Function at 0x180017a20
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r12
lea rbp, [rsp - 0x540]
sub rsp, 0x640
mov rax, qword [0x1801003f0]
xor rax, rsp
mov qword [rbp + 0x530], rax
cmp dword [0x1801161a0], 0
mov rsi, rcx
je 0x180017a9c
lea r9, str.CMonitorThread::CheckAgent_1
lea r8, str.WatchDog
lea rcx, [0x1801160e8]
mov edx, 0xf
call fcn.180011c50
cmp dword [0x1801161a0], 0
je 0x180017a9c
lea r9, str.CMonitorThread::CheckAgent_2
lea r8, str.WatchDog
lea rcx, [0x1801160e8]
mov edx, 0xf
call fcn.180011c50
lea rcx, [rbp - 0x1f]
xor edx, edx
mov r8d, 0x103
mov byte [rbp - 0x20], 0
call fcn.1800369b0
lea rcx, [rbp + 0xf1]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0xf0], 0
call fcn.1800369b0
lea rcx, [rbp + 0x421]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x420], 0
call fcn.1800369b0
call fcn.18002c330
test eax, eax
jne 0x180017b01
lea rcx, [rbp - 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x180017b18
call fcn.180001310
lea rcx, [rbp - 0x20]
mov r8d, 0x103
mov rdx, rax
call fcn.180036c70
call fcn.180005960
lea r8, [rbp - 0x20]
lea rdx, [0x1800c1ec8]
lea rcx, [rbp + 0xf0]
mov r9, rax
call fcn.18003756c
lea r9, [0x1800c7ce0]
lea r8, [rbp + 0xf0]
lea rdx, str._s__s_RunAgent32
lea rcx, [rbp + 0x420]
call fcn.18003756c
lea rcx, [rbp + 0x311]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x310], 0
call fcn.1800369b0
call fcn.180001310
lea rcx, [rbp + 0x310]
mov rdx, rax
mov r8d, 0x103
call fcn.180036c70
lea rcx, [rbp + 0x201]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x200], 0
call fcn.1800369b0
lea r9, [0x1800c7ce0]
lea r8, [rbp + 0x310]
lea rdx, [0x1800c1ec8]
lea rcx, [rbp + 0x200]
call fcn.18003756c
xor r12d, r12d
cmp dword [0x1801161a0], r12d
mov dword [rsp + 0x50], r12d
je 0x180017bf9
lea r9, str.CMonitorThread::CheckAgent_3
lea r8, str.WatchDog
lea edx, [r12 + 0xf]
lea rcx, [0x1801160e8]
call fcn.180011c50
lea r8, [rsp + 0x50]
lea rdx, str.RunAgent32
lea rcx, [rbp + 0x200]
call fcn.180013130
cmp dword [0x1801161a0], r12d
mov ebx, eax
je 0x180017c3b
lea r9, str.CMonitorThread::CheckAgent_4
lea r8, str.WatchDog
lea rcx, [0x1801160e8]
mov edx, 0xf
call fcn.180011c50
mov qword [rsp + 0x668], rdi
test ebx, ebx
je 0x180017de4
lea rcx, [rbp + 0x200]
call fcn.1800134e0
cmp dword [0x1801161a0], r12d
mov ebx, eax
je 0x180017c85
lea r9, str.CMonitorThread::CheckAgent_5___lu_
lea r8, str.WatchDog
lea rcx, [0x1801160e8]
mov edx, 0xf
mov dword [rsp + 0x20], eax
call fcn.180011c50
test ebx, ebx
je 0x180017de4
mov ebx, r12d
inc ebx
cmp dword [0x1801161a0], r12d
je 0x180017cba
lea r9, str.CMonitorThread::CheckAgent_6
lea r8, str.WatchDog
lea rcx, [0x1801160e8]
mov edx, 0xf
call fcn.180011c50
xor edx, edx
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x70], r12d
lea r8d, [rdx + 0x60]
call fcn.1800369b0
xor eax, eax
lea rdx, [rbp + 0x420]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x20]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
xor ecx, ecx
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp dword [0x1801161a0], r12d
mov edi, eax
je 0x180017d4e
lea r9, str.CMonitorThread::CheckAgent_7
lea r8, str.WatchDog
lea rcx, [0x1801160e8]
mov edx, 0xf
call fcn.180011c50
test edi, edi
jne 0x180017d9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x180017d91
lea rcx, [rbp + 0xf0]
xor edx, edx
call fcn.18000bcd0
cmp dword [0x1801161a0], r12d
je 0x180017d91
lea r9, str.CMonitorThread::CheckAgent_9
lea r8, str.WatchDog
lea edx, [rdi + 0xf]
lea rcx, [0x1801160e8]
call fcn.180011c50
cmp ebx, 2
jl 0x180017c90
jmp 0x180017de4
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsi + 0x8c], 1
cmp dword [0x1801161a0], r12d
je 0x180017e0c
lea r9, str.CMonitorThread::CheckAgent_8
lea r8, str.WatchDog
lea rcx, [0x1801160e8]
mov edx, 0xf
call fcn.180011c50
cmp dword [0x1801161a0], r12d
je 0x180017e0c
lea r9, str.CMonitorThread::CheckAgent_10
lea r8, str.WatchDog
lea rcx, [0x1801160e8]
mov edx, 0xf
call fcn.180011c50
mov rdi, qword [rsp + 0x668]
mov rcx, qword [rbp + 0x530]
xor rcx, rsp
call fcn.180036980
mov rbx, qword [rsp + 0x670]
add rsp, 0x640
pop r12
pop rsi
pop rbp
ret