Function at 0x1800d1e10
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xe8]
sub rsp, 0x1c0
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1802240e0]
xor rax, rsp
mov qword [rbp + 0xb0], rax
xor r13d, r13d
mov dword [rsp + 0x30], r13d
xor r15b, r15b
call fcn.1800d1d10
test rax, rax
je 0x1800d1e77
xor r9d, r9d
xor r8d, r8d
lea edx, [r13 + 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
lea rax, [rsp + 0x38]
mov qword [rbp - 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rbp - 0x38], rax
lea rax, [rsp + 0x78]
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x68]
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], r13w
mov r8d, 7
lea rdx, str.Version
lea rcx, [rsp + 0x38]
call fcn.1800055c0
nop
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r13w
mov r8d, 7
lea rdx, str.Upgrade
lea rcx, [rsp + 0x58]
call fcn.1800055c0
nop
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r13w
mov r8d, 0xa
lea rdx, str.config.ini
lea rcx, [rsp + 0x78]
call fcn.1800055c0
nop
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r13w
mov r8d, 7
lea rdx, str.2345Pic
lea rcx, [rbp - 0x68]
call fcn.1800055c0
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x78]
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x70]
call fcn.1800e2740
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x1801c14e0]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], r13w
mov dword [rsp + 0x30], 1
lea r12, str.2345Pic_SetDefault
mov rsi, 0xffffffffffffffff
mov rcx, rsi
nop dword [rax]
inc rcx
cmp word [r12 + rcx*2], 0
jne 0x1800d1fa0
mov rdx, qword [rbp + 0x80]
add rdx, rcx
lea rcx, [rbp + 0x50]
call fcn.180009580
lea r9, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r9, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x80]
mov r14, qword [rbp + 0x60]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
sub rax, r14
cmp rdi, rax
ja 0x1800d2019
lea rax, [r14 + rdi]
mov qword [rbp + 0x60], rax
lea rbx, [rbp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rbp + 0x50]
lea r8, [rdi + rdi]
lea rcx, [rbx + r14*2]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r13w
jmp 0x1800d2030
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp + 0x50]
call fcn.1800093d0
nop word [rax + rax]
inc rsi
cmp word [r12 + rsi*2], 0
jne 0x1800d2030
mov rcx, qword [rbp + 0x60]
mov r8, qword [rbp + 0x68]
mov rax, r8
sub rax, rcx
cmp rsi, rax
ja 0x1800d207a
lea rdi, [rcx + rsi]
mov qword [rbp + 0x60], rdi
lea rbx, [rbp + 0x50]
cmp r8, 8
cmovae rbx, qword [rbp + 0x50]
lea r8, [rsi + rsi]
lea rcx, [rbx + rcx*2]
mov rdx, r12
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r13w
jmp 0x1800d208e
mov qword [rsp + 0x20], rsi
mov r9, r12
mov rdx, rsi
lea rcx, [rbp + 0x50]
call fcn.1800093d0
lea r8, str..pdf
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x90]
call fcn.180009240
nop
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x30], eax
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x1800d20f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800d20f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800d20f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18017df04
movdqa xmm0, xmmword [0x1801c14e0]
movdqu xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], r13w
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x20], WSAStartup
lea rax, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rax, qword [rbp + 0x90]
mov qword [rbp - 8], rax
mov qword [rbp - 0x18], r13
mov dword [rbp + 0x10], 5
mov dword [rbp - 0x1c], 0x44c
lea rax, str.properties
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1800d216c
cmp qword [rbp + 0x18], 0x20
seta r15b
mov ebx, r13d
nop
call fcn.1800d1d10
mov rdi, rax
test rax, rax
jne 0x1800d218d
inc ebx
cmp ebx, 0xffff
je 0x1800d2245
jmp 0x1800d2170
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 5
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindow]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
mov rdi, rax
mov ebx, r13d
nop word [rax + rax]
mov edx, 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindow]
mov rdi, rax
cmp ebx, 8
je 0x1800d21df
inc ebx
cmp ebx, 9
jl 0x1800d21c0
jmp 0x1800d2245
lea rdx, [rbp + 0x50]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp + 0x58]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [rbp + 0x5c]
cdq
sub eax, edx
sar eax, 1
movzx ebx, ax
shl rbx, 0x10
movzx eax, cx
or rbx, rax
mov r9, rbx
mov edx, 0x201
mov r8d, 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov r9, rbx
mov edx, 0x202
mov r8d, 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x1800d228e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800d2289
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800d2289
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18017df04
movdqa xmm0, xmmword [0x1801c14e0]
movdqu xmmword [rbp + 0xa0], xmm0
mov word [rbp + 0x90], r13w
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x1800d22ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800d22e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800d22e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18017df04
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], r13w
movzx eax, r15b
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.18017dee0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret