Function at 0x180251c20
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xe8]
sub rsp, 0x1c0
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rbp + 0xb0], rax
xor r13d, r13d
mov dword [rsp + 0x30], r13d
xor r15b, r15b
call fcn.180251b20
test rax, rax
je 0x180251c87
xor r9d, r9d
xor r8d, r8d
lea edx, [r13 + 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
lea rax, [rsp + 0x38]
mov qword [rbp - 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rbp - 0x38], rax
lea rax, [rsp + 0x78]
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x68]
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], r13w
mov r8d, 7
lea rdx, str.Version
lea rcx, [rsp + 0x38]
call fcn.180005cd0
nop
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r13w
mov r8d, 7
lea rdx, str.Upgrade
lea rcx, [rsp + 0x58]
call fcn.180005cd0
nop
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r13w
mov r8d, 0xa
lea rdx, str.config.ini
lea rcx, [rsp + 0x78]
call fcn.180005cd0
nop
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r13w
mov r8d, 7
lea rdx, str.2345Pic
lea rcx, [rbp - 0x68]
call fcn.180005cd0
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x78]
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x70]
call fcn.1803716e0
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x1803f7240]
movdqu xmmword [rbp + 0x60], xmm1
mov word [rbp + 0x50], r13w
mov dword [rsp + 0x30], 1
lea r12, str.2345Pic_SetDefault
mov rsi, 0xffffffffffffffff
mov rcx, rsi
nop dword [rax]
inc rcx
cmp word [r12 + rcx*2], 0
jne 0x180251db0
mov rdx, qword [rbp + 0x80]
add rdx, rcx
lea rcx, [rbp + 0x50]
call fcn.18000c550
lea r9, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae r9, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x80]
mov r14, qword [rbp + 0x60]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
sub rax, r14
cmp rdi, rax
ja 0x180251e29
lea rax, [r14 + rdi]
mov qword [rbp + 0x60], rax
lea rbx, [rbp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rbp + 0x50]
lea r8, [rdi + rdi]
lea rcx, [rbx + r14*2]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r13w
jmp 0x180251e40
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x50]
call fcn.18000ada0
nop dword [rax]
inc rsi
cmp word [r12 + rsi*2], 0
jne 0x180251e40
mov rcx, qword [rbp + 0x60]
mov r8, qword [rbp + 0x68]
mov rax, r8
sub rax, rcx
cmp rsi, rax
ja 0x180251e8a
lea rdi, [rcx + rsi]
mov qword [rbp + 0x60], rdi
lea rbx, [rbp + 0x50]
cmp r8, 8
cmovae rbx, qword [rbp + 0x50]
lea r8, [rsi + rsi]
lea rcx, [rbx + rcx*2]
mov rdx, r12
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r13w
jmp 0x180251ea1
mov qword [rsp + 0x20], rsi
mov r9, r12
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp + 0x50]
call fcn.18000ada0
lea r8, str..pdf
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x90]
call fcn.180012500
nop
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x30], eax
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x180251f08
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180251f03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180251f03
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
movdqa xmm0, xmmword [0x1803f7240]
movdqu xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], r13w
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x20], 0x70
lea rax, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rax, qword [rbp + 0x90]
mov qword [rbp - 8], rax
mov qword [rbp - 0x18], r13
mov dword [rbp + 0x10], 5
mov dword [rbp - 0x1c], 0x44c
lea rax, str.properties
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x180251f7f
cmp qword [rbp + 0x18], 0x20
seta r15b
mov ebx, r13d
call fcn.180251b20
mov rdi, rax
test rax, rax
jne 0x180251f9f
inc ebx
cmp ebx, 0xffff
je 0x180252055
jmp 0x180251f82
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 5
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindow]
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
mov rdi, rax
mov ebx, r13d
nop dword [rax]
mov edx, 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindow]
mov rdi, rax
cmp ebx, 8
je 0x180251fef
inc ebx
cmp ebx, 9
jl 0x180251fd0
jmp 0x180252055
lea rdx, [rbp + 0x50]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp + 0x58]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [rbp + 0x5c]
cdq
sub eax, edx
sar eax, 1
movzx ebx, ax
shl rbx, 0x10
movzx eax, cx
or rbx, rax
mov r9, rbx
mov edx, 0x201
mov r8d, 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov r9, rbx
mov edx, 0x202
mov r8d, 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x18025209e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180252099
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180252099
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
movdqa xmm0, xmmword [0x1803f7240]
movdqu xmmword [rbp + 0xa0], xmm0
mov word [rbp + 0x90], r13w
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x1802520fc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1802520f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1802520f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], r13w
movzx eax, r15b
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.180393f50
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret