Function at 0x180002de0
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x2c0]
sub rsp, 0x3c0
mov rax, qword [0x1803d3080]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
xor r15d, r15d
mov dword [rbp - 0x70], r15d
call fcn.18000fb90
lea rcx, str.NeacSafe.sys
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], 0xc
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.180001e00
mov dword [rbp - 0x70], 3
lea rcx, [rbp + 0x120]
call fcn.180002c60
nop
lea r8, [rsp + 0x50]
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.180002350
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 7
jbe 0x180002ebd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002eb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180002eb8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180010590
movdqa xmm0, xmmword [0x1803ce2a0]
movdqu xmmword [rbp + 0x130], xmm0
mov word [rbp + 0x120], r15w
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x180002f1a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002f15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180002f15
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180010590
movdqa xmm0, xmmword [0x1803ce2a0]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r15w
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 7
cmova rdx, qword [rbp + 0x100]
lea rcx, [rbp - 0x30]
call fcn.18000f3b0
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x30], rax
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x34], edx
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x30]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
je 0x1800030b1
lea rdx, [0x180013920]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.18000e0c0
mov rbx, rax
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 7
cmova rcx, qword [rbp + 0x100]
mov qword [rsp + 0x70], rcx
mov rcx, qword [rbp + 0x110]
mov qword [rsp + 0x78], rcx
call fcn.18000fb90
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.18000de00
nop
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rax, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x78], rax
mov word [rbp - 0x80], 0x5c22
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.18000f710
mov rbx, rax
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x180003078
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003073
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180003073
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180010590
movdqa xmm0, xmmword [0x1803ce2b0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
lea rdx, [0x180013910]
mov rcx, rbx
call fcn.18000e0c0
lea rdx, [0x18000e290]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
jmp 0x1800037f4
mov r8d, 0x3b9000
lea rdx, [0x180015140]
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp - 0x28]
call fcn.18000d690
test rax, rax
jne 0x1800030f2
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x30]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
mov dword [rsp + 0x70], 0x6361654e
mov dword [rsp + 0x74], 0x65666153
mov dword [rsp + 0x78], 0x78652e61
mov byte [rsp + 0x7c], 0x65
mov ecx, 0xd
call fcn.1800101e4
mov rdi, rax
mov qword [rbp + 0x120], rax
lea rsi, [rax + 0xd]
mov qword [rbp + 0x130], rsi
mov r8d, 0xd
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x128], rsi
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r15
mov r14d, 7
mov qword [rbp + 0xf8], r14
cmp rdi, rsi
jne 0x180003182
mov word [rbp + 0xe0], r15w
jmp 0x180003200
mov rbx, rsi
sub rbx, rdi
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
ja 0x180003895
cmp rbx, r14
jbe 0x1800031c4
mov ecx, 0x10
add rcx, rcx
call fcn.1800101e4
mov r9, rax
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xf8], 0xf
jmp 0x1800031cb
lea r9, [rbp + 0xe0]
mov rcx, r9
mov r8, rbx
mov rdx, rdi
test rbx, rbx
je 0x1800031f4
nop dword [rax]
movzx eax, byte [rdx]
mov word [rcx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 1]
sub r8, 1
jne 0x1800031e0
mov qword [rbp + 0xf0], rbx
mov word [r9 + 0x1a], r15w
lea rdx, [rbp + 0xe0]
lea rcx, [rbp - 0x68]
call fcn.18000f5b0
nop
lea rcx, [rsp + 0x70]
call fcn.180002c60
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.18000d0c0
mov dword [rbp - 0x70], 0x23
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x50]
call fcn.180002070
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 7
cmova rcx, qword [rbp + 0x100]
call fcn.18000fe2c
test eax, eax
jne 0x180003881
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x1800032b8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800032b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800032b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180010590
movdqa xmm0, xmmword [0x1803ce2a0]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r15w
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x180003310
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000330b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000330b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180010590
movdqa xmm0, xmmword [0x1803ce2a0]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], r15w
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x180003366
