Function at 0x18000b010
Capabilities:
Create process on windows
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x180021018]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, rcx
xor r15d, r15d
mov ebx, r15d
test byte [rcx + 0x3c], 1
jne 0x18000b3d7
call fcn.18000b430
test eax, eax
je 0x18000b2c8
call fcn.18000b490
test eax, eax
je 0x18000b3d7
lea r8, str.773F1B9A_35B9_4E95_83A0_A210F2DE3B37_request
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rdi, rax
mov qword [rbp - 0x61], rax
lea r8, str.773F1B9A_35B9_4E95_83A0_A210F2DE3B37_running
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov r14, rax
mov qword [rbp + 0x17], rax
test rax, rax
jne 0x18000b0c0
lea r9, str.773F1B9A_35B9_4E95_83A0_A210F2DE3B37_running
xor r8d, r8d
lea edx, [rax + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r14, rax
mov qword [rbp + 0x17], rax
test rdi, rdi
je 0x18000b0e9
test r14, r14
je 0x18000b0e9
xor r9d, r9d
mov r8d, 0x7530
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
neg eax
sbb ebx, ebx
and ebx, 0x80004005
lea rcx, [rbp - 0x61]
call fcn.1800016b0
test ebx, ebx
js 0x18000b111
test r14, r14
je 0x18000b111
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x18000b20a
mov qword [rbp - 0x61], r15
mov dword [rbp + 0x27], r15d
mov rbx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x27]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rbp + 0x27], ebx
je 0x18000b177
lea rcx, str.KERNEL32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, [rbp - 0x61]
mov rax, rdi
call qword [case.0x18000a30c.0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
mov dword [rbp - 0x59], 0x70
lea rax, str._SystemRoot_SYSTEM32WISPTIS.EXE
mov qword [rbp - 0x41], rax
lea rax, str._ManualLaunch_
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x49], r15
mov dword [rbp - 0x55], 0x700
lea rax, str._SystemRoot_SYSTEM32_
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x21], r15
lea rcx, [rbp - 0x59]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
cmp dword [rbp + 0x27], r15d
je 0x18000b1ec
mov rcx, qword [rbp - 0x61]
mov rax, rbx
call qword [case.0x18000a30c.0]
mov ebx, 0x80004005
test edi, edi
cmovne ebx, r15d
jne 0x18000b206
lea rcx, str.PimcManager::LoadWisptis_failed_to_ShellExecuteEx._r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test ebx, ebx
js 0x18000b228
test r14, r14
je 0x18000b228
mov edx, 0x7530
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, [rbp + 0x17]
call fcn.1800016b0
jmp 0x18000b239
lea rcx, [rbp + 0x17]
call fcn.1800016b0
test ebx, ebx
js 0x18000b3d7
lea rbx, [rsi + 0x20]
mov qword [rsp + 0x20], rbx
lea r9, [0x18001ae80]
xor edx, edx
lea r8d, [rdx + 0x17]
lea rcx, [0x180019fb0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18000b3d7
lea rax, [rbp - 0x61]
mov qword [rbp + 0x17], rax
lea rcx, [rsp + 0x30]
call fcn.180001250
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x27], xmm0
mov rcx, qword [rbx]
mov qword [rbp - 0x61], rcx
test rcx, rcx
je 0x18000b297
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x18000a30c.0]
nop
lea r8, [rbp + 0x27]
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x79]
call fcn.18000d0a0
movups xmm0, xmmword [rax]
movups xmmword [rsi + 0x28], xmm0
mov eax, dword [rax + 0x10]
mov dword [rsi + 0x38], eax
cmp dword [rsi + 0x28], 0
je 0x18000b3d7
or dword [rsi + 0x3c], 1
jmp 0x18000b3d7
mov qword [rbp + 0x17], r15
mov qword [rbp + 0x17], r15
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x27], r15
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
lea r9, [0x18001ae90]
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [0x18001a450]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x18000b31b
mov rcx, qword [rbp + 0x27]
test rcx, rcx
je 0x18000b316
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18000a30c.0]
nop
jmp 0x18000b3c1
mov rcx, qword [rbp + 0x17]
test rcx, rcx
jne 0x18000b340
mov rcx, qword [rbp + 0x27]
test rcx, rcx
je 0x18000b33b
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18000a30c.0]
nop
jmp 0x18000b3c1
mov rax, qword [rcx]
lea rdx, [rbp + 0x27]
mov rax, qword [rax + 0x18]
call qword [case.0x18000a30c.0]
test eax, eax
jns 0x18000b36e
mov rcx, qword [rbp + 0x27]
test rcx, rcx
je 0x18000b36c
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18000a30c.0]
nop
jmp 0x18000b3c1
mov rcx, qword [rbp + 0x27]
mov rax, qword [rcx]
lea r8, [rsi + 0x20]
lea rdx, [0x180019f80]
mov rax, qword [rax]
call qword [case.0x18000a30c.0]
test eax, eax
jns 0x18000b3a6
mov rcx, qword [rbp + 0x27]
test rcx, rcx
je 0x18000b3a4
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18000a30c.0]
nop
jmp 0x18000b3c1
or dword [rsi + 0x3c], 1
mov rcx, qword [rbp + 0x27]
test rcx, rcx
je 0x18000b3c1
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18000a30c.0]
nop
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x18000b3d7
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18000a30c.0]
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.180011d80
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret