Function at 0x180011df0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1804cc010]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rbx, rcx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
lea rdx, [rcx + 0x20]
lea rcx, [rbp]
call fcn.180004ad0
nop
cmp qword [rbx + 0x30], r12
jne 0x180011f15
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x180011f48
cmp qword [rbx + 0x10], r12
je 0x180011f48
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
call qword [rax + 0x68]
mov rdi, rax
lea rax, [rbp]
cmp rax, rdi
je 0x180011e9d
lea rcx, [rbp]
call fcn.180004e20
movups xmm0, xmmword [rdi]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 7
mov word [rdi], r12w
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x180011ee0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011edb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180011edb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180386950
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov r10, qword [rbx + 0x10]
mov edx, 0x11be
mov rcx, r10
call fcn.180261f90
bt eax, 9
jae 0x180011f15
mov edx, 0x12ee
mov rcx, r10
call fcn.180262510
mov edi, r12d
mov esi, r12d
mov eax, dword [rbx + 0x40]
mov r14d, 3
cmp eax, 0x9c52
jg 0x180011f54
je 0x180011f4f
cmp eax, 0x1074
je 0x180011f69
cmp eax, 0x1353
je 0x180011f4f
cmp eax, 0x9c51
jne 0x180011f71
lea esi, [r14 + 1]
jmp 0x180011f6c
xor bl, bl
jmp 0x1800124db
mov esi, r14d
jmp 0x180011f6c
cmp eax, 0x9cba
je 0x180011f69
cmp eax, 0xc350
jne 0x180011f71
mov esi, 2
jmp 0x180011f6c
mov esi, r12d
mov edi, 5
xor r9d, r9d
lea r8, str.RCMainFrameWnd2345PicEdit
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov r15, rax
test rax, rax
je 0x180012150
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x180012150
cmp qword [rbp + 0x10], 0
je 0x180012135
mov qword [rsp + 0x38], r12
mov ecx, 0x58
call fcn.180386914
mov rbx, rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov r8d, 0x19
lea rdx, str.RCMainFrameWnd2345PicEdit
lea rcx, [rbp - 0x40]
call fcn.180004ea0
nop
mov dword [rsp + 0x30], 1
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
mov r8d, 0x43
lea rdx, str.RC_MAIN_INSTANCE_2345PICEDIT_C24237CB_7988_4196_8FBA_716DD0BC9F5D
lea rcx, [rbp - 0x20]
call fcn.180004ea0
nop
mov dword [rsp + 0x30], r14d
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.1802002f0
mov rbx, rax
mov qword [rsp + 0x38], rax
and r14d, 0xfffffffd
mov dword [rsp + 0x30], r14d
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x180012094
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001208f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001208f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180386950
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
and r14d, 0xfffffffe
mov dword [rsp + 0x30], r14d
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x1800120f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800120ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800120ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180386950
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov rcx, rbx
call fcn.180200630
test al, al
je 0x18001211b
lea rdx, [rbp]
mov rcx, rbx
call fcn.180200d30
nop
test rbx, rbx
je 0x180012135
mov rcx, rbx
call fcn.180200430
mov edx, 0x58
mov rcx, rbx
call fcn.180386950
mov r9d, esi
mov r8d, edi
mov edx, 0x40b
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
mov bl, 1
jmp 0x1800124db
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov r8d, 0xf
lea rdx, str.2345PicEdit.exe
lea rcx, [rbp - 0x40]
call fcn.180004ea0
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x20]
call fcn.1801fdbc0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x1800121d1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800121cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800121cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180386950
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
lea rcx, [rbp + 0x20]
call fcn.1801559c0
test al, al
je 0x180012485
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8b, 1
call fcn.1801fff00
test al, al
je 0x180012485
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.18015acc0
mov rbx, rax
lea rax, [rbp + 0x20]
cmp rax, rbx
je 0x180012252
lea rcx, [rbp + 0x20]
call fcn.180004e20
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x180012295
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180012290
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180012290
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180386950
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r12w
cmp qword [rbp + 0x10], 0
je 0x180012386
lea rdx, [rbp]
lea rcx, [rbp - 0x20]
call fcn.18015acc0
mov rbx, rax
lea rax, [rbp]
cmp rax, rbx
je 0x18001230b
lea rcx, [rbp]
call fcn.180004e20
movups xmm0, xmmword [rbx]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x18001234e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180012349
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180012349
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180386950
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
lea r8, [rbp]
cmp qword [rbp + 0x18], 8
cmovae r8, qword [rbp]
mov dword [rsp + 0x20], esi
mov r9d, edi
lea rdx, str.__file_s___pagetype_d___subtype_d___source2345Pic___functionpic
lea rcx, [rbp + 0x40]
call fcn.180154b60
jmp 0x18001239c
mov r9d, esi
mov r8d, edi
lea rdx, str.__pagetype_d___subtype_d
lea rcx, [rbp + 0x40]
call fcn.180154b60
xor eax, eax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov dword [rbp - 0x5c], eax
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x100000
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], r12
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rax, qword [rbp + 0x20]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rax, qword [rbp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x70], 1
mov qword [rbp - 0x58], r12
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x18001242d
cmp qword [rsp + 0x78], 0x20
jbe 0x18001242d
mov bl, 1
jmp 0x18001242f
xor bl, bl
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180012472
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001246d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001246d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180386950
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r12w
jmp 0x180012487
xor bl, bl
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x1800124ca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800124c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800124c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180386950
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r12w
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x18001251e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180012519
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180012519
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180386950
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 7
mov word [rbp], r12w
movzx eax, bl
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1803868f0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret