Function at 0x180013510
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rbx, rcx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
lea rdx, [rcx + 0x20]
lea rcx, [rbp]
call fcn.180005900
nop
cmp qword [rbx + 0x30], r12
jne 0x180013635
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x180013668
cmp qword [rbx + 0x10], r12
je 0x180013668
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
call qword [rax + 0x68]
mov rdi, rax
lea rax, [rbp]
cmp rax, rdi
je 0x1800135bd
lea rcx, [rbp]
call fcn.180005c50
movups xmm0, xmmword [rdi]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 7
mov word [rdi], r12w
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x180013600
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800135fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800135fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov r10, qword [rbx + 0x10]
mov edx, 0x11be
mov rcx, r10
call fcn.1802662f0
bt eax, 9
jae 0x180013635
mov edx, 0x12ee
mov rcx, r10
call fcn.180266870
mov edi, r12d
mov esi, r12d
mov eax, dword [rbx + 0x40]
mov r14d, 3
cmp eax, 0x9c52
jg 0x180013674
je 0x18001366f
cmp eax, 0x1074
je 0x180013689
cmp eax, 0x1353
je 0x18001366f
cmp eax, 0x9c51
jne 0x180013691
lea esi, [r14 + 1]
jmp 0x18001368c
xor bl, bl
jmp 0x180013bfb
mov esi, r14d
jmp 0x18001368c
cmp eax, 0x9cba
je 0x180013689
cmp eax, 0xc350
jne 0x180013691
mov esi, 2
jmp 0x18001368c
mov esi, r12d
mov edi, 5
xor r9d, r9d
lea r8, str.RCMainFrameWnd2345PicEdit
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov r15, rax
test rax, rax
je 0x180013870
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x180013870
cmp qword [rbp + 0x10], 0
je 0x180013855
mov qword [rsp + 0x38], r12
mov ecx, 0x58
call fcn.180393f74
mov rbx, rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov r8d, 0x19
lea rdx, str.RCMainFrameWnd2345PicEdit
lea rcx, [rbp - 0x40]
call fcn.180005cd0
nop
mov dword [rsp + 0x30], 1
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
mov r8d, 0x43
lea rdx, str.RC_MAIN_INSTANCE_2345PICEDIT_C24237CB_7988_4196_8FBA_716DD0BC9F5D
lea rcx, [rbp - 0x20]
call fcn.180005cd0
nop
mov dword [rsp + 0x30], r14d
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.180201ea0
mov rbx, rax
mov qword [rsp + 0x38], rax
and r14d, 0xfffffffd
mov dword [rsp + 0x30], r14d
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x1800137b4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800137af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800137af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
and r14d, 0xfffffffe
mov dword [rsp + 0x30], r14d
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x180013811
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001380c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001380c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov rcx, rbx
call fcn.1802021e0
test al, al
je 0x18001383b
lea rdx, [rbp]
mov rcx, rbx
call fcn.1802029d0
nop
test rbx, rbx
je 0x180013855
mov rcx, rbx
call fcn.180201fe0
mov edx, 0x58
mov rcx, rbx
call fcn.180393fb0
mov r9d, esi
mov r8d, edi
mov edx, 0x40b
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
mov bl, 1
jmp 0x180013bfb
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov r8d, 0xf
lea rdx, str.2345PicEdit.exe
lea rcx, [rbp - 0x40]
call fcn.180005cd0
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x20]
call fcn.18036f580
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x1800138f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800138ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800138ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
lea rcx, [rbp + 0x20]
call fcn.18015b0b0
test al, al
je 0x180013ba5
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8b, 1
call fcn.180371fa0
test al, al
je 0x180013ba5
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.180160990
mov rbx, rax
lea rax, [rbp + 0x20]
cmp rax, rbx
je 0x180013972
lea rcx, [rbp + 0x20]
call fcn.180005c50
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x1800139b5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800139b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800139b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r12w
cmp qword [rbp + 0x10], 0
je 0x180013aa6
lea rdx, [rbp]
lea rcx, [rbp - 0x20]
call fcn.180160990
mov rbx, rax
lea rax, [rbp]
cmp rax, rbx
je 0x180013a2b
lea rcx, [rbp]
call fcn.180005c50
movups xmm0, xmmword [rbx]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x180013a6e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180013a69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180013a69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
lea r8, [rbp]
cmp qword [rbp + 0x18], 8
cmovae r8, qword [rbp]
mov dword [rsp + 0x20], esi
mov r9d, edi
lea rdx, str.__file_s___pagetype_d___subtype_d___source2345Pic___functionpic
lea rcx, [rbp + 0x40]
call fcn.18015a250
jmp 0x180013abc
mov r9d, esi
mov r8d, edi
lea rdx, str.__pagetype_d___subtype_d
lea rcx, [rbp + 0x40]
call fcn.18015a250
xor eax, eax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov dword [rbp - 0x5c], eax
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x100000
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], r12
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rax, qword [rbp + 0x20]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rax, qword [rbp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x70], 1
mov qword [rbp - 0x58], r12
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x180013b4d
cmp qword [rsp + 0x78], 0x20
jbe 0x180013b4d
mov bl, 1
jmp 0x180013b4f
xor bl, bl
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180013b92
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180013b8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180013b8d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r12w
jmp 0x180013ba7
xor bl, bl
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180013bea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180013be5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180013be5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r12w
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x180013c3e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180013c39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180013c39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 7
mov word [rbp], r12w
movzx eax, bl
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.180393f50
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret