Function at 0x1800014b0
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x18000c040]
xor rax, rsp
mov qword [rbp + 0x340], rax
xor r15d, r15d
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r15
mov r14, rcx
mov qword [rsp + 0x70], r15
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rcx + rbx], r15b
jne 0x180001500
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x1800017a5
mov qword [rsp + 0x478], rsi
mov qword [rsp + 0x70], 0xf
cmp rbx, 0xf
ja 0x180001552
mov r8, rbx
mov qword [rsp + 0x68], rbx
mov rdx, r14
lea rcx, [rsp + 0x58]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x58], r15b
jmp 0x1800015e9
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x18000158b
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.180005fb4
test rax, rax
je 0x1800016c7
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1800015c8
mov ecx, 0x16
mov rdi, rax
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1800015b6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800017ab
jmp 0x18000156c
test rcx, rcx
je 0x1800015c5
call fcn.180005fb4
mov rsi, rax
jmp 0x1800015c8
mov rsi, r15
mov r8, rbx
mov qword [rsp + 0x58], rsi
mov rdx, r14
mov qword [rsp + 0x68], rbx
mov rcx, rsi
mov qword [rsp + 0x70], rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], r15b
xor edx, edx
mov edi, r15d
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000168a
lea rdx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18000168a
nop dword [rax]
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], r15
lea r8, [rbp + 0x1c]
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp qword [rsp + 0x70], 0xf
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x230]
cmova rdx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x180001687
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180001620
jmp 0x18000168a
mov edi, dword [rbp - 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x1800016d3
mov rcx, qword [rsp + 0x58]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800016ce
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800016ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180005f80
test edi, edi
je 0x1800016de
mov eax, edi
jmp 0x180001775
xorps xmm0, xmm0
mov dword [rbp - 0x80], 0x68
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, str.C:Program_Files__x86_AssaultCube_assaultcube.bat
lea rax, [rbp - 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
lea rax, str.C:Program_Files__x86_AssaultCube_
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x180001773
mov rcx, qword [rsp + 0x58]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x68]
jmp 0x180001775
xor eax, eax
mov rsi, qword [rsp + 0x478]
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.180005f60
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1800011b0
int3
call fcn.180001110
int3