Function at 0x1800115f0
Capabilities:
Create process on windows

Disassembly:
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x740
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x780], rbx
mov rax, qword [0x180082098]
xor rax, rsp
mov qword [rsp + 0x730], rax
mov rdi, rdx
mov r15, rcx
cmp dword [rdx], 0x68
jne 0x1800116d4
test dword [rdx + 4], 0x4000
je 0x1800116d4
cmp word [rdx + 0x42], 0
je 0x1800116d4
mov rdx, qword [rdx + 0x40]
movdqa xmm0, xmmword [0x18005caf0]
movdqu xmmword [rsp + 0xe0], xmm0
xor esi, esi
mov word [rsp + 0xd0], si
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rdx + r8*2], si
jne 0x180011673
lea rcx, [rsp + 0xd0]
call fcn.1800046a0
mov rdx, qword [rsp + 0xe8]
cmp rdx, 8
jb 0x1800116da
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800116cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180011c0c
call fcn.18001b158
jmp 0x1800116da
xor esi, esi
lea rbx, [rsi - 1]
cmp word [rdi + 0x12], 0
jne 0x180011aef
movzx edx, word [rdi + 0x10]
mov rcx, qword [r15 + 0x38]
mov rax, qword [r15 + 0x40]
sub rax, rcx
sar rax, 2
cmp rdx, rax
jae 0x180011bdf
mov r13d, dword [rcx + rdx*4]
mov edi, 1
lea rbx, [r15 + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18001171b
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov r14, rax
lea eax, [r13 - 0x3ea]
cmp eax, 0xc
ja case.0x180011747.1009
cdqe
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x11c20]
add rcx, rdx
jmp rcx
lea rdx, str..doc
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x1800118b5
lea rdx, str..docx
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x1800118b5
lea rdx, str..xlsx
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180011899
lea rdx, str..xls
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180011899
lea rdx, str..pptx
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x18001187d
lea rdx, str..ppt
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x18001187d
lea rdx, str..jpg
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180011861
lea rdx, str..png
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180011861
lea rdx, str..bmp
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180011861
lea rdx, str..jpeg
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180011861
lea rdx, str..tif
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180011861
lea rdx, str..tiff
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je case.0x180011747.1009
cmp qword [rbx + 0x18], 8
jb 0x18001186b
mov rbx, qword [rbx]
mov edx, 0x18
mov rcx, rbx
call fcn.180012a40
jmp 0x180011adb
cmp qword [rbx + 0x18], 8
jb 0x180011887
mov rbx, qword [rbx]
mov edx, 0x17
mov rcx, rbx
call fcn.180012a40
jmp 0x180011adb
cmp qword [rbx + 0x18], 8
jb 0x1800118a3
mov rbx, qword [rbx]
mov edx, 0x16
mov rcx, rbx
call fcn.180012a40
jmp 0x180011adb
cmp qword [rbx + 0x18], 8
jb 0x1800118bf
mov rbx, qword [rbx]
mov edx, 0x15
mov rcx, rbx
call fcn.180012a40
jmp 0x180011adb
cmp qword [rbx + 0x18], 8
jb 0x1800118db
mov rbx, qword [rbx]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x110]
call fcn.180039590
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x320]
call fcn.180039590
mov r8d, 0x104
lea rdx, [rsp + 0x110]
mov rcx, qword [0x180084e50]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x110]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, str.BKPdf.exe
lea rcx, [rsp + 0x110]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x110]
lea r8, str._s___s_
mov edx, 0x208
lea rcx, [rsp + 0x320]
call fcn.180017220
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rsp + 0x64]
call fcn.180039590
xor eax, eax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0x60], 0x68
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x320]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je case.0x180011747.1009
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x180011747.1009
cmp qword [rbx + 0x18], 8
jb 0x1800119ff
mov rbx, qword [rbx]
mov edx, edi
mov rcx, rbx
call fcn.180012a40
jmp 0x180011adb
cmp qword [rbx + 0x18], 8
jb 0x180011a18
mov rbx, qword [rbx]
mov edx, 2
mov rcx, rbx
call fcn.180012a40
jmp 0x180011adb
cmp qword [rbx + 0x18], 8
jb 0x180011a34
mov rbx, qword [rbx]
mov edx, 3
mov rcx, rbx
call fcn.180012a40
jmp 0x180011adb
cmp qword [rbx + 0x18], 8
jb 0x180011a50
mov rbx, qword [rbx]
mov edx, 0x2b
mov rcx, rbx
call fcn.180012a40
jmp 0x180011adb
cmp qword [rbx + 0x18], 8
jb 0x180011a6c
mov rbx, qword [rbx]
mov edx, 4
mov rcx, rbx
call fcn.180012a40
jmp 0x180011adb
cmp qword [rbx + 0x18], 8
jb 0x180011a85
mov rbx, qword [rbx]
mov edx, 0x1f
mov rcx, rbx
call fcn.180012a40
jmp 0x180011adb
cmp qword [rbx + 0x18], 8
jb 0x180011a9e
mov rbx, qword [rbx]
mov edx, 0x20
mov rcx, rbx
call fcn.180012a40
jmp 0x180011adb
cmp qword [rbx + 0x18], 8
jb 0x180011ab7
mov rbx, qword [rbx]
mov edx, 0x26
mov rcx, rbx
call fcn.180012a40
jmp 0x180011adb
cmp qword [rbx + 0x18], 8
jb 0x180011ad0
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, r15
call fcn.180013080
mov edi, esi
test eax, eax
sete dil
mov eax, edi
jmp 0x180011be4
mov rdx, qword [rdi + 0x10]
movdqa xmm0, xmmword [0x18005cb00]
movdqu xmmword [rsp + 0xe0], xmm0
mov byte [rsp + 0xd0], 0
nop dword [rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x180011b10
mov r8, rbx
lea rcx, [rsp + 0xd0]
call fcn.180004850
nop
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xf0]
call fcn.18000d5b0
mov rdx, qword [rsp + 0x108]
cmp rdx, 8
jb 0x180011b87
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011b82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180011c12
call fcn.18001b158
movdqa xmm0, xmmword [0x18005caf0]
movdqu xmmword [rsp + 0x100], xmm0
mov word [rsp + 0xf0], si
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0x10
jb 0x180011bdf
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011bda
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180011c18
call fcn.18001b158
mov eax, 0x80004005
mov rcx, qword [rsp + 0x730]
xor rcx, rsp
call fcn.18001b2e0
mov rbx, qword [rsp + 0x780]
add rsp, 0x740
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
call fcn.18003cd34
nop
call fcn.18003cd34
nop
call fcn.18003cd34
int3