Function at 0x18006e6e0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x1c0
mov qword [rax - 0xd8], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1800c9088]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rsi, rdx
mov rdi, rcx
lea rcx, [rsp + 0x60]
call fcn.18005cfa8
nop
lea rcx, [rsp + 0xc8]
call fcn.18007c168
nop
lea rdx, [rsp + 0xc8]
mov rcx, rdi
call fcn.18006e58c
mov ebx, eax
xor r14d, r14d
test eax, eax
jns 0x18006e766
lea rcx, [rsp + 0xc8]
call fcn.18007c214
nop
lea rcx, [rsp + 0x60]
call fcn.18005d030
mov eax, ebx
jmp 0x18006eb46
cmp byte [rsp + 0xf0], r14b
jne 0x18006e7c7
lea rax, [0x1800c9a10]
mov rcx, qword [0x1800c9a10]
cmp rcx, rax
je 0x18006e7a5
test byte [rcx + 0x1c], 1
je 0x18006e7a5
cmp byte [rcx + 0x19], 4
jb 0x18006e7a5
mov edx, 0x55
lea r8, [0x1800a28b8]
mov rcx, qword [rcx + 0x10]
call fcn.180001ae4
nop
lea rcx, [rsp + 0xc8]
call fcn.18007c214
nop
lea rcx, [rsp + 0x60]
call fcn.18005d030
mov eax, 1
jmp 0x18006eb46
mov rbx, qword [rsp + 0xf8]
cmp dword [rbx - 0x10], r14d
jne 0x18006e82c
lea rax, [0x1800c9a10]
mov rcx, qword [0x1800c9a10]
cmp rcx, rax
je 0x18006e80a
test byte [rcx + 0x1c], 1
je 0x18006e80a
cmp byte [rcx + 0x19], 3
jb 0x18006e80a
mov edx, 0x56
lea r8, [0x1800a28b8]
mov rcx, qword [rcx + 0x10]
call fcn.180001ae4
nop
lea rcx, [rsp + 0xc8]
call fcn.18007c214
nop
lea rcx, [rsp + 0x60]
call fcn.18005d030
mov eax, 1
jmp 0x18006eb46
call fcn.180001d84
mov rcx, rax
test rax, rax
je 0x18006eb6a
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.18005e0bc
test al, al
jne 0x18006e89f
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18006e87d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0xc8]
call fcn.18007c214
nop
lea rcx, [rsp + 0x60]
call fcn.18005d030
mov eax, 0x8007000e
jmp 0x18006eb46
call fcn.180001d84
mov rcx, rax
test rax, rax
je 0x18006eb75
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x50], rax
cmp dword [rbx - 0x10], r14d
jl 0x18006eb80
mov r9, rsi
mov r8, qword [rsp + 0x58]
lea rcx, [rsp + 0x50]
cmp word [rbx], 0x22
je 0x18006e8ea
lea rdx, str.__ls___file___ls_
call fcn.180001700
jmp 0x18006e8f6
lea rdx, str._ls__file___ls_
call fcn.180001700
cmp byte [rdi + 0x2c4], r14b
je 0x18006e921
lea rdx, str.__tempfile
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], r14w
jne 0x18006e90a
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.1800148f0
xor eax, eax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
lea ebx, [rax + 0x68]
mov r8d, ebx
xor edx, edx
lea rcx, [rsp + 0x120]
call fcn.1800485d0
mov dword [rsp + 0x120], ebx
mov rbx, qword [rsp + 0x50]
mov edx, dword [rbx - 0x10]
test edx, edx
js 0x18006eb8a
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x18006e987
lea rcx, [rsp + 0x50]
call fcn.180001a7c
mov rbx, qword [rsp + 0x50]
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
lea rdi, [rbx - 0x18]
test rbx, rbx
jne 0x18006e9d9
mov eax, r14d
jmp 0x18006e9ed
movsxd rdx, dword [rdi + 0xc]
mov rcx, rbx
call fcn.18004d32c
test eax, eax
js 0x18006eb94
cmp eax, dword [rdi + 0xc]
jg 0x18006eb94
mov dword [rdi + 8], eax
cdqe
mov word [rbx + rax*2], r14w
test esi, esi
jne 0x18006eab3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rax, [0x1800c9a10]
mov rcx, qword [0x1800c9a10]
cmp rcx, rax
je 0x18006ea4b
test byte [rcx + 0x1c], 1
je 0x18006ea4b
cmp byte [rcx + 0x19], 2
jb 0x18006ea4b
mov edx, 0x57
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x1800a28b8]
mov rcx, qword [rcx + 0x10]
call fcn.180001594
movzx ebx, si
or ebx, 0x80070000
test esi, esi
cmovle ebx, esi
or eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x18006ea73
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18006ea94
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
lea rcx, [rsp + 0xc8]
call fcn.18007c214
nop
lea rcx, [rsp + 0x60]
call fcn.18005d030
mov eax, ebx
jmp 0x18006eb46
or edx, 0xffffffff
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
or eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x18006eafb
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18006eb1b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0xc8]
call fcn.18007c214
nop
lea rcx, [rsp + 0x60]
call fcn.18005d030
xor eax, eax
jmp 0x18006eb46
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.180045d30
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1c0
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.180001b3c
nop
mov ecx, 0x80004005
call fcn.180001b3c
nop
mov ecx, 0x80070057
call fcn.180001b3c
mov ecx, 0x80070057
call fcn.180001b3c
mov ecx, 0x80070057
call fcn.180001b3c
int3