Function at 0x18000ce70
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x1800240b0]
xor rax, rsp
mov qword [rbp + 0x370], rax
and qword [rsp + 0x50], 0
xor esi, esi
xor r12d, r12d
and qword [rsp + 0x30], rsi
mov qword [rsp + 0x58], r9
mov r14, r8
mov qword [rsp + 0x40], r12
mov rdi, rdx
xor r15d, r15d
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov rcx, rax
mov edx, 0x20008
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x18000cef0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x18000d01d
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x38]
call fcn.180020308
mov ebx, eax
test eax, eax
jne 0x18000d01d
mov eax, dword [rsp + 0x38]
dec eax
cmp eax, 1
jbe 0x18000cf1e
mov ebx, 5
jmp 0x18000d01d
and qword [rsp + 0x20], rsi
lea r8, [rbp - 0x30]
mov r9d, 0xc8
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
test eax, eax
jne 0x18000cf47
mov ebx, 0xe0000205
jmp 0x18000d01d
lea r9, [rbp + 0x160]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180015aa4
test eax, eax
je 0x18000cee3
mov rdx, r14
mov rcx, rdi
call fcn.180015b9c
mov rsi, rax
test rax, rax
je 0x18000cee3
lea rcx, [rbp - 0x30]
call fcn.180017a84
mov r15, rax
test rax, rax
je 0x18000cf8d
mov r12, rax
jmp 0x18000cfa1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x18000d01d
lea r12, [rbp - 0x30]
and qword [rsp + 0x38], r13
lea r8, [rsp + 0x38]
mov edx, 0xc8
mov rcx, r12
call fcn.180008540
test eax, eax
jns 0x18000cfc4
movzx ebx, ax
mov r12, r13
jmp 0x18000d01d
mov rdi, qword [rsp + 0x38]
lea rcx, [rbp + 0x160]
call fcn.180017a84
mov r13, rax
test rax, rax
je 0x18000cfe2
mov r14, rax
jmp 0x18000cff5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x18000d018
lea r14, [rbp + 0x160]
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov edx, 0x104
mov rcx, r14
call fcn.180008540
test eax, eax
jns 0x18000d0a4
movzx ebx, ax
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18000d032
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x18000d040
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r15, r15
je 0x18000d04e
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r13, r13
je 0x18000d05c
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x18000d06a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r12, r12
je 0x18000d078
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.180001ac0
mov rbx, qword [rsp + 0x4c0]
add rsp, 0x480
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rsp + 0x38]
add rdi, 0x10a
mov rcx, rsi
add rax, rdi
mov qword [rsp + 0x48], rax
call fcn.180017a84
mov rdi, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x18000d0e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x18000d1e1
mov rdi, rsi
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov edx, 0x7fff
mov rcx, rdi
call fcn.180008540
test eax, eax
js 0x18000d015
mov rax, qword [rsp + 0x38]
mov ecx, 0x40
add rax, 4
add rax, qword [rsp + 0x48]
mov qword [rsp + 0x48], rax
lea rdx, [rax + rax]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
jne 0x18000d132
lea ebx, [rax + 8]
mov r12, rax
jmp 0x18000d01d
mov rdx, qword [rsp + 0x48]
mov r9, r12
lea r8, [0x18000d1f0]
mov rcx, rax
mov qword [rsp + 0x28], rdi
mov r12, rax
mov qword [rsp + 0x20], r14
call fcn.18000df90
test eax, eax
jns 0x18000d164
mov ebx, 8
jmp 0x18000d01d
mov edi, 0x70
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, edi
call sub.msvcrt.dll_memset
and qword [rsp + 0x68], 0
lea rax, [0x180020c28]
mov qword [rsp + 0x70], rax
lea rax, [0x18000d228]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x64], 0x4040
mov qword [rbp - 0x80], r12
mov qword [rsp + 0x78], rax
mov dword [rbp - 0x70], 5
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x18000cee3
mov rcx, qword [rbp - 0x38]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x18000d01d
mov r12, qword [rsp + 0x40]
jmp 0x18000d022