Function at 0x180001564
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
xor ebp, ebp
mov r13, r8
mov r15d, edx
lea rcx, [rsp + 0x48]
lea r8d, [rbp + 0x30]
xor edx, edx
mov r12d, r9d
mov qword [rsp + 0x40], rbp
call sub.ntdll.dll_memset
mov eax, dword [0x18000d3a0]
mov rdi, rbp
lea rbx, [0x18000d3e0]
mov esi, ebp
lea r14d, [rbp + 8]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.18000468c
cmp eax, ebp
je 0x180001c8f
mov rcx, qword [rsp + 0x38]
mov edx, 0xd
call fcn.180005024
cmp rax, rbp
je 0x180001c7b
add esi, 1
mov qword [rbx], rax
add rbx, r14
cmp esi, 3
jb 0x1800015c5
mov rcx, qword [0x18000d3f0]
cmp word [rcx], 0x61
jb 0x18000161d
cmp word [rcx], 0x7a
ja 0x18000161d
movzx eax, word [rcx]
sub eax, 0x20
jmp 0x180001620
movzx eax, word [rcx]
mov word [rcx], ax
lea rdx, [0x18000f43c]
lea rcx, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
call fcn.180003790
xor ebx, ebx
cmp rax, rbx
mov qword [0x18000d3f8], rax
je 0x180001c8f
lea r9d, [rbx + 1]
lea rdx, [0x18000f538]
lea rcx, [rsp + 0x34]
xor r8d, r8d
call fcn.180003790
cmp rax, rbx
mov qword [0x18000d410], rax
je 0x180001c8f
lea ebp, [rbx + 4]
mov r8, rax
xor edx, edx
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
cmp rax, rbx
mov rsi, rax
je 0x180001724
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor ebp, ebp
cmp rax, rbp
mov rbx, rax
je 0x180001719
lea r8d, [rbp + 0x30]
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, rbp
je 0x18000170e
cmp qword [rsp + 0x98], 0x10
jbe 0x18000170e
cmp dword [rbx], ebp
je 0x1800016dd
lea rdi, [rbx + 0x10]
cmp dword [rbx + 8], ebp
je 0x1800016fb
mov eax, dword [rbx + 4]
mov ecx, dword [rbx]
add rax, rbx
lea rcx, [rcx + rax + 0x10]
mov qword [rsp + 0x68], rcx
mov eax, dword [rbx + 8]
mov dword [rsp + 0x70], eax
cmp dword [rbx + 4], ebp
je 0x180001719
mov eax, dword [rbx]
lea rcx, [rax + rbx + 0x10]
mov qword [rsp + 0x48], rcx
jmp 0x180001719
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov esi, 5
mov dword [rsp + 0x34], 1
mov ebp, 0x2000
cmp byte [0x18000d378], sil
jbe 0x18000195f
lea r8, [rsp + 0x38]
mov edx, 0x20008
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x34], ebx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, ebx
je 0x180001829
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9d, [rsi - 1]
lea r8, [rsp + 0x34]
lea edx, [rsi + 0xf]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea edx, [rsi + 0x14]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov r11d, dword [rsp + 0x30]
cmp r11d, ebx
je 0x18000181e
mov rcx, qword [0x18000d350]
mov r8, r11
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
je 0x18000181c
mov r9d, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea edx, [rsi + 0x14]
mov r8, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x18000180a
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov cl, byte [rax]
sub cl, 1
movzx edx, cl
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ebp, dword [rax]
mov rcx, qword [0x18000d350]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x34], ebx
jne 0x18000195f
cmp ebp, 0x1000
jne 0x18000195f
cmp rdi, rbx
jne 0x18000194d
mov r13, qword [rsp + 0x68]
mov r12d, dword [rsp + 0x70]
mov rdi, rbx
cmp r13, rbx
je 0x180001944
cmp r12d, ebx
je 0x180001944
mov ecx, 0x1fd1
call fcn.180004d98
cmp rax, rbx
mov rbp, rax
je 0x180001944
mov r15d, 1
mov r8d, r12d
mov rdx, r13
mov r9d, r15d
mov rcx, rax
call fcn.180004b84
cmp eax, ebx
je 0x180001941
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [0x18000d350]
xor edx, edx
lea r8d, [rax + rax + 0xc]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, rbx
mov rdi, rax
je 0x18000192d
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdx, rbp
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
sub rcx, rbp
lea rdx, [0x18000f6c8]
sar rcx, 1
mov ecx, ecx
lea rcx, [rdi + rcx*2]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r9d, r15d
mov r8d, r12d
mov rdx, r13
mov rcx, rdi
call fcn.180004b84
xor ebx, ebx
cmp eax, ebx
je 0x18000192d
mov rcx, qword [0x18000d350]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, rbx
mov rcx, qword [0x18000d350]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180001944
mov rdi, rbp
cmp rdi, rbx
je 0x180001adb
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call fcn.180003c98
jmp 0x180001ace
cmp dword [rsp + 0x70], ebx
jne 0x180001a36
cmp rdi, rbx
jne 0x180001a1a
mov rcx, qword [0x18000d370]
lea rax, [rsp + 0x78]
lea r8, [rsp + 0x80]
mov r9d, 0x30
xor edx, edx
mov qword [rsp + 0x20], rax
mov rdi, rbx
call qword [sym.imp.ntdll.dll_ZwQueryInformationProcess]
cmp eax, ebx
jl 0x180001a15
mov r8d, dword [rsp + 0xa8]
cmp r8d, ebx
je 0x180001a15
xor edx, edx
mov ecx, 0x418
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rbx, rax
je 0x180001a13
mov rcx, qword [0x18000d350]
xor edx, edx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rdi, rax
je 0x180001a0a
mov r9d, 0x800
mov r8, rax
xor edx, edx
mov rcx, rbx
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
jne 0x180001a0a
mov rcx, qword [0x18000d350]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edi, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp rdi, rbx
je 0x180001a36
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.180004a88
cmp eax, ebx
mov esi, eax
jne 0x180001c92
mov rbx, qword [rsp + 0xe0]
mov r8d, dword [0x18000d3a0]
mov r9d, 1
mov rcx, rbx
mov edx, r15d
call fcn.180005780
mov r8d, dword [0x18000d3a0]
mov r9d, 1
mov edx, r12d
mov rcx, r13
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x60], r15d
call fcn.180005780
mov rcx, qword [0x18000d3e8]
xor ebx, ebx
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x64], r12d
cmp qword [rsp + 0x48], rbx
lea rdx, [0x18000f4d8]
jne 0x180001aa0
lea rdx, [0x18000f4c0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rax, [rsp + 0x40]
lea r9, [fcn.180003e48]
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffff80000003
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call fcn.18000438c
mov esi, eax
cmp rdi, rbx
je 0x180001adb
mov rcx, rdi
call fcn.1800039dc
cmp esi, ebx
jne 0x180001c92
cmp qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x40]
je 0x180001b33
mov dx, 0x20
call qword [sym.imp.SHLWAPI.dll_StrChrW]
cmp rax, rbx
je 0x180001b05
mov word [rax], bx
add rax, 2
mov r8, qword [rsp + 0x40]
lea rdx, [0x18000f100]
mov r9, rax
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rsi, rax
cmp eax, 0x20
cmovg esi, ebx
jmp 0x180001c92
mov edx, 0x104
call fcn.180004f98
xor r12d, r12d
cmp rax, r12
mov rbx, rax
je 0x180001c8f
mov rcx, rax
call qword [sym.imp.SHELL32.dll_PathGetShortPath]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.180004cd8
cmp rax, r12
mov rsi, rax
je 0x180001c76
mov rcx, qword [0x18000d350]
lea r8d, [rdi + 0xb]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r12
mov rdi, rax
je 0x180001c64
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
lea rdx, [0x18000f13a]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea r9, [0x18000b3d4]
lea rdx, [0x18000f558]
mov r8, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, qword [0x18000d350]
xor edx, edx
mov r8d, 0x30c
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, r12
mov rbp, rax
je 0x180001c52
mov r8d, dword [0x18000d348]
lea rdx, [0x18000f562]
mov rcx, rax
imul r8d, r8d, 0x19660d
add r8d, 0x3c6ef35f
mov dword [0x18000d348], r8d
shr r8d, 1
mov r9d, r8d
not r9d
mov dword [rsp + 0x28], r9d
mov dword [rsp + 0x20], r8d
call qword [sym.imp.USER32.dll_wsprintfA]
mov r9, rdi
mov rdx, rbp
mov rcx, rsi
mov r8d, eax
mov dword [rsp + 0x20], r12d
call fcn.1800038d0
mov rcx, qword [0x18000d350]
mov r8, rbp
xor edx, edx
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x18000d350]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x18000d350]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, rbx
jmp 0x180001c80
mov r8, qword [rsp + 0x38]
mov rcx, qword [0x18000d350]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, r14d
lea r11, [rsp + 0xb0]
mov eax, esi
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret