Function at 0x1800746d0
Capabilities:
Create process on windows

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0x20c0]
mov eax, 0x21c0
call fcn.180386c90
sub rsp, rax
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x21e8], rbx
mov qword [rsp + 0x21f0], rsi
mov qword [rsp + 0x21f8], rdi
mov rax, qword [0x1804ca010]
xor rax, rsp
mov qword [rbp + 0x20b0], rax
mov rbx, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
cmp qword [rcx + 8], r15
je 0x1800752f1
mov rcx, qword [rcx]
test rcx, rcx
je 0x1800752f1
mov rax, qword [rcx]
call qword [rax + 0x78]
mov rdi, rax
test rax, rax
je 0x1800752f1
xor edx, edx
mov r8d, 0x201b
lea rcx, [rbp - 0x3c]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x1fe3], r15d
mov dword [rbp - 0x40], 0x2027
mov rax, qword [rbx + 8]
mov qword [rbp + 0xfcc], rax
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x30]
mov byte [rbp + 0xfdd], al
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x20]
mov byte [rbp + 0xfdc], al
mov byte [rbp + 0xfde], 1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2080], xmm0
movdqa xmm1, xmmword [0x1803e6740]
movdqu xmmword [rbp + 0x2080], xmm1
mov word [rbp + 0x2070], r15w
mov rax, qword [rdi]
lea rdx, [rbp + 0x2070]
mov rcx, rdi
call qword [rax + 0x50]
lea rax, [rbp + 0x2070]
cmp qword [rbp + 0x2088], 8
cmovae rax, qword [rbp + 0x2070]
movzx eax, byte [rax]
mov byte [rbp + 0x1fe2], al
mov word [rbp + 0x1fdf], 0x101
mov byte [rbp + 0x1fe1], r15b
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2040], xmm0
movdqa xmm1, xmmword [0x1803e6740]
movdqu xmmword [rbp + 0x2040], xmm1
mov word [rbp + 0x2030], r15w
mov rcx, qword [rbp + 0x2040]
mov rdx, qword [rbp + 0x2048]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x180074877
lea rdi, [rcx + 6]
mov qword [rbp + 0x2040], rdi
lea rbx, [rbp + 0x2030]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x2030]
lea rcx, [rbx + rcx*2]
lea r8d, [r15 + 0xc]
lea rdx, [0x1803bfe50]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x18007489a
mov qword [rsp + 0x20], 6
lea r9, [0x1803bfe50]
xor r8d, r8d
lea edx, [r8 + 6]
lea rcx, [rbp + 0x2030]
call fcn.180009e00
lea rdx, [rbp + 0x2010]
lea rcx, [rbp - 0x40]
call fcn.180074480
nop
mov r9, rax
cmp qword [rax + 0x18], 8
jb 0x1800748b8
mov r9, qword [rax]
mov rdx, qword [rax + 0x10]
mov rcx, qword [rbp + 0x2040]
mov r8, qword [rbp + 0x2048]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x18007490a
lea rdi, [rcx + rdx]
mov qword [rbp + 0x2040], rdi
lea rbx, [rbp + 0x2030]
cmp r8, 8
cmovae rbx, qword [rbp + 0x2030]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x18007491f
mov qword [rsp + 0x20], rdx
xor r8d, r8d
lea rcx, [rbp + 0x2030]
call fcn.180009e00
nop
mov rdx, qword [rbp + 0x2028]
cmp rdx, 8
jb 0x180074968
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2010]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180074963
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180074963
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
movdqa xmm0, xmmword [0x1803e6740]
movdqu xmmword [rbp + 0x2020], xmm0
mov word [rbp + 0x2010], r15w
lea rcx, [rbp + 0x2030]
cmp qword [rbp + 0x2048], 8
cmovae rcx, qword [rbp + 0x2030]
lea rdx, [rbp + 0xfdf]
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1800749b0
xor bl, bl
cmp byte [0x1804db034], bl
jne 0x18007522a
mov byte [0x1804db034], 1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20a0], xmm0
movdqa xmm1, xmmword [0x1803e6740]
movdqu xmmword [rbp + 0x20a0], xmm1
mov word [rbp + 0x2090], r15w
mov r8d, 0x12
lea rdx, str.2345PicCapture.exe
lea rcx, [rbp + 0x2090]
call fcn.180004e70
nop
lea rdx, [rbp + 0x2090]
lea rcx, [rbp + 0x2050]
call fcn.1801fdce0
nop
mov rdx, qword [rbp + 0x20a8]
cmp rdx, 8
jb 0x180074a6f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2090]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180074a6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180074a6a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
movdqa xmm0, xmmword [0x1803e6740]
movdqu xmmword [rbp + 0x20a0], xmm0
mov word [rbp + 0x2090], r15w
lea rcx, [rbp + 0x2050]
call fcn.180155ab0
test al, al
je 0x1800751c7
lea rcx, [rbp + 0x2050]
cmp qword [rbp + 0x2068], 8
cmovae rcx, qword [rbp + 0x2050]
mov r8b, 1
call fcn.180200020
test al, al
je 0x1800751c7
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2000], xmm0
movdqa xmm1, xmmword [0x1803e6740]
movdqu xmmword [rbp + 0x2000], xmm1
mov word [rbp + 0x1ff0], r15w
mov rdx, qword [rbp + 0xfcc]
lea rcx, [rbp + 0x2010]
call fcn.180154370
mov rbx, rax
lea rax, [rbp + 0x1ff0]
cmp rax, rbx
je 0x180074b38
lea rcx, [rbp + 0x1ff0]
call fcn.180004df0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x1ff0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x2000], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rbp + 0x2028]
cmp rdx, 8
jb 0x180074b81
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2010]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180074b7c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180074b7c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
movdqa xmm0, xmmword [0x1803e6740]
movdqu xmmword [rbp + 0x2020], xmm0
mov word [rbp + 0x2010], r15w
lea rdx, [rbp + 0x2050]
lea rcx, [rbp + 0x2010]
call fcn.18015adb0
mov rbx, rax
lea rax, [rbp + 0x2050]
cmp rax, rbx
je 0x180074bec
lea rcx, [rbp + 0x2050]
call fcn.180004df0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x2050], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x2060], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rbp + 0x2028]
cmp rdx, 8
jb 0x180074c35
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2010]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180074c30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180074c30
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
movdqa xmm0, xmmword [0x1803e6740]
movdqu xmmword [rbp + 0x2020], xmm0
mov word [rbp + 0x2010], r15w
mov rcx, qword [rbp + 0x2000]
mov rdx, qword [rbp + 0x2008]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180074ca2
lea rdi, [rcx + 1]
mov qword [rbp + 0x2000], rdi
lea rbx, [rbp + 0x1ff0]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1803c2b80]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x180074cc6
mov qword [rsp + 0x20], 1
lea r9, [0x1803c2b80]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0x1ff0]
call fcn.180009e00
nop
mov rdx, r15
cmp byte [rbp + 0xfdd], r15b
setne dl
lea rcx, [rbp + 0x2010]
call fcn.180154370
mov esi, 4
mov dword [rsp + 0x30], esi
and esi, 0xfffffffb
mov dword [rsp + 0x30], esi
or esi, 2
mov dword [rsp + 0x30], esi
lea r9, [rbp + 0x2010]
cmp qword [rbp + 0x2028], 8
cmovae r9, qword [rbp + 0x2010]
mov rdi, qword [rbp + 0x2020]
mov r14, qword [rbp + 0x2000]
mov rcx, qword [rbp + 0x2008]
mov rax, rcx
sub rax, r14
cmp rdi, rax
ja 0x180074d66
lea rax, [r14 + rdi]
mov qword [rbp + 0x2000], rax
lea rbx, [rbp + 0x1ff0]
cmp rcx, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea r8, [rdi + rdi]
lea rcx, [rbx + r14*2]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r15w
jmp 0x180074d7d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x1ff0]
call fcn.180009e00
and esi, 0xfffffffd
mov dword [rsp + 0x30], esi
mov rdx, qword [rbp + 0x2028]
cmp rdx, 8
jb 0x180074dcd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2010]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180074dc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180074dc8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
movdqa xmm0, xmmword [0x1803e6740]
movdqu xmmword [rbp + 0x2020], xmm0
mov word [rbp + 0x2010], r15w
mov rcx, qword [rbp + 0x2000]
mov rdx, qword [rbp + 0x2008]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180074e3a
lea rdi, [rcx + 1]
mov qword [rbp + 0x2000], rdi
lea rbx, [rbp + 0x1ff0]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1803c2b80]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x180074e5e
mov qword [rsp + 0x20], 1
lea r9, [0x1803c2b80]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0x1ff0]
call fcn.180009e00
nop
mov rdx, r15
cmp byte [rbp + 0xfdc], r15b
setne dl
lea rcx, [rbp + 0x2010]
call fcn.180154370
or esi, 0x10
mov dword [rsp + 0x30], esi
and esi, 0xffffffef
mov dword [rsp + 0x30], esi
or esi, 8
mov dword [rsp + 0x30], esi
lea r9, [rbp + 0x2010]
cmp qword [rbp + 0x2028], 8
cmovae r9, qword [rbp + 0x2010]
mov rdi, qword [rbp + 0x2020]
mov r14, qword [rbp + 0x2000]
mov rcx, qword [rbp + 0x2008]
mov rax, rcx
sub rax, r14
cmp rdi, rax
ja 0x180074efc
lea rax, [r14 + rdi]
mov qword [rbp + 0x2000], rax
lea rbx, [rbp + 0x1ff0]
cmp rcx, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea r8, [rdi + rdi]
lea rcx, [rbx + r14*2]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r15w
jmp 0x180074f13
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x1ff0]
call fcn.180009e00
and esi, 0xfffffff7
mov dword [rsp + 0x30], esi
mov rdx, qword [rbp + 0x2028]
cmp rdx, 8
jb 0x180074f63
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2010]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180074f5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180074f5e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
movdqa xmm0, xmmword [0x1803e6740]
movdqu xmmword [rbp + 0x2020], xmm0
mov word [rbp + 0x2010], r15w
mov rcx, qword [rbp + 0x2000]
mov rdx, qword [rbp + 0x2008]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180074fd0
lea rdi, [rcx + 1]
mov qword [rbp + 0x2000], rdi
lea rbx, [rbp + 0x1ff0]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1803c2b80]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x180074ff3
mov qword [rsp + 0x20], 1
lea r9, [0x1803c2b80]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0x1ff0]
call fcn.180009e00
lea rax, [rbp + 0xfdf]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x180075001
mov rcx, qword [rbp + 0x2000]
mov r8, qword [rbp + 0x2008]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x18007505d
lea rdi, [rdx + rcx]
mov qword [rbp + 0x2000], rdi
lea rbx, [rbp + 0x1ff0]
cmp r8, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
lea rdx, [rbp + 0xfdf]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x180075078
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0xfdf]
xor r8d, r8d
lea rcx, [rbp + 0x1ff0]
call fcn.180009e00
xor eax, eax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov dword [rbp - 0x5c], eax
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x540
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], r15
lea rax, [rbp + 0x2050]
cmp qword [rbp + 0x2068], 8
cmovae rax, qword [rbp + 0x2050]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x1ff0]
cmp qword [rbp + 0x2008], 8
cmovae rax, qword [rbp + 0x1ff0]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 1
mov qword [rbp - 0x58], r15
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne bl
mov byte [0x1804db034], 0
mov rdx, qword [rbp + 0x2008]
cmp rdx, 8
jb 0x180075160
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1ff0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007515b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18007515b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
movdqa xmm0, xmmword [0x1803e6740]
movdqu xmmword [rbp + 0x2000], xmm0
mov word [rbp + 0x1ff0], r15w
mov rdx, qword [rbp + 0x2068]
cmp rdx, 8
jb 0x180075212
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2050]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800751c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800751c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
jmp 0x180075212
mov rdx, qword [rbp + 0x2068]
cmp rdx, 8
jb 0x180075210
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2050]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007520b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18007520b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
xor bl, bl
movdqa xmm0, xmmword [0x1803e6740]
mov word [rbp + 0x2050], r15w
movdqu xmmword [rbp + 0x2060], xmm0
mov rdx, qword [rbp + 0x2048]
cmp rdx, 8
jb 0x180075273
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2030]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18007526e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18007526e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
movdqa xmm0, xmmword [0x1803e6740]
movdqu xmmword [rbp + 0x2040], xmm0
mov word [rbp + 0x2030], r15w
mov rdx, qword [rbp + 0x2088]
cmp rdx, 8
jb 0x1800752d4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2070]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800752cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800752cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
movdqa xmm0, xmmword [0x1803e6740]
movdqu xmmword [rbp + 0x2080], xmm0
mov word [rbp + 0x2070], r15w
movzx eax, bl
jmp 0x1800752f3
xor al, al
mov rcx, qword [rbp + 0x20b0]
xor rcx, rsp
call fcn.180385c10
lea r11, [rsp + 0x21c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret