Function at 0x18006c570
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x2f0
mov rax, qword [0x18018c280]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
xor esi, esi
mov r14d, esi
mov dword [rsp + 0x50], esi
xorps xmm0, xmm0
mov dword [rsp + 0x190], 0x4ff4a1e0
mov dword [rsp + 0x194], 0xe387f610
mov dword [rsp + 0x198], 0x1ee3a5eb
mov dword [rsp + 0x19c], 0xaf666b8e
mov dword [rsp + 0x1a0], 0x41904f75
mov dword [rsp + 0x1a4], 0xae8bcc70
mov dword [rsp + 0x1a8], 0x568f84ce
mov dword [rsp + 0x1ac], 0xe9b92680
mov dword [rsp + 0x1b0], 0xed5809bc
mov dword [rsp + 0x1b4], 0xd265d73d
mov dword [rsp + 0x1b8], 0x239c5d65
mov dword [rsp + 0x1bc], 0x447ef946
mov dword [rsp + 0x1c0], 0x84752ea0
mov dword [rsp + 0x1c4], 0x7a713ee7
mov dword [rsp + 0x1c8], 0x17f56ccc
mov dword [rsp + 0x1cc], 0xfa61c88d
mov dword [rsp + 0x1d0], 0xcf56e5d6
mov dword [rsp + 0x1d4], 0x534981e5
mov dword [rsp + 0x1d8], 0x1695c027
mov dword [rsp + 0x1dc], 0x713bc49e
movdqu xmmword [rsp + 0x218], xmm0
mov qword [rsp + 0x228], rsi
mov edx, 0x50
lea rcx, [rsp + 0x218]
call fcn.180044a50
mov rbx, qword [rsp + 0x218]
mov r8d, 0x50
lea rdx, [rsp + 0x190]
mov rcx, rbx
call fcn.1800c7450
lea rax, [rbx + 0x50]
mov qword [rsp + 0x220], rax
xorps xmm0, xmm0
mov dword [rsp + 0x60], 0xd676bdab
mov dword [rsp + 0x64], 0xb0161cf4
mov dword [rsp + 0x68], 0xa3b40e0c
mov dword [rsp + 0x6c], 0x2773853d
mov dword [rsp + 0x70], 0x2a857440
mov dword [rsp + 0x74], 0x412460fe
mov dword [rsp + 0x78], 0x9d04ade7
mov dword [rsp + 0x7c], 0x456276fd
mov dword [rsp + 0x80], 0x9ac37582
mov dword [rsp + 0x84], 0x2abb15f9
mov dword [rsp + 0x88], 0x35318c6e
mov dword [rsp + 0x8c], 0xcd6c3a95
mov dword [rsp + 0x90], 0x7ed86e62
mov dword [rsp + 0x94], 0x4fdf96db
mov dword [rsp + 0x98], 0x698bccd6
mov dword [rsp + 0x9c], 0xf6e59daf
mov dword [rsp + 0xa0], 0xa4b6a4be
mov dword [rsp + 0xa4], 0x78828282
mov dword [rsp + 0xa8], 0xb94d0bd9
mov dword [rsp + 0xac], 0x426c9ceb
movdqu xmmword [rsp + 0x200], xmm0
mov qword [rsp + 0x210], rsi
mov edx, 0x50
lea rcx, [rsp + 0x200]
call fcn.180044a50
mov rbx, qword [rsp + 0x200]
mov r8d, 0x50
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1800c7450
lea rax, [rbx + 0x50]
mov qword [rsp + 0x208], rax
lea rdx, [rsp + 0x218]
lea rcx, [rsp + 0x170]
call fcn.180028b60
nop
mov rdx, rax
lea rcx, [rsp + 0x2a0]
call fcn.18005d160
nop
mov rcx, qword [rsp + 0x170]
test rcx, rcx
je 0x18006c866
mov rdx, qword [rsp + 0x180]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006c84d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006cf9f
call fcn.1800918d0
mov qword [rsp + 0x170], rsi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x178], xmm0
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0xd0]
call fcn.180028b60
nop
mov rdx, rax
lea rcx, [rsp + 0x2c0]
call fcn.18005d160
nop
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x18006c8d0
mov rdx, qword [rsp + 0xe0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006c8ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006cfa5
call fcn.1800918d0
nop
lea rdi, [rsp + 0x2a0]
lea r15, [rsp + 0x2e0]
mov qword [rsp + 0xb8], r15
lea r12, str..exe
movabs rbx, 0xc000000000000010
movabs r13, 0xc000000000000000
mov qword [rsp + 0xb0], rdi
cmp rdi, r15
je 0x18006cc01
lea rcx, [rsp + 0x130]
call fcn.1800054f0
mov rdx, rax
mov qword [rsp + 0x120], r12
mov qword [rsp + 0x128], 9
lea rcx, [0x1801937e0]
cmp qword [0x1801937f8], 7
cmova rcx, qword [0x1801937e0]
mov qword [rsp + 0xf0], rcx
mov rax, qword [0x1801937f0]
mov qword [rsp + 0xf8], rax
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rsp + 0x1a0], xmm0
mov qword [rsp + 0x190], r13
mov rcx, rdx
cmp qword [rdx + 0x18], 7
jbe 0x18006c98b
mov rcx, qword [rdx]
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x100], rcx
mov qword [rsp + 0x108], rax
movups xmm0, xmmword [rsp + 0x100]
movups xmmword [rsp + 0x1b0], xmm0
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x110], 2
lea rax, [rsp + 0x190]
mov qword [rsp + 0x118], rax
movaps xmm0, xmmword [rsp + 0x110]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x120]
movdqa xmmword [rsp + 0x170], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x1e0]
call fcn.18000d210
or r14d, 1
mov dword [rsp + 0x50], r14d
mov rdx, qword [rsp + 0x148]
cmp rdx, 7
jbe 0x18006ca63
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006ca5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006cfab
call fcn.1800918d0
mov qword [rsp + 0x140], rsi
mov qword [rsp + 0x148], 7
mov word [rsp + 0x130], si
lea r8, [rsp + 0x1e0]
mov rdx, rdi
lea rcx, [rsp + 0x190]
call fcn.18002a3e0
cmp byte [rsp + 0x1b0], 0
je 0x18006cc6b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x234], xmm0
movups xmmword [rsp + 0x244], xmm0
movups xmmword [rsp + 0x254], xmm0
movups xmmword [rsp + 0x264], xmm0
movups xmmword [rsp + 0x274], xmm0
movups xmmword [rsp + 0x284], xmm0
mov dword [rsp + 0x294], eax
movups xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], rax
mov dword [rsp + 0x230], Ordinal_106
lea rcx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 7
cmova rcx, qword [rsp + 0x1e0]
lea rax, [rsp + 0x170]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x230]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x18006cc6b
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 0xf
jbe 0x18006cbb8
inc rdx
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006cbb2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006cfb1
call fcn.1800918d0
nop
mov rdx, qword [rsp + 0x1f8]
cmp rdx, 7
jbe 0x18006cc01
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006cbfb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006d005
call fcn.1800918d0
nop
lea r9, [fcn.1800067f0]
mov edx, Ordinal_34
mov r8d, 2
lea rcx, [rsp + 0x2a0]
call fcn.180091cd4
nop
mov rcx, qword [rsp + 0x200]
test rcx, rcx
je 0x18006cf2b
mov rdx, qword [rsp + 0x210]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006cf12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006cfb7
jmp 0x18006cf12
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 0xf
jbe 0x18006ccaf
inc rdx
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006cca9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006cfbd
call fcn.1800918d0
nop
lea rdx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 7
cmova rdx, qword [rsp + 0x1e0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x190], xmm0
mov qword [rsp + 0x1a0], rsi
mov qword [rsp + 0x1a8], rsi
mov r8, qword [rsp + 0x1f0]
lea rcx, [rsp + 0x190]
call fcn.18000acf0
or r14d, 6
mov dword [rsp + 0x50], r14d
mov r8d, 3
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x160]
call fcn.180021d60
movsd xmm0, qword [rax]
movsd qword [rsp + 0x150], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0xd0], ecx
lea rax, [0x18018d290]
mov qword [rsp + 0xd8], rax
movaps xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0x170], xmm0
mov eax, dword [rsp + 0x150]
test eax, eax
je 0x18006cdaa
cmp eax, 1
setne bl
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 7
jbe 0x18006cdbb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006cdb6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006cfc3
jmp 0x18006cdb6
xor bl, bl
test ecx, ecx
jne 0x18006cfc9
jmp 0x18006cd65
call fcn.1800918d0
test bl, bl
je 0x18006ce8d
lea rdx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 7
cmova rdx, qword [rsp + 0x1e0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x188], rsi
mov r8, qword [rsp + 0x1f0]
lea rcx, [rsp + 0x170]
call fcn.18000acf0
or r14d, 0x18
mov dword [rsp + 0x50], r14d
lea rcx, [rsp + 0x170]
cmp qword [rsp + 0x188], 7
cmova rcx, qword [rsp + 0x170]
call fcn.18009059c
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x18006cfe6
mov rdx, qword [rsp + 0x188]
cmp rdx, 7
jbe 0x18006ce8d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006ce87
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006cfff
call fcn.1800918d0
nop
jmp 0x18006ceb7
movabs rbx, 0xc000000000000010
mov rdx, qword [rsp + 0x1f8]
cmp rdx, 7
jbe 0x18006cf09
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006cf04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006d005
call fcn.1800918d0
add rdi, 0x20
jmp 0x18006c903
call fcn.1800918d0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x200], xmm0
mov qword [rsp + 0x210], rsi
mov rcx, qword [rsp + 0x218]
test rcx, rcx
je 0x18006cf6d
mov rdx, qword [rsp + 0x228]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006cf68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006d00b
call fcn.1800918d0
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.1800918b0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.1800a6d18
nop
call fcn.1800a6d18
nop
call fcn.1800a6d18
int3
call fcn.1800a6d18
nop
call fcn.1800a6d18
nop
call fcn.1800a6d18
nop
call fcn.1800a6d18
nop
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0x170]
lea rcx, [0x1801050d0]
call fcn.1800212d0
nop
shr rdx, 0x20
lea r8, [rsp + 0x170]
lea rcx, str.remove
call fcn.18002bf00
nop
call fcn.1800a6d18
nop
call fcn.1800a6d18
nop
call fcn.1800a6d18
int3