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003361
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180003361
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180010590
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x140]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x180014ef8]
mov qword [rbp + 0x140], rax
lea rax, [0x180015078]
mov qword [rbp + 0x150], rax
lea rcx, [rbp + 0x1d8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
mov dword [rbp - 0x70], 0x43
xor r8d, r8d
lea rdx, [rbp + 0x158]
lea rcx, [rbp + 0x140]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__::constructor_class_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t______ptr64____ptr64]
nop
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
lea r12, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x140], r12
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x13c], edx
lea rcx, [rbp + 0x158]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + 0x158], rax
mov qword [rbp + 0x1c0], r15
mov dword [rbp + 0x1c8], r15d
lea rdx, [0x180013930]
lea rcx, [rbp + 0x150]
call fcn.18000e2d0
mov rbx, rax
lea rcx, [rbp - 0x68]
call fcn.180002c60
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.18000d0c0
nop
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rcx, rbx
call fcn.18000f9a0
lea rdx, [0x1800138e4]
mov rcx, rax
call fcn.18000e2d0
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 7
cmova rdx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
mov rcx, rax
call fcn.18000f9a0
mov rcx, rax
lea rdx, [0x180013930]
call fcn.18000e2d0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x1800034f4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800034ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800034ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180010590
movdqa xmm0, xmmword [0x1803ce2a0]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r15w
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x18000354b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003546
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180003546
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180010590
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x244], xmm0
movups xmmword [rbp + 0x254], xmm0
movups xmmword [rbp + 0x264], xmm0
movups xmmword [rbp + 0x274], xmm0
movups xmmword [rbp + 0x284], xmm0
movups xmmword [rbp + 0x294], xmm0
mov dword [rbp + 0x2a4], eax
mov dword [rbp + 0x240], 0x68
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rax
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r14
mov word [rsp + 0x50], r15w
mov dword [rbp - 0x70], 0x2c3
movups xmmword [rsp + 0x70], xmm0
mov rcx, r15
mov r8d, dword [rbp + 0x1c8]
mov eax, r8d
and al, 0x22
cmp al, 2
je 0x1800035f9
mov rax, qword [rbp + 0x198]
mov rdx, qword [rax]
test rdx, rdx
je 0x1800035f9
mov rax, qword [rbp + 0x178]
mov r9, qword [rax]
cmp rdx, qword [rbp + 0x1c0]
cmovb rdx, qword [rbp + 0x1c0]
sub rdx, r9
sar rdx, 1
mov rcx, r9
jmp 0x180003639
test r8b, 4
jne 0x18000366b
mov rax, qword [rbp + 0x190]
mov r8, qword [rax]
mov rdx, r15
test r8, r8
je 0x180003634
mov rax, qword [rbp + 0x170]
mov r9, qword [rax]
mov rax, qword [rbp + 0x1a8]
movsxd rcx, dword [rax]
lea rdx, [r8 + rcx*2]
sub rdx, r9
sar rdx, 1
mov rcx, r9
jmp 0x180003639
mov r9, qword [rsp + 0x70]
test rcx, rcx
je 0x18000366b
lea rcx, [rsp + 0x50]
cmp rdx, 7
ja 0x180003665
mov qword [rsp + 0x60], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rsp + rbx + 0x50], r15w
jmp 0x18000366b
call fcn.18000e770
nop
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x240]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x1800036f8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800036f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800036f3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180010590
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x140], r12
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x13c], edx
lea rcx, [rbp + 0x158]
call fcn.18000bfb0
lea rcx, [rbp + 0x160]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0x1d8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 7
jbe 0x1800037a9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800037a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800037a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180010590
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], r14
mov word [rbp + 0xe0], r15w
test rdi, rdi
je 0x1800037f4
sub rsi, rdi
cmp rsi, 0x1000
jb 0x1800037e8
add rsi, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x180003842
mov rdi, rcx
mov rdx, rsi
mov rcx, rdi
call fcn.180010590
nop
lea rcx, [rbp - 0x30]
call fcn.1800038a0
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 7
jbe 0x18000384e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003849
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180003849
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.180010590
movzx eax, bl
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.1800100e0
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x100]
mov edx, eax
call fcn.180002b80
nop
call fcn.1800011e0
int3