Function at 0x1801d9630
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x18054e100]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor esi, esi
call fcn.1801d91b0
lea rcx, [rbp + 0xf]
call fcn.1803006b0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
lea ecx, [rsi + 0x20]
call fcn.180357684
mov rbx, rax
mov qword [rbp - 0x11], rax
mov qword [rbp - 1], 0x15
mov qword [rbp + 7], 0x1f
movups xmm0, xmmword [str.cmd.exe__C_del__F__Q]
movups xmmword [rax], xmm0
mov ecx, dword [0x1804aafc0]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x1804aafc4]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], sil
movabs rdi, 0x7fffffffffffffff
mov rax, rdi
mov rcx, qword [rbp + 0x1f]
sub rax, rcx
cmp rax, 0x12
jb 0x1801d9959
lea r9, [rbp + 0xf]
cmp qword [rbp + 0x27], 0xf
cmova r9, qword [rbp + 0xf]
mov qword [rsp + 0x30], 0x12
lea rax, str.thunderlangage.bat
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x31]
call fcn.18006a4c0
nop
movabs r14, 0x7fffffffffffffea
mov rcx, qword [rbp - 0x21]
cmp rcx, r14
ja 0x1801d995f
lea rax, [rbp - 0x31]
cmp qword [rbp - 0x19], 0xf
cmova rax, qword [rbp - 0x31]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x15
mov r9, rbx
lea rcx, [rbp + 0x2f]
call fcn.18006a4c0
lea r9, [rbp + 0x2f]
cmp qword [rbp + 0x47], 0xf
cmova r9, qword [rbp + 0x2f]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [rbp + 0x2f]
call fcn.18006b8d0
nop
lea rcx, [rbp - 0x31]
call fcn.18006b8d0
nop
mov rdx, qword [rbp + 7]
cmp rdx, 0xf
jbe 0x1801d97c8
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801d97c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801d9965
call fcn.180357650
nop
lea rcx, [rbp + 0xf]
call fcn.18006b8d0
call fcn.1801d93f0
lea rcx, [rbp - 0x31]
call fcn.1803006b0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
mov ecx, 0x20
call fcn.180357684
mov rbx, rax
mov qword [rbp - 0x11], rax
mov qword [rbp - 1], 0x15
mov qword [rbp + 7], 0x1f
movups xmm0, xmmword [str.cmd.exe__C_del__F__Q]
movups xmmword [rax], xmm0
mov ecx, dword [0x1804aafc0]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x1804aafc4]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
mov rax, qword [rbp - 0x21]
sub rdi, rax
cmp rdi, 0xf
jb 0x1801d996b
lea r9, [rbp - 0x31]
cmp qword [rbp - 0x19], 0xf
cmova r9, qword [rbp - 0x31]
mov qword [rsp + 0x30], 0xf
lea rcx, str.langage.thunder
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0xf]
call fcn.18006a4c0
nop
mov rcx, qword [rbp + 0x1f]
cmp rcx, r14
ja 0x1801d9971
lea rax, [rbp + 0xf]
cmp qword [rbp + 0x27], 0xf
cmova rax, qword [rbp + 0xf]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x15
mov r9, rbx
lea rcx, [rbp + 0x2f]
call fcn.18006a4c0
lea r9, [rbp + 0x2f]
cmp qword [rbp + 0x47], 0xf
cmova r9, qword [rbp + 0x2f]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [rbp + 0x2f]
call fcn.18006b8d0
nop
lea rcx, [rbp + 0xf]
call fcn.18006b8d0
nop
mov rdx, qword [rbp + 7]
cmp rdx, 0xf
jbe 0x1801d991f
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801d9919
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801d9953
call fcn.180357650
nop
lea rcx, [rbp - 0x31]
call fcn.18006b8d0
xor eax, eax
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.180357630
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.18035e820
nop
call fcn.18006b090
nop
call fcn.18006b090
nop
call fcn.18035e820
nop
call fcn.18006b090
nop
call fcn.18006b090
int3