Function at 0x18000a120
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xb8
mov qword [rbp - 0x69], 0xfffffffffffffffe
mov rax, qword [0x180064138]
xor rax, rsp
mov qword [rbp - 1], rax
mov r14, r9
mov rsi, r8
mov r13, rdx
mov r12, rcx
mov rax, qword [rbp + 0x77]
mov qword [rbp - 0x71], rax
mov eax, dword [rbp + 0x7f]
mov dword [rbp - 0x75], eax
xor r15d, r15d
mov ebx, r15d
mov dword [rbp - 0x79], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x18000a386
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x18000a386
mov rcx, rsi
call fcn.18001cf20
test eax, eax
jne 0x18000a1a9
lea eax, [r15 + 1]
jmp 0x18000a393
test r12, r12
je 0x18000a257
mov rdi, 0xffffffffffffffff
movdqa xmm0, xmmword [0x180047150]
test r14, r14
je 0x18000a1f4
movdqu xmmword [rbp - 0x11], xmm0
mov word [rbp - 0x21], r15w
mov r8, rdi
inc r8
cmp word [r14 + r8*2], bx
jne 0x18000a1d3
mov rdx, r14
lea rcx, [rbp - 0x21]
call fcn.1800083e0
lea r15, [rbp - 0x21]
mov ebx, 1
jmp 0x18000a207
movdqu xmmword [rbp - 0x31], xmm0
mov word [rbp - 0x41], r15w
lea r15, [rbp - 0x41]
mov ebx, 2
mov dword [rbp - 0x79], ebx
movdqa xmm0, xmmword [0x180047150]
movdqu xmmword [rbp - 0x51], xmm0
xor eax, eax
mov word [rbp - 0x61], ax
nop dword [rax]
inc rdi
cmp word [rsi + rdi*2], ax
jne 0x18000a220
mov r8, rdi
mov rdx, rsi
lea rcx, [rbp - 0x61]
call fcn.1800083e0
nop
or ebx, 4
mov dword [rbp - 0x79], ebx
mov r8, r15
lea rdx, [rbp - 0x61]
mov rcx, r12
call fcn.180018c70
test eax, eax
je 0x18000a257
mov dil, 1
jmp 0x18000a25a
xor dil, dil
test bl, 4
je 0x18000a2b9
and ebx, 0xfffffffb
mov rdx, qword [rbp - 0x49]
cmp rdx, 8
jb 0x18000a2a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a29d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000a3b9
call fcn.18001dbb8
movdqa xmm0, xmmword [0x180047150]
movdqu xmmword [rbp - 0x51], xmm0
xor r15d, r15d
mov word [rbp - 0x61], r15w
jmp 0x18000a2bc
xor r15d, r15d
test bl, 2
je 0x18000a316
and ebx, 0xfffffffd
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x18000a304
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a2ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000a3bf
call fcn.18001dbb8
movdqa xmm0, xmmword [0x180047150]
movdqu xmmword [rbp - 0x31], xmm0
mov word [rbp - 0x41], r15w
test bl, 1
je 0x18000a357
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x18000a357
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a352
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000a3b3
call fcn.18001dbb8
test dil, dil
je 0x18000a363
mov eax, 0x7fffffff
jmp 0x18000a393
mov eax, dword [rbp - 0x75]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp - 0x71]
mov qword [rsp + 0x20], rax
mov r9, r14
mov r8, rsi
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x18000a393
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.18001e0c0
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.180029c54
nop
call fcn.180029c54
nop
call fcn.180029c54
int3