Function at 0x18007c18e
Capabilities:
Create process on windows

Disassembly:
xor rax, rsp
mov qword [rsp + 0x930], rax
mov byte [rsp + 0x52], 0
mov edx, 8
lea rcx, [rsp + 0x248]
call fcn.18007d2e0
lea rcx, [rsp + 0x248]
call 0x18009fcad
mov r8d, 0x800
lea rdx, [rsp + 0x510]
xor ecx, ecx
call qword [0x18008d268]
lea rcx, [rsp + 0x510]
call qword [0x18008d540]
lea rdx, [rsp + 0x510]
lea rcx, [rsp + 0x300]
call 0x1800d2f8e
mov edx, 8
lea rcx, [rsp + 0x250]
call fcn.18007d338
xor byte [rcx], dl
add byte [rax], al
lea rdx, [rsp + 0x250]
lea rcx, [0x1800d9780]
call 0x1800fc40c
mov edx, 0x17
lea rcx, [rsp + 0x1c0]
call 0x1800a9112
mov qword [rsp + 0x68], rax
mov edx, 0x16
lea rcx, [rsp + 0x1a0]
call 0x1800a9129
mov rcx, qword [rsp + 0x68]
mov r8, rcx
mov rdx, rax
mov edx, eax
lea rcx, [rsp + 0x180]
call 0x1800a559d
mov rcx, rax
call 0x1800a0ab5
mov rdx, rax
lea rcx, [rsp + 0x300]
call qword [0x18008d568]
lea rcx, [rsp + 0x180]
call 0x1800a0b03
lea rcx, [rsp + 0x1a0]
call 0x1800a0b10
lea rcx, [rsp + 0x1c0]
call 0x1800a0b1d
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x290]
call 0x1800c5082
mov dword [rsp + 0x290], 0x68
mov dword [rsp + 0x2cc], 1
xor eax, eax
mov word [rsp + 0x2d0], ax
lea rcx, [rsp + 0x300]
call qword [0x18008d570]
test eax, eax
je 0x18007c415
mov edx, 8
lea rcx, [rsp + 0x258]
call fcn.18007d42a
lea rcx, [rsp + 0x258]
call 0x18009fdf7
mov edx, 0x82
lea rcx, [rsp + 0x200]
call 0x1800a91fd
mov rcx, rax
call 0x1800a0b71
mov qword [rsp + 0x70], rax
mov edx, 0x85
lea rcx, [rsp + 0x1e0]
call 0x1800a921c
mov rcx, rax
call 0x1800a0b90
mov rcx, qword [rsp + 0x70]
mov r9, rcx
lea r8, [rsp + 0x300]
mov rdx, rax
lea rcx, [rsp + 0x258]
call 0x1800a0900
lea rcx, [rsp + 0x1e0]
call 0x1800a0bed
lea rcx, [rsp + 0x200]
call 0x1800a0bfa
mov edx, 0x400
lea rcx, [rsp + 0x258]
call 0x18009ff9c
lea rcx, [rsp + 0x278]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x290]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov byte [rsp + 0x50], 0
lea rcx, [rsp + 0x258]
call 0x18009fdd1
lea rcx, [rsp + 0x250]
call 0x18009fdde
lea rcx, [rsp + 0x248]
call 0x18009fdeb
movzx eax, byte [rsp + 0x50]
jmp 0x1800f8054
mov edx, 0x15
lea rcx, [rsp + 0x220]
lea ecx, [rsp + 0x220]
call 0x1800a930b
mov rcx, rax
call 0x1800a0c7f
lea rcx, [rsp + 0x240]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf023f
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [0x18008d100]
mov dword [rsp + 0x54], eax
lea rcx, [rsp + 0x220]
call 0x1800a0ce6
cmp dword [rsp + 0x54], 0
jne 0x18007c4ad
mov edx, 0x15
lea rcx, [rsp + 0x80]
call 0x1800a9363
mov rcx, rax
call 0x1800a0cd7
xor r9d, r9d
mov r8d, 0x200
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [0x18008d0f0]
lea rcx, [rsp + 0x80]
call 0x1800a0d2d
mov edx, 0x83
lea rcx, [rsp + 0xe0]
call 0x1800a93a3
mov rcx, rax
call 0x1800a0d17
mov qword [rsp + 0x78], rax
mov edx, 0x2f
lea rcx, [rsp + 0xc0]
call 0x1800a93c2
mov rcx, rax
call 0x1800a0d36
mov qword [rsp + 0x58], rax
mov edx, 0x84
lea rcx, [rsp + 0xa0]
call 0x1800a93e1
mov rcx, rax
call 0x1800a0d55
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x58]
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0x248]
call 0x1800a0acf
lea rcx, [rsp + 0xa0]
call 0x1800a0dbc
lea rcx, [rsp + 0xc0]
call 0x1800a0dc9
add al, byte [rax]
lea rcx, [rsp + 0xe0]
call 0x1800a0dd6
lea rcx, [rsp + 0x248]