Function at 0x180008f68
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
xor ebx, ebx
mov r14, r8
mov qword [rbp + 0x1d8], rbx
mov rdi, rdx
mov rsi, rcx
cmp rdx, 8
ja 0x180009271
cmp rdx, 8
je 0x18000924d
test rdx, rdx
je 0x18000948d
cmp rdx, 2
jbe 0x1800090e9
cmp rdx, 3
je 0x180009038
cmp rdx, 4
je 0x180008ffd
cmp rdx, 6
je 0x180008fed
cmp rdx, 7
jne 0x18000948d
mov eax, 0xdeadc0de
mov qword [rbp + 0x1d8], rax
jmp 0x18000948d
xor edx, edx
mov rcx, r14
call qword [sym.imp.USER32.dll_ActivateKeyboardLayout]
jmp 0x18000948d
mov rcx, qword [0x180035760]
cmp qword [rcx + 0x730], rbx
je 0x18000948d
mov rdx, rsi
call fcn.1800094b0
mov rcx, qword [0x180035760]
mov rdx, rsi
mov qword [rbp + 0x1d8], 0xdead
call fcn.180009814
jmp 0x18000948d
mov rcx, qword [0x180035730]
add rcx, 0xc
call qword [sym.imp.USER32.dll_SetKeyboardState]
mov rax, qword [0x180035730]
movzx ecx, byte [rax + 0x1d]
shr ecx, 7
test byte [rax + 0x1e], 0x80
je 0x1800090b4
test ecx, ecx
jne 0x180009080
cmp byte [rax + 0x7f], bl
jge 0x18000948d
lea edx, [rcx + 2]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetAncestor]
mov rcx, rax
mov edx, 0x10
jmp 0x1800090d8
cmp byte [rax + 0x3a], bl
jge 0x18000948d
mov dword [rsp + 0x28], 1
lea r8, str.taskmgr
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x18000948d
test ecx, ecx
je 0x18000948d
cmp byte [rax + 0x27], bl
jge 0x18000948d
mov rcx, qword [0x180035760]
mov edx, 0x201
mov rcx, qword [rcx + 0xe8]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_PostMessageA]
jmp 0x18000948d
call qword [sym.imp.USER32.dll_GetMenu]
mov r14, rax
test rax, rax
je 0x18000948d
mov rcx, rax
or r13d, 0xffffffff
call qword [sym.imp.USER32.dll_GetMenuItemCount]
mov r12d, eax
mov r15d, ebx
test eax, eax
jle 0x180009148
mov r8d, 0x400
mov edx, r15d
mov rcx, r14
call qword [sym.imp.USER32.dll_GetMenuState]
test al, al
jns 0x180009140
mov r9d, 0x400
mov r8d, r15d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.USER32.dll_HiliteMenuItem]
mov r13d, r15d
inc r15d
cmp r15d, r12d
jl 0x180009112
mov r8, qword [0x180035730]
mov rdx, r14
mov rcx, rsi
mov r8, qword [r8 + 4]
call qword [sym.imp.USER32.dll_MenuItemFromPoint]
mov r15d, eax
cmp eax, 0xffffffff
je 0x18000948d
mov r8d, 0x400
mov edx, eax
mov rcx, r14
call qword [sym.imp.USER32.dll_GetMenuState]
mov r12d, eax
cmp r13d, r15d
je 0x18000918a
call qword [sym.imp.USER32.dll_EndMenu]
mov r9d, 0x480
mov r8d, r15d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.USER32.dll_HiliteMenuItem]
cmp rdi, 2
je 0x18000948d
test r12b, 3
jne 0x18000948d
test r12b, 0x10
je 0x180009214
mov edx, r15d
mov rcx, r14
call qword [sym.imp.USER32.dll_GetSubMenu]
mov rdi, rax
test rax, rax
je 0x18000948d
lea r9, [rsp + 0x48]
mov r8d, r15d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetMenuItemRect]
test eax, eax
je 0x18000948d
mov r9d, dword [rsp + 0x54]
mov edx, 0x4000
mov r8d, dword [rsp + 0x48]
mov rcx, rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x18000948d
bt r12d, 0xb
jb 0x180009232
mov edx, r15d
mov rcx, r14
call qword [sym.imp.USER32.dll_GetMenuItemID]
mov ebx, eax
cmp eax, 0xffffffff
je 0x18000948d
movzx r8d, bx
lea rax, [rbp + 0x1c8]
xor r9d, r9d
mov edx, 0x111
mov rcx, rsi
jmp 0x180009472
mov rcx, qword [0x180035760]
mov r9d, 5
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x18000948d
cmp rdi, 9
je 0x180009444
jbe 0x18000948d
cmp rdi, 0xb
jbe 0x1800092fc
cmp rdi, 0xc
je 0x1800092b0
cmp rdi, 0xe
jne 0x18000948d
call fcn.180009794
test eax, eax
je 0x18000948d
mov qword [rbp + 0x1d8], rsi
jmp 0x18000948d
xor edx, edx
call qword [sym.imp.USER32.dll_GetSystemMenu]
mov qword [rsp + 0x30], rbx
mov rcx, r14
shr rcx, 0x10
mov edx, 0x100
movsx r9d, cx
mov rcx, rax
movsx r8d, r14w
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_TrackPopupMenu]
movsxd r8, eax
xor r9d, r9d
mov edx, 0x112
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageA]
jmp 0x18000948d
movsx eax, r14w
lea r9, [rbp + 0x1c8]
mov dword [rbp + 0x1c8], eax
xor r8d, r8d
shr r14, 0x10
mov edx, 0x445
movsx eax, r14w
mov dword [rbp + 0x1cc], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x3e8
mov dword [rsp + 0x20], 2
mov qword [rsp + 0x40], rbx
call qword [sym.imp.USER32.dll_SendMessageTimeoutA]
test rax, rax
je 0x18000948d
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x18000948d
xor eax, eax
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x5c], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x64], rax
mov edx, 0x417
mov qword [rsp + 0x6c], rax
mov rcx, rsi
mov dword [rsp + 0x74], eax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x3e8
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutA]
movsxd r8, dword [rsp + 0x5c]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x80]
mov dword [rsp + 0x28], 0x3e8
mov edx, 0x42d
mov rcx, rsi
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutA]
lea rdx, [rbp - 0x80]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test byte [rsp + 0x60], 1
mov rbx, rax
jne 0x1800093fb
mov rcx, qword [0x180035760]
mov rdx, rax
call fcn.18001c170
cmp rdi, 0xb
jne 0x18000948d
lea rdx, [rbp + 0x1c8]
mov rcx, rsi
call qword [sym.imp.USER32.dll_ClientToScreen]
movzx eax, word [rbp + 0x1c8]
lea r8d, [rdi + 1]
movzx r9d, word [rbp + 0x1cc]
mov rcx, rbx
shl r9, 0x10
or r9, rax
mov rax, qword [0x180035730]
mov edx, dword [rax + 0x150]
jmp 0x1800090de
movsx eax, r14w
lea r9, [rbp + 0x1c8]
shr r14, 0x10
mov edx, 0x445
mov dword [rbp + 0x1c8], eax
xor r8d, r8d
movsx eax, r14w
mov dword [rbp + 0x1cc], eax
lea rax, [rbp + 0x1d8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x3e8
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutA]
mov rax, qword [rbp + 0x1d8]
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret