Function at 0x1800206f0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x180101040]
xor rax, rsp
mov qword [rbp - 9], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x39], rcx
mov qword [rbp - 0x31], rdx
xor r14d, r14d
lea rdx, [0x180104350]
lea rcx, [rbp - 0x29]
call fcn.1800045b0
mov rcx, rax
call fcn.180020350
test al, al
jne 0x180020803
mov r9, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180020761
mov r9, qword [rbx]
mov r8, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x18002076e
mov r8, qword [rsi]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], r14
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
test rax, rax
jne 0x180020a06
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ShellExecuteEx_run_copier_app_failed_with_error__n
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], gethostname
mov dword [rbp - 0x61], eax
movabs rax, 0x2000000000000000
mov qword [rbp - 0x69], rax
mov qword [rbp - 0x59], 1
lea rax, [rbp - 0x69]
mov qword [rbp - 0x51], rax
movaps xmm0, xmmword [rbp - 0x59]
movdqa xmmword [rbp - 0x59], xmm0
movaps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm1
lea r8, [rbp - 0x59]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x29]
call fcn.180006f90
lea rcx, [rbp - 0x29]
call fcn.180011830
jmp 0x180020a06
mov rcx, qword [rbx + 0x10]
movabs rdi, 0x7fffffffffffffff
mov rax, rdi
sub rax, rcx
cmp rax, 0x1d
jb 0x180020ad7
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x18002082e
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x1d
lea r9, str.__Operation__:_4___Guid__:__
lea rcx, [rbp - 0x59]
call fcn.180015d10
nop
mov r8d, 3
lea rdx, [0x1800f1e70]
lea rcx, [rbp - 0x59]
call fcn.1800144b0
movups xmm7, xmmword [rax]
movups xmmword [rbp - 0x29], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp - 0x19], xmm6
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 0x41]
cmp rdx, 0xf
jbe 0x1800208c1
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800208bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180020add
call fcn.180022160
movdqa xmm0, xmmword [0x1800f23f0]
movdqu xmmword [rbp - 0x49], xmm0
mov byte [rbp - 0x59], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x79], r14
mov qword [rbp - 0x71], r14
lea r12, [rbp - 0x29]
movq r15, xmm7
movdqa xmm0, xmm6
psrldq xmm0, 8
movq r13, xmm0
cmp r13, 0xf
cmova r12, r15
movq r14, xmm6
cmp r14, rdi
ja 0x180020ae3
mov qword [rbp - 0x71], reloc.WS2_32.dll_ntohs
cmp r14, 0xf
ja 0x180020930
mov qword [rbp - 0x79], r14
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x40], xmm0
jmp 0x1800209c1
mov rax, r14
or rax, 0xf
cmp rax, rdi
jbe 0x18002096c
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.180022194
mov rcx, rax
test rax, rax
je 0x180020ae9
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800209a5
mov rdi, rax
mov ecx, socket
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x180020997
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180020acb
jmp 0x18002094a
test rcx, rcx
je 0x1800209a3
call fcn.180022194
jmp 0x1800209a5
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x79], r14
mov qword [rbp - 0x71], rdi
lea r8, [r14 + 1]
mov rdx, r12
mov rcx, rax
call fcn.1800ae620
lea rcx, [rsp + 0x40]
call fcn.180020d20
nop
cmp r13, 0xf
jbe 0x180020a03
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x1800209fb
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180020aef
mov rcx, r15
call fcn.180022160
xor r14d, r14d
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x180020a40
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x180020a3b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180020ac5
mov rcx, r8
call fcn.180022160
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x180020a85
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180020a80
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180020ad1
mov rcx, r8
call fcn.180022160
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.180022140
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18002aea4
nop
call fcn.1800012d0
nop
call fcn.18002aea4
nop
call fcn.180001370
nop
call fcn.18002aea4
int3
call fcn.180001370
int3
call fcn.18002aea4
nop
call fcn.18002aea4
int3