Function at 0x180035390
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x6c8]
sub rsp, 0x7a0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x180142d48]
xor rax, rsp
mov qword [rbp + 0x690], rax
mov r12d, ecx
mov dword [rsp + 0x38], 0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x480]
call fcn.18009b170
mov r8d, 0x104
lea rdx, [rbp + 0x480]
mov rcx, qword [0x1801530b8]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x480]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, str.Utils_rundll.exe
lea rcx, [rbp + 0x480]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x480]
call fcn.1800743b0
test eax, eax
jne 0x1800355f4
call fcn.18007a080
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + 0x10]
cmp al, 1
jne 0x180035c0e
movdqa xmm0, xmmword [0x1801180e0]
movdqu xmmword [rbp + 0x410], xmm0
mov byte [rbp + 0x400], 0
mov r8d, 0x5c
lea rdx, str.d:jenkins.jenkinsworkspacemaster_lucomputerz_band_win10computerz7_band_win10utils.cpp
lea rcx, [rbp + 0x400]
call fcn.18000f910
nop
movdqa xmm0, xmmword [0x1801180e0]
movdqu xmmword [rbp + 0x390], xmm0
mov byte [rbp + 0x380], 0
mov r8d, 3
lea rdx, [0x1800f4ed4]
lea rcx, [rbp + 0x380]
call fcn.18000f910
nop
call fcn.18007a080
mov rdi, rax
lea r9, [rbp + 0x480]
lea r8, str.SignCheck_error:_s
mov edx, 1
lea rcx, [rsp + 0x50]
call fcn.180079c10
nop
mov r9d, 0x12b
lea r8, [rbp + 0x400]
lea rdx, [rbp + 0x380]
lea rcx, [rbp - 0x20]
call fcn.1800143c0
mov rbx, rax
mov rcx, qword [rsp + 0x50]
lea rdx, [0x1800f4e38]
test rcx, rcx
cmovne rdx, rcx
mov rcx, rax
call fcn.180013a00
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r8 + 0x38]
nop
lea rcx, [rbp - 0x20]
call fcn.1800147c0
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov esi, 0xffffffff
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x180035552
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x398]
cmp rdx, 0x10
jb 0x180035593
inc rdx
mov rcx, qword [rbp + 0x380]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003558e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180035c3f
call fcn.180050640
movdqa xmm0, xmmword [0x1801180e0]
movdqu xmmword [rbp + 0x390], xmm0
mov byte [rbp + 0x380], 0
mov rdx, qword [rbp + 0x418]
cmp rdx, 0x10
jb 0x180035c0e
inc rdx
mov rcx, qword [rbp + 0x400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800355ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180035c45
call fcn.180050640
jmp 0x180035c0e
call fcn.180011c30
mov rcx, rax
test rax, rax
je 0x180035c4b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea r9, [0x1800f9c60]
lea r8, [0x1800f9c88]
lea rdx, str.__dll_s___entry_s
lea rcx, [rsp + 0x30]
call fcn.18002bf40
call fcn.18007a080
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + 0x10]
lea r14, [0x1800f4e38]
mov esi, 0xffffffff
cmp al, 1
jne 0x180035837
movdqa xmm0, xmmword [0x1801180e0]
movdqu xmmword [rbp + 0x430], xmm0
mov byte [rbp + 0x420], 0
lea r8d, [rsi + 0x5d]
lea rdx, str.d:jenkins.jenkinsworkspacemaster_lucomputerz_band_win10computerz7_band_win10utils.cpp
lea rcx, [rbp + 0x420]
call fcn.18000f910
nop
movdqa xmm0, xmmword [0x1801180e0]
movdqu xmmword [rbp + 0x3b0], xmm0
mov byte [rbp + 0x3a0], 0
lea r8d, [rsi + 4]
lea rdx, [0x1800f4ed4]
lea rcx, [rbp + 0x3a0]
call fcn.18000f910
nop
call fcn.18007a080
mov rdi, rax
mov rcx, qword [rsp + 0x30]
add rcx, 0xffffffffffffffe8
call fcn.180013250
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x480]
lea r8, [0x1800f9cd0]
lea edx, [rsi + 3]
lea rcx, [rsp + 0x60]
call fcn.180079c10
mov r15, rax
mov dword [rsp + 0x38], 2
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x18003572c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov r9d, 0x131
lea r8, [rbp + 0x420]
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0xc8]
call fcn.1800143c0
mov rbx, rax
mov rcx, qword [r15]
mov rdx, r14
test rcx, rcx
cmovne rdx, rcx
mov rcx, rax
call fcn.180013a00
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r8 + 0x38]
nop
lea rcx, [rbp + 0xc8]
call fcn.1800147c0
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18003579e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x3b8]
cmp rdx, 0x10
jb 0x1800357df
inc rdx
mov rcx, qword [rbp + 0x3a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800357da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180035c56
call fcn.180050640
movdqa xmm0, xmmword [0x1801180e0]
movdqu xmmword [rbp + 0x3b0], xmm0
mov byte [rbp + 0x3a0], 0
mov rdx, qword [rbp + 0x438]
cmp rdx, 0x10
jb 0x180035837
inc rdx
mov rcx, qword [rbp + 0x420]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180035832
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180035c5c
call fcn.180050640
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x70]
call fcn.18009b170
mov dword [rsp + 0x70], 0x70
lea rax, [rbp + 0x480]
mov qword [rbp - 0x78], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x60], 0
mov dword [rsp + 0x74], 0x440
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x180035bf2
call fcn.18007a080
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + 0x10]
cmp al, 1
jne 0x180035a2c
movdqa xmm0, xmmword [0x1801180e0]
movdqu xmmword [rbp + 0x450], xmm0
mov byte [rbp + 0x440], 0
mov r8d, 0x5c
lea rdx, str.d:jenkins.jenkinsworkspacemaster_lucomputerz_band_win10computerz7_band_win10utils.cpp
lea rcx, [rbp + 0x440]
call fcn.18000f910
nop
movdqa xmm0, xmmword [0x1801180e0]
movdqu xmmword [rbp + 0x3d0], xmm0
mov byte [rbp + 0x3c0], 0
mov r8d, 3
lea rdx, [0x1800f4ed4]
lea rcx, [rbp + 0x3c0]
call fcn.18000f910
nop
call fcn.18007a080
mov rdi, rax
lea r8, str.rundll.exe_shell_Execute_success_
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.180079c10
nop
mov r9d, 0x13d
lea r8, [rbp + 0x440]
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x1b0]
call fcn.1800143c0
mov rbx, rax
mov rcx, qword [rsp + 0x58]
mov rdx, r14
test rcx, rcx
cmovne rdx, rcx
mov rcx, rax
call fcn.180013a00
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r8 + 0x38]
nop
lea rcx, [rbp + 0x1b0]
call fcn.1800147c0
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180035993
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x3d8]
cmp rdx, 0x10
jb 0x1800359d4
inc rdx
mov rcx, qword [rbp + 0x3c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800359cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180035c62
call fcn.180050640
movdqa xmm0, xmmword [0x1801180e0]
movdqu xmmword [rbp + 0x3d0], xmm0
mov byte [rbp + 0x3c0], 0
mov rdx, qword [rbp + 0x458]
cmp rdx, 0x10
jb 0x180035a2c
inc rdx
mov rcx, qword [rbp + 0x440]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180035a27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180035c68
call fcn.180050640
mov edx, r12d
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x180035be7
call fcn.18007a080
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + 0x10]
cmp al, 1
jne 0x180035be7
movdqa xmm0, xmmword [0x1801180e0]
movdqu xmmword [rbp + 0x470], xmm0
mov byte [rbp + 0x460], 0
mov r8d, 0x5c
lea rdx, str.d:jenkins.jenkinsworkspacemaster_lucomputerz_band_win10computerz7_band_win10utils.cpp
lea rcx, [rbp + 0x460]
call fcn.18000f910
nop
movdqa xmm0, xmmword [0x1801180e0]
movdqu xmmword [rbp + 0x3f0], xmm0
mov byte [rbp + 0x3e0], 0
mov r8d, 3
lea rdx, [0x1800f4ed4]
lea rcx, [rbp + 0x3e0]
call fcn.18000f910
nop
call fcn.18007a080
mov rdi, rax
lea r8, str.ShellExecuteEx_timeout
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.180079c10
nop
mov r9d, 0x142
lea r8, [rbp + 0x460]
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp + 0x298]
call fcn.1800143c0
mov rbx, rax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
cmovne r14, rcx
mov rdx, r14
mov rcx, rax
call fcn.180013a00
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r8 + 0x38]
nop
lea rcx, [rbp + 0x298]
call fcn.1800147c0
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180035b52
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x3f8]
cmp rdx, 0x10
jb 0x180035b93
inc rdx
mov rcx, qword [rbp + 0x3e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180035b8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180035c6e
call fcn.180050640
movdqa xmm0, xmmword [0x1801180e0]
movdqu xmmword [rbp + 0x3f0], xmm0
mov byte [rbp + 0x3e0], 0
mov rdx, qword [rbp + 0x478]
cmp rdx, 0x10
jb 0x180035be7
inc rdx
mov rcx, qword [rbp + 0x460]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180035be2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180035c39
call fcn.180050640
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x180035c0e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x690]
xor rcx, rsp
call fcn.180050ad0
lea r11, [rsp + 0x7a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.18009e27c
nop
call fcn.18009e27c
nop
call fcn.18009e27c
int3
mov ecx, 0x80004005
call fcn.180010480
nop
call fcn.18009e27c
nop
call fcn.18009e27c
nop
call fcn.18009e27c
nop
call fcn.18009e27c
nop
call fcn.18009e27c
int3