp - 0x50]
mov edx, 0xe5
xor ecx, ecx
call fcn.1800588e0
mov qword [rbp - 0x30], rax
jmp 0x180069f27
mov rcx, qword [rbp - 0x20]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov edx, 0xd8
call fcn.18001aaa0
mov rsi, rax
jmp 0x180069f27
mov word [rsp + 0x60], r8w
lea rcx, [rsp + 0x61]
mov r8, rdx
lea rdx, [0x18009879c]
call fcn.180071f50
jmp 0x180069f27
mov rax, qword [rbp + 0x740]
lea r8, [rbp + 0x738]
lea rdx, [rsp + 0x70]
mov word [rbp + 0x738], r10w
mov ecx, 0x42
mov rax, qword [rax]
mov qword [rsp + 0x70], rax
call fcn.180018420
mov rcx, qword [rbp - 0x58]
xor r9d, r9d
movsxd r13, eax
xor r8d, r8d
mov edx, 0xd8
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x20], rbx
call fcn.18001aaa0
mov r12, rax
jmp 0x180069f27
mov byte [rsp + 0x66], 0x3f
jmp case.0x1800699a1.167
mov eax, 1
mov qword [rbp - 0x38], rbx
mov word [rsp + 0x30], ax
lea r9, [rsp + 0x30]
mov rax, qword [rbp + 0x740]
xor edx, edx
xor ecx, ecx
mov r8d, 0x88
mov rax, qword [rax]
mov qword [rbp - 0x58], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
call fcn.180051020
mov qword [rbp - 0x58], rax
jmp 0x180069f27
mov rax, qword [rbp + 0x740]
lea r9, [rsp + 0x38]
mov word [rsp + 0x38], dx
xor ecx, ecx
xor edx, edx
mov r8d, 0x88
mov rax, qword [rax]
mov qword [rbp - 0x68], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
call fcn.180051020
mov qword [rbp - 0x68], rax
jmp 0x180069f27
lea rdx, str.open
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x180069b62
lea rdx, str.explore
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x180069b62
lea rdx, [0x180098ee8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x180069b62
test r14, r14
je 0x180069b44
cmp qword [rbp - 0x38], 0
jne 0x180069b62
mov rdx, qword [0x1800b5130]
lea rcx, [rbp - 0x10]
mov r8d, 0xff
mov rdx, qword [rdx]
call fcn.180071f50
jmp 0x180069d43
cmp r13, 0xb
jle 0x180069b87
mov rdx, qword [0x1800b5130]
lea rcx, [rbp - 0x10]
mov r8d, 0xff
mov rdx, qword [rdx + 8]
call fcn.180071f50
jmp 0x180069d43
mov ebx, 0xaa
nop dword [rax]
mov eax, ebx
sub eax, 0xaa
je 0x180069d0d
sub eax, 0x32
je 0x180069ce4
sub eax, 0x32
je 0x180069cb9
sub eax, 0x32
je 0x180069cb3
cmp eax, 0x32
jne 0x180069d34
cmp rdi, 0x20
jg 0x180069d34
lea rax, [rdi - 2]
cmp rax, 0x1e
ja case.0x180069bf2.4
lea rdx, [0x180000000]
movzx eax, byte [rdx + rax + 0x6a070]
mov ecx, dword [rdx + rax*4 + 0x6a040]
add rcx, rdx
jmp rcx
mov rax, qword [0x1800b5130]
mov rdx, qword [rax + 0x10]
jmp 0x180069c94
mov rax, qword [0x1800b5130]
mov rdx, qword [rax + 0x18]
jmp 0x180069c94
mov rax, qword [0x1800b5130]
mov rdx, qword [rax + 0x20]
jmp 0x180069c94
mov rax, qword [0x1800b5130]
mov rdx, qword [rax + 0x28]
jmp 0x180069c94
mov rax, qword [0x1800b5130]
mov rdx, qword [rax + 0x30]
jmp 0x180069c94
mov rax, qword [0x1800b5130]
mov rdx, qword [rax + 0x38]
jmp 0x180069c94
mov rax, qword [0x1800b5130]
mov rdx, qword [rax + 0x40]
jmp 0x180069c94
mov rax, qword [0x1800b5130]
mov rdx, qword [rax + 0x48]
jmp 0x180069c94
mov rax, qword [0x1800b5130]
mov rdx, qword [rax + 0x50]
jmp 0x180069c94
mov rax, qword [0x1800b5130]
mov rdx, qword [rax + 0x58]
jmp 0x180069c94
mov rax, qword [0x1800b5130]
mov rdx, qword [rax + 0x60]
jmp 0x180069c94
mov rax, qword [0x1800b5130]
mov rdx, qword [rax + 0x68]
mov r8d, 0xff
lea rcx, [rbp - 0x10]
call fcn.180071f50
mov ebx, 0x172
mov r15d, 0x9d
jmp 0x180069d34
mov byte [rbp - 0x10], 0
jmp 0x180069d34
mov edx, 6
xor ecx, ecx
call qword [rbp - 0x30]
mov r9, qword [rbp - 0x80]
mov r8, r14
mov rdx, r12
mov dword [rsp + 0x28], r13d
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdi, rax
jmp 0x180069d34
test rsi, rsi
je 0x180069d34
mov rax, rsi
mov r13d, 0x5c
movzx ecx, word [rax]
cmp cx, 0x2f
jne 0x180069d02
mov word [rax], r13w
mov ecx, r13d
add rax, 2
test cx, cx
jne 0x180069cf2
jmp 0x180069d2f
mov rax, r14
mov r13d, 0x5c
movzx ecx, word [rax]
cmp cx, 0x2f
jne 0x180069d26
mov word [rax], r13w
mov ecx, r13d
add rax, 2
test cx, cx
jne 0x180069d16
mov r13, qword [rsp + 0x70]
add ebx, 0x32
cmp ebx, 0x1a4
jb 0x180069b90
lea rcx, [rbp - 0x10]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x180069d50
mov qword [rsp + 0x78], rax
lea r9, [rsp + 0x78]
mov rax, qword [rbp + 0x740]
xor edx, edx
xor r8d, r8d
mov rax, qword [rax]
lea ecx, [rdx + 0x75]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
call fcn.18003c470
jmp 0x180069f27
lea rdx, [r9 + 0x40]
mov dword [rsp + 0x20], 0x123
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call fcn.1800108e0
jmp 0x180069f27
mov rcx, qword [rbp - 0x68]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov edx, 0xd8
call fcn.18001aaa0
mov r14, rax
jmp 0x180069f27
mov rbx, qword [rbp + 0x740]
lea r9, [rsp + 0x40]
xor edx, edx
mov word [rsp + 0x40], r11w
xor ecx, ecx
mov r8d, 0x88
mov rax, qword [rbx]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call fcn.180051020
mov rcx, qword [rbx]
lea r9, [rsp + 0x48]
mov qword [rbp - 0x18], rax
xor edx, edx
mov eax, 4
mov qword [rsp + 0x78], rcx
mov word [rsp + 0x48], ax
xor ecx, ecx
lea rax, [rsp + 0x78]
mov r8d, 0x88
mov qword [rsp + 0x20], rax
call fcn.180051020
mov qword [rbp - 0x20], rax
jmp 0x180069f27
lea rbx, [r9 + 0x20]
mov r8, 0xffffffffffffffff
lea rax, [rsp + 0x60]
inc r8
cmp byte [rax + r8], 0
jne 0x180069e54
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.18004e1a0
mov rax, qword [rbp + 0x740]
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x180069e7f
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
mov rcx, rbx
call fcn.18004de10
mov r9, qword [rbp + 0x728]
mov eax, 0x1bb
mov word [r9 + 0x60], ax
jmp 0x180069f2e
mov r9, qword [rbp - 0x68]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
mov r8d, 0xd4
call fcn.18002de50
mov rcx, qword [rbp - 0x18]
inc eax
cdqe
xor r9d, r9d
xor r8d, r8d
mov qword [rbp - 0x38], rax
mov edx, 0xd8
mov qword [rsp + 0x20], rbx
call fcn.18001aaa0
mov qword [rbp - 0x80], rax
jmp 0x180069f27
mov rdi, rbx
jmp case.0x1800699a1.167
movzx eax, word [0x180098ef4]
mov r8, 0xffffffffffffffff
mov word [rsp + 0x67], ax
movzx eax, byte [0x180098ef6]
mov byte [rsp + 0x69], al
lea rax, [rsp + 0x50]
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180069f10
lea rdx, [rsp + 0x50]
mov rcx, r9
call fcn.18004e1a0
mov r9, qword [rbp + 0x728]
mov edx, 2
lea r8d, [rdx + 0x2d]
lea r10d, [rdx + 3]
lea r11d, [rdx + 1]
dec r15d
lea rcx, [0x180000000]
mov ebx, 0
cmp r15d, dword [rbp - 0x60]
ja 0x180069980
mov rbx, qword [rsp + 0x820]
add rsp, 0x7e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret