Function at 0x180076a10
Capabilities:
Create process on windows

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0x20c0]
mov eax, 0x21c0
call fcn.180394fd0
sub rsp, rax
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x21e8], rbx
mov qword [rsp + 0x21f0], rsi
mov qword [rsp + 0x21f8], rdi
mov rax, qword [0x1804e0010]
xor rax, rsp
mov qword [rbp + 0x20b0], rax
mov rbx, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
cmp qword [rcx + 8], r15
je 0x180077631
mov rcx, qword [rcx]
test rcx, rcx
je 0x180077631
mov rax, qword [rcx]
call qword [rax + 0x78]
mov rdi, rax
test rax, rax
je 0x180077631
xor edx, edx
mov r8d, 0x201b
lea rcx, [rbp - 0x3c]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x1fe3], r15d
mov dword [rbp - 0x40], 0x2027
mov rax, qword [rbx + 8]
mov qword [rbp + 0xfcc], rax
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x30]
mov byte [rbp + 0xfdd], al
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x20]
mov byte [rbp + 0xfdc], al
mov byte [rbp + 0xfde], 1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2080], xmm0
movdqa xmm1, xmmword [0x1803f7240]
movdqu xmmword [rbp + 0x2080], xmm1
mov word [rbp + 0x2070], r15w
mov rax, qword [rdi]
lea rdx, [rbp + 0x2070]
mov rcx, rdi
call qword [rax + 0x50]
lea rax, [rbp + 0x2070]
cmp qword [rbp + 0x2088], 8
cmovae rax, qword [rbp + 0x2070]
movzx eax, byte [rax]
mov byte [rbp + 0x1fe2], al
mov word [rbp + 0x1fdf], 0x101
mov byte [rbp + 0x1fe1], r15b
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2040], xmm0
movdqa xmm1, xmmword [0x1803f7240]
movdqu xmmword [rbp + 0x2040], xmm1
mov word [rbp + 0x2030], r15w
mov rcx, qword [rbp + 0x2040]
mov rdx, qword [rbp + 0x2048]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x180076bb7
lea rdi, [rcx + 6]
mov qword [rbp + 0x2040], rdi
lea rbx, [rbp + 0x2030]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x2030]
lea rcx, [rbx + rcx*2]
lea r8d, [r15 + 0xc]
lea rdx, [0x1803cedf8]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x180076bda
mov qword [rsp + 0x20], 6
lea r9, [0x1803cedf8]
xor r8d, r8d
lea edx, [r8 + 6]
lea rcx, [rbp + 0x2030]
call fcn.18000ada0
lea rdx, [rbp + 0x2010]
lea rcx, [rbp - 0x40]
call fcn.1800767c0
nop
mov r9, rax
cmp qword [rax + 0x18], 8
jb 0x180076bf8
mov r9, qword [rax]
mov rdx, qword [rax + 0x10]
mov rcx, qword [rbp + 0x2040]
mov r8, qword [rbp + 0x2048]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x180076c4a
lea rdi, [rcx + rdx]
mov qword [rbp + 0x2040], rdi
lea rbx, [rbp + 0x2030]
cmp r8, 8
cmovae rbx, qword [rbp + 0x2030]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x180076c5f
mov qword [rsp + 0x20], rdx
xor r8d, r8d
lea rcx, [rbp + 0x2030]
call fcn.18000ada0
nop
mov rdx, qword [rbp + 0x2028]
cmp rdx, 8
jb 0x180076ca8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2010]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180076ca3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180076ca3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
movdqa xmm0, xmmword [0x1803f7240]
movdqu xmmword [rbp + 0x2020], xmm0
mov word [rbp + 0x2010], r15w
lea rcx, [rbp + 0x2030]
cmp qword [rbp + 0x2048], 8
cmovae rcx, qword [rbp + 0x2030]
lea rdx, [rbp + 0xfdf]
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180076cf0
xor bl, bl
cmp byte [0x1804f1984], bl
jne 0x18007756a
mov byte [0x1804f1984], 1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20a0], xmm0
movdqa xmm1, xmmword [0x1803f7240]
movdqu xmmword [rbp + 0x20a0], xmm1
mov word [rbp + 0x2090], r15w
mov r8d, 0x12
lea rdx, str.2345PicCapture.exe
lea rcx, [rbp + 0x2090]
call fcn.180005cd0
nop
lea rdx, [rbp + 0x2090]
lea rcx, [rbp + 0x2050]
call fcn.18036f580
nop
mov rdx, qword [rbp + 0x20a8]
cmp rdx, 8
jb 0x180076daf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2090]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180076daa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180076daa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
movdqa xmm0, xmmword [0x1803f7240]
movdqu xmmword [rbp + 0x20a0], xmm0
mov word [rbp + 0x2090], r15w
lea rcx, [rbp + 0x2050]
call fcn.18015b0b0
test al, al
je 0x180077507
lea rcx, [rbp + 0x2050]
cmp qword [rbp + 0x2068], 8
cmovae rcx, qword [rbp + 0x2050]
mov r8b, 1
call fcn.180371fa0
test al, al
je 0x180077507
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2000], xmm0
movdqa xmm1, xmmword [0x1803f7240]
movdqu xmmword [rbp + 0x2000], xmm1
mov word [rbp + 0x1ff0], r15w
mov rdx, qword [rbp + 0xfcc]
lea rcx, [rbp + 0x2010]
call fcn.180159970
mov rbx, rax
lea rax, [rbp + 0x1ff0]
cmp rax, rbx
je 0x180076e78
lea rcx, [rbp + 0x1ff0]
call fcn.180005c50
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x1ff0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x2000], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rbp + 0x2028]
cmp rdx, 8
jb 0x180076ec1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2010]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180076ebc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180076ebc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
movdqa xmm0, xmmword [0x1803f7240]
movdqu xmmword [rbp + 0x2020], xmm0
mov word [rbp + 0x2010], r15w
lea rdx, [rbp + 0x2050]
lea rcx, [rbp + 0x2010]
call fcn.180160990
mov rbx, rax
lea rax, [rbp + 0x2050]
cmp rax, rbx
je 0x180076f2c
lea rcx, [rbp + 0x2050]
call fcn.180005c50
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x2050], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x2060], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rbp + 0x2028]
cmp rdx, 8
jb 0x180076f75
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2010]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180076f70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180076f70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
movdqa xmm0, xmmword [0x1803f7240]
movdqu xmmword [rbp + 0x2020], xmm0
mov word [rbp + 0x2010], r15w
mov rcx, qword [rbp + 0x2000]
mov rdx, qword [rbp + 0x2008]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180076fe2
lea rdi, [rcx + 1]
mov qword [rbp + 0x2000], rdi
lea rbx, [rbp + 0x1ff0]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1803d1bb0]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x180077006
mov qword [rsp + 0x20], 1
lea r9, [0x1803d1bb0]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0x1ff0]
call fcn.18000ada0
nop
mov rdx, r15
cmp byte [rbp + 0xfdd], r15b
setne dl
lea rcx, [rbp + 0x2010]
call fcn.180159970
mov esi, 4
mov dword [rsp + 0x30], esi
and esi, 0xfffffffb
mov dword [rsp + 0x30], esi
or esi, 2
mov dword [rsp + 0x30], esi
lea r9, [rbp + 0x2010]
cmp qword [rbp + 0x2028], 8
cmovae r9, qword [rbp + 0x2010]
mov rdi, qword [rbp + 0x2020]
mov r14, qword [rbp + 0x2000]
mov rcx, qword [rbp + 0x2008]
mov rax, rcx
sub rax, r14
cmp rdi, rax
ja 0x1800770a6
lea rax, [r14 + rdi]
mov qword [rbp + 0x2000], rax
lea rbx, [rbp + 0x1ff0]
cmp rcx, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea r8, [rdi + rdi]
lea rcx, [rbx + r14*2]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r15w
jmp 0x1800770bd
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x1ff0]
call fcn.18000ada0
and esi, 0xfffffffd
mov dword [rsp + 0x30], esi
mov rdx, qword [rbp + 0x2028]
cmp rdx, 8
jb 0x18007710d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2010]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180077108
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180077108
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
movdqa xmm0, xmmword [0x1803f7240]
movdqu xmmword [rbp + 0x2020], xmm0
mov word [rbp + 0x2010], r15w
mov rcx, qword [rbp + 0x2000]
mov rdx, qword [rbp + 0x2008]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x18007717a
lea rdi, [rcx + 1]
mov qword [rbp + 0x2000], rdi
lea rbx, [rbp + 0x1ff0]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1803d1bb0]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x18007719e
mov qword [rsp + 0x20], 1
lea r9, [0x1803d1bb0]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0x1ff0]
call fcn.18000ada0
nop
mov rdx, r15
cmp byte [rbp + 0xfdc], r15b
setne dl
lea rcx, [rbp + 0x2010]
call fcn.180159970
or esi, 0x10
mov dword [rsp + 0x30], esi
and esi, 0xffffffef
mov dword [rsp + 0x30], esi
or esi, 8
mov dword [rsp + 0x30], esi
lea r9, [rbp + 0x2010]
cmp qword [rbp + 0x2028], 8
cmovae r9, qword [rbp + 0x2010]
mov rdi, qword [rbp + 0x2020]
mov r14, qword [rbp + 0x2000]
mov rcx, qword [rbp + 0x2008]
mov rax, rcx
sub rax, r14
cmp rdi, rax
ja 0x18007723c
lea rax, [r14 + rdi]
mov qword [rbp + 0x2000], rax
lea rbx, [rbp + 0x1ff0]
cmp rcx, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea r8, [rdi + rdi]
lea rcx, [rbx + r14*2]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r15w
jmp 0x180077253
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x1ff0]
call fcn.18000ada0
and esi, 0xfffffff7
mov dword [rsp + 0x30], esi
mov rdx, qword [rbp + 0x2028]
cmp rdx, 8
jb 0x1800772a3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2010]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007729e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18007729e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
movdqa xmm0, xmmword [0x1803f7240]
movdqu xmmword [rbp + 0x2020], xmm0
mov word [rbp + 0x2010], r15w
mov rcx, qword [rbp + 0x2000]
mov rdx, qword [rbp + 0x2008]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180077310
lea rdi, [rcx + 1]
mov qword [rbp + 0x2000], rdi
lea rbx, [rbp + 0x1ff0]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1803d1bb0]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x180077333
mov qword [rsp + 0x20], 1
lea r9, [0x1803d1bb0]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0x1ff0]
call fcn.18000ada0
lea rax, [rbp + 0xfdf]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x180077341
mov rcx, qword [rbp + 0x2000]
mov r8, qword [rbp + 0x2008]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x18007739d
lea rdi, [rdx + rcx]
mov qword [rbp + 0x2000], rdi
lea rbx, [rbp + 0x1ff0]
cmp r8, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
lea rdx, [rbp + 0xfdf]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x1800773b8
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0xfdf]
xor r8d, r8d
lea rcx, [rbp + 0x1ff0]
call fcn.18000ada0
xor eax, eax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov dword [rbp - 0x5c], eax
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x540
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], r15
lea rax, [rbp + 0x2050]
cmp qword [rbp + 0x2068], 8
cmovae rax, qword [rbp + 0x2050]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x1ff0]
cmp qword [rbp + 0x2008], 8
cmovae rax, qword [rbp + 0x1ff0]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 1
mov qword [rbp - 0x58], r15
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne bl
mov byte [0x1804f1984], 0
mov rdx, qword [rbp + 0x2008]
cmp rdx, 8
jb 0x1800774a0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1ff0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007749b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18007749b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
movdqa xmm0, xmmword [0x1803f7240]
movdqu xmmword [rbp + 0x2000], xmm0
mov word [rbp + 0x1ff0], r15w
mov rdx, qword [rbp + 0x2068]
cmp rdx, 8
jb 0x180077552
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2050]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180077500
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180077500
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
jmp 0x180077552
mov rdx, qword [rbp + 0x2068]
cmp rdx, 8
jb 0x180077550
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2050]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007754b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18007754b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
xor bl, bl
movdqa xmm0, xmmword [0x1803f7240]
mov word [rbp + 0x2050], r15w
movdqu xmmword [rbp + 0x2060], xmm0
mov rdx, qword [rbp + 0x2048]
cmp rdx, 8
jb 0x1800775b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2030]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800775ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800775ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
movdqa xmm0, xmmword [0x1803f7240]
movdqu xmmword [rbp + 0x2040], xmm0
mov word [rbp + 0x2030], r15w
mov rdx, qword [rbp + 0x2088]
cmp rdx, 8
jb 0x180077614
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2070]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007760f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18007760f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180393fb0
movdqa xmm0, xmmword [0x1803f7240]
movdqu xmmword [rbp + 0x2080], xmm0
mov word [rbp + 0x2070], r15w
movzx eax, bl
jmp 0x180077633
xor al, al
mov rcx, qword [rbp + 0x20b0]
xor rcx, rsp
call fcn.180393f50
lea r11, [rsp + 0x21c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret