Function at 0x180012510
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1804cd010]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rbx, rcx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
lea rdx, [rcx + 0x20]
lea rcx, [rbp]
call fcn.180004ad0
nop
cmp qword [rbx + 0x30], r12
jne 0x180012635
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x180012668
cmp qword [rbx + 0x10], r12
je 0x180012668
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
call qword [rax + 0x68]
mov rdi, rax
lea rax, [rbp]
cmp rax, rdi
je 0x1800125bd
lea rcx, [rbp]
call fcn.180004e20
movups xmm0, xmmword [rdi]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 7
mov word [rdi], r12w
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x180012600
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800125fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800125fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov r10, qword [rbx + 0x10]
mov edx, 0x11be
mov rcx, r10
call fcn.180263aa0
bt eax, 9
jae 0x180012635
mov edx, 0x12ee
mov rcx, r10
call fcn.180264020
mov edi, r12d
mov esi, r12d
mov eax, dword [rbx + 0x40]
mov r14d, 3
cmp eax, 0x9c52
jg 0x180012674
je 0x18001266f
cmp eax, 0x1074
je 0x180012689
cmp eax, 0x1353
je 0x18001266f
cmp eax, 0x9c51
jne 0x180012691
lea esi, [r14 + 1]
jmp 0x18001268c
xor bl, bl
jmp 0x180012bfb
mov esi, r14d
jmp 0x18001268c
cmp eax, 0x9cba
je 0x180012689
cmp eax, 0xc350
jne 0x180012691
mov esi, 2
jmp 0x18001268c
mov esi, r12d
mov edi, 5
xor r9d, r9d
lea r8, str.RCMainFrameWnd2345PicEdit
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov r15, rax
test rax, rax
je 0x180012870
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x180012870
cmp qword [rbp + 0x10], 0
je 0x180012855
mov qword [rsp + 0x38], r12
mov ecx, 0x58
call fcn.180388424
mov rbx, rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov r8d, 0x19
lea rdx, str.RCMainFrameWnd2345PicEdit
lea rcx, [rbp - 0x40]
call fcn.180004ea0
nop
mov dword [rsp + 0x30], 1
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
mov r8d, 0x43
lea rdx, str.RC_MAIN_INSTANCE_2345PICEDIT_C24237CB_7988_4196_8FBA_716DD0BC9F5D
lea rcx, [rbp - 0x20]
call fcn.180004ea0
nop
mov dword [rsp + 0x30], r14d
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.1802009d0
mov rbx, rax
mov qword [rsp + 0x38], rax
and r14d, 0xfffffffd
mov dword [rsp + 0x30], r14d
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x1800127b4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800127af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800127af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
and r14d, 0xfffffffe
mov dword [rsp + 0x30], r14d
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x180012811
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001280c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001280c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov rcx, rbx
call fcn.180200d10
test al, al
je 0x18001283b
lea rdx, [rbp]
mov rcx, rbx
call fcn.180201500
nop
test rbx, rbx
je 0x180012855
mov rcx, rbx
call fcn.180200b10
mov edx, 0x58
mov rcx, rbx
call fcn.180388460
mov r9d, esi
mov r8d, edi
mov edx, 0x40b
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
mov bl, 1
jmp 0x180012bfb
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov r8d, 0xf
lea rdx, str.2345PicEdit.exe
lea rcx, [rbp - 0x40]
call fcn.180004ea0
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x20]
call fcn.1801fe2a0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x1800128f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800128ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800128ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
lea rcx, [rbp + 0x20]
call fcn.180156070
test al, al
je 0x180012ba5
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8b, 1
call fcn.1802005e0
test al, al
je 0x180012ba5
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.18015b370
mov rbx, rax
lea rax, [rbp + 0x20]
cmp rax, rbx
je 0x180012972
lea rcx, [rbp + 0x20]
call fcn.180004e20
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x1800129b5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800129b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800129b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r12w
cmp qword [rbp + 0x10], 0
je 0x180012aa6
lea rdx, [rbp]
lea rcx, [rbp - 0x20]
call fcn.18015b370
mov rbx, rax
lea rax, [rbp]
cmp rax, rbx
je 0x180012a2b
lea rcx, [rbp]
call fcn.180004e20
movups xmm0, xmmword [rbx]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x180012a6e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180012a69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180012a69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
lea r8, [rbp]
cmp qword [rbp + 0x18], 8
cmovae r8, qword [rbp]
mov dword [rsp + 0x20], esi
mov r9d, edi
lea rdx, str.__file_s___pagetype_d___subtype_d___source2345Pic___functionpic
lea rcx, [rbp + 0x40]
call fcn.180155210
jmp 0x180012abc
mov r9d, esi
mov r8d, edi
lea rdx, str.__pagetype_d___subtype_d
lea rcx, [rbp + 0x40]
call fcn.180155210
xor eax, eax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov dword [rbp - 0x5c], eax
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x100000
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], r12
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rax, qword [rbp + 0x20]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rax, qword [rbp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x70], 1
mov qword [rbp - 0x58], r12
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x180012b4d
cmp qword [rsp + 0x78], 0x20
jbe 0x180012b4d
mov bl, 1
jmp 0x180012b4f
xor bl, bl
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180012b92
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180012b8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180012b8d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r12w
jmp 0x180012ba7
xor bl, bl
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180012bea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180012be5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180012be5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r12w
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x180012c3e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180012c39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180012c39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180388460
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 7
mov word [rbp], r12w
movzx eax, bl
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.180388400
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret