Function at 0x180074030
Capabilities:
Create process on windows

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0x20c0]
mov eax, 0x21c0
call fcn.180387970
sub rsp, rax
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x21e8], rbx
mov qword [rsp + 0x21f0], rsi
mov qword [rsp + 0x21f8], rdi
mov rax, qword [0x1804cc010]
xor rax, rsp
mov qword [rbp + 0x20b0], rax
mov rbx, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
cmp qword [rcx + 8], r15
je 0x180074c51
mov rcx, qword [rcx]
test rcx, rcx
je 0x180074c51
mov rax, qword [rcx]
call qword [rax + 0x78]
mov rdi, rax
test rax, rax
je 0x180074c51
xor edx, edx
mov r8d, 0x201b
lea rcx, [rbp - 0x3c]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x1fe3], r15d
mov dword [rbp - 0x40], 0x2027
mov rax, qword [rbx + 8]
mov qword [rbp + 0xfcc], rax
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x30]
mov byte [rbp + 0xfdd], al
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x20]
mov byte [rbp + 0xfdc], al
mov byte [rbp + 0xfde], 1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2080], xmm0
movdqa xmm1, xmmword [0x1803e7600]
movdqu xmmword [rbp + 0x2080], xmm1
mov word [rbp + 0x2070], r15w
mov rax, qword [rdi]
lea rdx, [rbp + 0x2070]
mov rcx, rdi
call qword [rax + 0x50]
lea rax, [rbp + 0x2070]
cmp qword [rbp + 0x2088], 8
cmovae rax, qword [rbp + 0x2070]
movzx eax, byte [rax]
mov byte [rbp + 0x1fe2], al
mov word [rbp + 0x1fdf], 0x101
mov byte [rbp + 0x1fe1], r15b
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2040], xmm0
movdqa xmm1, xmmword [0x1803e7600]
movdqu xmmword [rbp + 0x2040], xmm1
mov word [rbp + 0x2030], r15w
mov rcx, qword [rbp + 0x2040]
mov rdx, qword [rbp + 0x2048]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x1800741d7
lea rdi, [rcx + 6]
mov qword [rbp + 0x2040], rdi
lea rbx, [rbp + 0x2030]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x2030]
lea rcx, [rbx + rcx*2]
lea r8d, [r15 + 0xc]
lea rdx, [0x1803c0df0]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x1800741fa
mov qword [rsp + 0x20], 6
lea r9, [0x1803c0df0]
xor r8d, r8d
lea edx, [r8 + 6]
lea rcx, [rbp + 0x2030]
call fcn.180009e30
lea rdx, [rbp + 0x2010]
lea rcx, [rbp - 0x40]
call fcn.180073de0
nop
mov r9, rax
cmp qword [rax + 0x18], 8
jb 0x180074218
mov r9, qword [rax]
mov rdx, qword [rax + 0x10]
mov rcx, qword [rbp + 0x2040]
mov r8, qword [rbp + 0x2048]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x18007426a
lea rdi, [rcx + rdx]
mov qword [rbp + 0x2040], rdi
lea rbx, [rbp + 0x2030]
cmp r8, 8
cmovae rbx, qword [rbp + 0x2030]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x18007427f
mov qword [rsp + 0x20], rdx
xor r8d, r8d
lea rcx, [rbp + 0x2030]
call fcn.180009e30
nop
mov rdx, qword [rbp + 0x2028]
cmp rdx, 8
jb 0x1800742c8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2010]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800742c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800742c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180386950
movdqa xmm0, xmmword [0x1803e7600]
movdqu xmmword [rbp + 0x2020], xmm0
mov word [rbp + 0x2010], r15w
lea rcx, [rbp + 0x2030]
cmp qword [rbp + 0x2048], 8
cmovae rcx, qword [rbp + 0x2030]
lea rdx, [rbp + 0xfdf]
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180074310
xor bl, bl
cmp byte [0x1804dd074], bl
jne 0x180074b8a
mov byte [0x1804dd074], 1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20a0], xmm0
movdqa xmm1, xmmword [0x1803e7600]
movdqu xmmword [rbp + 0x20a0], xmm1
mov word [rbp + 0x2090], r15w
mov r8d, 0x12
lea rdx, str.2345PicCapture.exe
lea rcx, [rbp + 0x2090]
call fcn.180004ea0
nop
lea rdx, [rbp + 0x2090]
lea rcx, [rbp + 0x2050]
call fcn.1801fdbc0
nop
mov rdx, qword [rbp + 0x20a8]
cmp rdx, 8
jb 0x1800743cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2090]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800743ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800743ca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180386950
movdqa xmm0, xmmword [0x1803e7600]
movdqu xmmword [rbp + 0x20a0], xmm0
mov word [rbp + 0x2090], r15w
lea rcx, [rbp + 0x2050]
call fcn.1801559c0
test al, al
je 0x180074b27
lea rcx, [rbp + 0x2050]
cmp qword [rbp + 0x2068], 8
cmovae rcx, qword [rbp + 0x2050]
mov r8b, 1
call fcn.1801fff00
test al, al
je 0x180074b27
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2000], xmm0
movdqa xmm1, xmmword [0x1803e7600]
movdqu xmmword [rbp + 0x2000], xmm1
mov word [rbp + 0x1ff0], r15w
mov rdx, qword [rbp + 0xfcc]
lea rcx, [rbp + 0x2010]
call fcn.180154280
mov rbx, rax
lea rax, [rbp + 0x1ff0]
cmp rax, rbx
je 0x180074498
lea rcx, [rbp + 0x1ff0]
call fcn.180004e20
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x1ff0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x2000], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rbp + 0x2028]
cmp rdx, 8
jb 0x1800744e1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2010]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800744dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800744dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180386950
movdqa xmm0, xmmword [0x1803e7600]
movdqu xmmword [rbp + 0x2020], xmm0
mov word [rbp + 0x2010], r15w
lea rdx, [rbp + 0x2050]
lea rcx, [rbp + 0x2010]
call fcn.18015acc0
mov rbx, rax
lea rax, [rbp + 0x2050]
cmp rax, rbx
je 0x18007454c
lea rcx, [rbp + 0x2050]
call fcn.180004e20
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x2050], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x2060], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rbp + 0x2028]
cmp rdx, 8
jb 0x180074595
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2010]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180074590
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180074590
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180386950
movdqa xmm0, xmmword [0x1803e7600]
movdqu xmmword [rbp + 0x2020], xmm0
mov word [rbp + 0x2010], r15w
mov rcx, qword [rbp + 0x2000]
mov rdx, qword [rbp + 0x2008]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180074602
lea rdi, [rcx + 1]
mov qword [rbp + 0x2000], rdi
lea rbx, [rbp + 0x1ff0]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1803c3bd8]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x180074626
mov qword [rsp + 0x20], 1
lea r9, [0x1803c3bd8]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0x1ff0]
call fcn.180009e30
nop
mov rdx, r15
cmp byte [rbp + 0xfdd], r15b
setne dl
lea rcx, [rbp + 0x2010]
call fcn.180154280
mov esi, 4
mov dword [rsp + 0x30], esi
and esi, 0xfffffffb
mov dword [rsp + 0x30], esi
or esi, 2
mov dword [rsp + 0x30], esi
lea r9, [rbp + 0x2010]
cmp qword [rbp + 0x2028], 8
cmovae r9, qword [rbp + 0x2010]
mov rdi, qword [rbp + 0x2020]
mov r14, qword [rbp + 0x2000]
mov rcx, qword [rbp + 0x2008]
mov rax, rcx
sub rax, r14
cmp rdi, rax
ja 0x1800746c6
lea rax, [r14 + rdi]
mov qword [rbp + 0x2000], rax
lea rbx, [rbp + 0x1ff0]
cmp rcx, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea r8, [rdi + rdi]
lea rcx, [rbx + r14*2]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r15w
jmp 0x1800746dd
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x1ff0]
call fcn.180009e30
and esi, 0xfffffffd
mov dword [rsp + 0x30], esi
mov rdx, qword [rbp + 0x2028]
cmp rdx, 8
jb 0x18007472d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2010]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180074728
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180074728
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180386950
movdqa xmm0, xmmword [0x1803e7600]
movdqu xmmword [rbp + 0x2020], xmm0
mov word [rbp + 0x2010], r15w
mov rcx, qword [rbp + 0x2000]
mov rdx, qword [rbp + 0x2008]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x18007479a
lea rdi, [rcx + 1]
mov qword [rbp + 0x2000], rdi
lea rbx, [rbp + 0x1ff0]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1803c3bd8]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x1800747be
mov qword [rsp + 0x20], 1
lea r9, [0x1803c3bd8]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0x1ff0]
call fcn.180009e30
nop
mov rdx, r15
cmp byte [rbp + 0xfdc], r15b
setne dl
lea rcx, [rbp + 0x2010]
call fcn.180154280
or esi, 0x10
mov dword [rsp + 0x30], esi
and esi, 0xffffffef
mov dword [rsp + 0x30], esi
or esi, 8
mov dword [rsp + 0x30], esi
lea r9, [rbp + 0x2010]
cmp qword [rbp + 0x2028], 8
cmovae r9, qword [rbp + 0x2010]
mov rdi, qword [rbp + 0x2020]
mov r14, qword [rbp + 0x2000]
mov rcx, qword [rbp + 0x2008]
mov rax, rcx
sub rax, r14
cmp rdi, rax
ja 0x18007485c
lea rax, [r14 + rdi]
mov qword [rbp + 0x2000], rax
lea rbx, [rbp + 0x1ff0]
cmp rcx, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea r8, [rdi + rdi]
lea rcx, [rbx + r14*2]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r15w
jmp 0x180074873
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x1ff0]
call fcn.180009e30
and esi, 0xfffffff7
mov dword [rsp + 0x30], esi
mov rdx, qword [rbp + 0x2028]
cmp rdx, 8
jb 0x1800748c3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2010]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800748be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800748be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180386950
movdqa xmm0, xmmword [0x1803e7600]
movdqu xmmword [rbp + 0x2020], xmm0
mov word [rbp + 0x2010], r15w
mov rcx, qword [rbp + 0x2000]
mov rdx, qword [rbp + 0x2008]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x180074930
lea rdi, [rcx + 1]
mov qword [rbp + 0x2000], rdi
lea rbx, [rbp + 0x1ff0]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea rcx, [rbx + rcx*2]
mov r8d, 2
lea rdx, [0x1803c3bd8]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x180074953
mov qword [rsp + 0x20], 1
lea r9, [0x1803c3bd8]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0x1ff0]
call fcn.180009e30
lea rax, [rbp + 0xfdf]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x180074961
mov rcx, qword [rbp + 0x2000]
mov r8, qword [rbp + 0x2008]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1800749bd
lea rdi, [rdx + rcx]
mov qword [rbp + 0x2000], rdi
lea rbx, [rbp + 0x1ff0]
cmp r8, 8
cmovae rbx, qword [rbp + 0x1ff0]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
lea rdx, [rbp + 0xfdf]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x1800749d8
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0xfdf]
xor r8d, r8d
lea rcx, [rbp + 0x1ff0]
call fcn.180009e30
xor eax, eax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov dword [rbp - 0x5c], eax
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x540
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], r15
lea rax, [rbp + 0x2050]
cmp qword [rbp + 0x2068], 8
cmovae rax, qword [rbp + 0x2050]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x1ff0]
cmp qword [rbp + 0x2008], 8
cmovae rax, qword [rbp + 0x1ff0]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], 1
mov qword [rbp - 0x58], r15
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne bl
mov byte [0x1804dd074], 0
mov rdx, qword [rbp + 0x2008]
cmp rdx, 8
jb 0x180074ac0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1ff0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180074abb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180074abb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180386950
movdqa xmm0, xmmword [0x1803e7600]
movdqu xmmword [rbp + 0x2000], xmm0
mov word [rbp + 0x1ff0], r15w
mov rdx, qword [rbp + 0x2068]
cmp rdx, 8
jb 0x180074b72
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2050]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180074b20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180074b20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180386950
jmp 0x180074b72
mov rdx, qword [rbp + 0x2068]
cmp rdx, 8
jb 0x180074b70
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2050]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180074b6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180074b6b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180386950
xor bl, bl
movdqa xmm0, xmmword [0x1803e7600]
mov word [rbp + 0x2050], r15w
movdqu xmmword [rbp + 0x2060], xmm0
mov rdx, qword [rbp + 0x2048]
cmp rdx, 8
jb 0x180074bd3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2030]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180074bce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180074bce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180386950
movdqa xmm0, xmmword [0x1803e7600]
movdqu xmmword [rbp + 0x2040], xmm0
mov word [rbp + 0x2030], r15w
mov rdx, qword [rbp + 0x2088]
cmp rdx, 8
jb 0x180074c34
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2070]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180074c2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180074c2f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180386950
movdqa xmm0, xmmword [0x1803e7600]
movdqu xmmword [rbp + 0x2080], xmm0
mov word [rbp + 0x2070], r15w
movzx eax, bl
jmp 0x180074c53
xor al, al
mov rcx, qword [rbp + 0x20b0]
xor rcx, rsp
call fcn.1803868f0
lea r11, [rsp + 0x21c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret