Function at 0x180001240
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x18000a040]
xor rax, rsp
mov qword [rbp + 0x340], rax
xor r15d, r15d
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r15
mov r14, rcx
mov qword [rsp + 0x70], r15
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rcx + rbx], r15b
jne 0x180001290
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x180001535
mov qword [rsp + 0x478], rsi
mov qword [rsp + 0x70], 0xf
cmp rbx, 0xf
ja 0x1800012e2
mov r8, rbx
mov qword [rsp + 0x68], rbx
mov rdx, r14
lea rcx, [rsp + 0x58]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x58], r15b
jmp 0x180001379
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x18000131b
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.180004274
test rax, rax
je 0x180001457
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x180001358
mov ecx, 0x16
mov rdi, rax
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x180001346
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000153b
jmp 0x1800012fc
test rcx, rcx
je 0x180001355
call fcn.180004274
mov rsi, rax
jmp 0x180001358
mov rsi, r15
mov r8, rbx
mov qword [rsp + 0x58], rsi
mov rdx, r14
mov qword [rsp + 0x68], rbx
mov rcx, rsi
mov qword [rsp + 0x70], rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], r15b
xor edx, edx
mov edi, r15d
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000141a
lea rdx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18000141a
nop dword [rax]
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], r15
lea r8, [rbp + 0x1c]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp qword [rsp + 0x70], 0xf
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x230]
cmova rdx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x180001417
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800013b0
jmp 0x18000141a
mov edi, dword [rbp - 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x180001463
mov rcx, qword [rsp + 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000145e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000145e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180004240
test edi, edi
je 0x18000146e
mov eax, edi
jmp 0x180001505
xorps xmm0, xmm0
mov dword [rbp - 0x80], 0x68
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, str.C:Program_Files__x86_AssaultCube_assaultcube.bat
lea rax, [rbp - 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
lea rax, str.C:Program_Files__x86_AssaultCube_
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x180001503
mov rcx, qword [rsp + 0x58]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x68]
jmp 0x180001505
xor eax, eax
mov rsi, qword [rsp + 0x478]
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.180004220
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.180001220
int3
call fcn.180001180
int3