Function at 0x180001340
Capabilities:
Create process on windows

Disassembly:
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x18000c040]
xor rax, rsp
mov qword [rbp + 0xb0], rax
xorps xmm0, xmm0
xor eax, eax
xor edx, edx
mov qword [rbp + 0x40], rax
cmp qword [rcx + 0x18], 7
movups xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x20], 0x68
movups xmmword [rbp + 0x10], xmm0
mov dword [rbp + 0x1c], 1
movups xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x20], dx
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x30], rax
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp - 0x40], xmm0
jbe 0x1800013a9
mov rcx, qword [rcx]
lea rax, [rbp - 0x40]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], edx
mov rdx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x180001413
mov rcx, qword [rbp - 0x40]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1800016b2
movabs r9, 0xdfe423052970b2cc
movabs rax, 0xd47936099058d885
mov qword [rsp + 0x50], rax
movabs r8, 0xd41d370c911ad8c7
mov rax, qword [rsp + 0x50]
movabs rdx, 0x1648d9c4f60b418f
mov qword [rsp + 0x60], rax
movabs rcx, 0xe9a7c9dd194e5c74
mov qword [rsp + 0x50], r9
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], r8
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], r9
mov qword [rbp + 0x50], rax
mov rax, qword [rsp + 0x50]
movdqa xmm0, xmmword [rsp + 0x60]
mov qword [rbp + 0x58], rax
movabs rax, 0xd43d37699173d889
xorps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
movabs rax, 0xdea623642914b2b9
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x78], rax
movabs rax, 0x1092c6615819e5ee
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x80], rax
movabs rax, 0xcbe1cd3609285627
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x78], rax
movabs rax, 0xdedb0038f9028aae
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x70], rax
movabs rax, 0x3dedd40eae32727d
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x68], rax
movabs rax, 0xe906bc999fa8bae5
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x60], rax
movabs rax, 0xfab761721eaa1bb7
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x50], rdx
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x50], rcx
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x50], r8
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0x60], rax
mov qword [rsp + 0x50], r9
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0x68], rax
movabs rax, 0x10fbc6125839e581
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0x70], rax
movabs rax, 0xcb93cd430908573e
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0x78], rax
movabs rax, 0xdeb40050f9618adb
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0x80], rax
movabs rax, 0x3dcdd509ae5b7210
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0x88], rax
movabs rax, 0xe965bcf69fdaba95
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x60]
mov rax, qword [rsp + 0x50]
mov r9d, 0x10
mov qword [rbp + 0x90], rax
movabs rax, 0xfa9961071ed91bd2
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], rdx
lea rdx, [rsp + 0x70]
mov qword [rbp + 0x98], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], rcx
xor ecx, ecx
mov qword [rbp + 0xa0], rax
mov rax, qword [rsp + 0x50]
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x60]
movdqa xmm1, xmmword [rbp - 0x80]
xorps xmm1, xmmword [rbp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm0, xmmword [rbp - 0x70]
xorps xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm1, xmmword [rbp - 0x60]
xorps xmm1, xmmword [rbp + 0x90]
mov qword [rbp + 0xa8], rax
xorps xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmmword [rbp - 0x60], xmm1
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.180006d30
add rsp, 0x1c0
pop rbp
ret