Function at 0x180002ad0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rsi, rcx
xor r12d, r12d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
movups xmmword [rbp + 0x54], xmm0
movups xmmword [rbp + 0x64], xmm0
mov dword [rbp + 0x74], eax
mov dword [rbp + 0x10], 0x68
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rax
mov rdx, rcx
cmp qword [rcx + 0x18], 0xf
jbe 0x180002b4a
mov rdx, qword [rcx]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x180002e9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp - 0x48]
call fcn.180008ed0
nop
mov r13, qword [rsi + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 0x1b
jb 0x180003061
cmp qword [rsi + 0x18], 0xf
jbe 0x180002bc3
mov rsi, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea r15, [r13 + 0x1b]
mov ebx, 0xf
mov edi, ebx
lea r14, [rsp + 0x50]
cmp r15, rbx
jbe 0x180002c63
mov rdi, r15
or rdi, rbx
cmp rdi, rcx
jbe 0x180002c24
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.18000c4c4
test rax, rax
je 0x180003067
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x180002c5e
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x180002c3e
mov r14, r12
jmp 0x180002c5e
cmp rcx, 0x1000
jb 0x180002c56
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180003055
jmp 0x180002c05
call fcn.18000c4c4
mov r14, rax
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rdi
movups xmm0, xmmword [str.Failed_to_execute_command:]
movups xmmword [r14], xmm0
movsd xmm0, qword [0x18003a6d8]
movsd qword [r14 + 0x10], xmm0
movzx eax, word [0x18003a6e0]
mov word [r14 + 0x18], ax
movzx eax, byte [0x18003a6e2]
mov byte [r14 + 0x1a], al
lea rcx, [r14 + 0x1b]
mov r8, r13
mov rdx, rsi
call fcn.18002cdb0
mov byte [r14 + r15], 0
mov r8d, 0xe
lea rdx, [0x18003a6b8]
lea rcx, [rsp + 0x50]
call fcn.1800080a0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], rbx
mov byte [rax], 0
lea r9, [rbp - 0x48]
lea r8, [rbp - 0x68]
lea rcx, [rsp + 0x78]
call fcn.18000acb0
nop
mov r8d, 1
lea rdx, [0x18003a6b0]
lea rcx, [rsp + 0x78]
call fcn.1800080a0
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], rbx
mov byte [rax], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x180002d71
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002d6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000306d
call fcn.18000c490
movdqa xmm0, xmmword [0x18003aea0]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x180002dc6
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002db9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003073
call fcn.18000c490
movdqa xmm0, xmmword [0x18003aea0]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x180002e0b
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002dfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003079
call fcn.18000c490
movdqa xmm0, xmmword [0x18003aea0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x180002e51
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002e4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000307f
call fcn.18000c490
lea rcx, [rbp - 0x10]
call fcn.180001fe0
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x180002e96
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002e91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003085
call fcn.18000c490
xor al, al
jmp 0x18000301f
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsi + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0x1f
jb 0x18000308b
cmp qword [rsi + 0x18], 0xf
jbe 0x180002ee8
mov rsi, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea r14, [r15 + 0x1f]
mov ebx, 0xf
lea rdi, [rsp + 0x50]
cmp r14, rbx
jbe 0x180002f87
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x180002f48
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.18000c4c4
test rax, rax
je 0x18000304f
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180002f82
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x180002f62
mov rdi, r12
jmp 0x180002f82
cmp rcx, 0x1000
jb 0x180002f7a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000305b
jmp 0x180002f29
call fcn.18000c4c4
mov rdi, rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rbx
movups xmm0, xmmword [str.Successfully_executed_command:]
movups xmmword [rdi], xmm0
movsd xmm0, qword [0x18003a6f8]
movsd qword [rdi + 0x10], xmm0
mov eax, dword [0x18003a700]
mov dword [rdi + 0x18], eax
movzx eax, word [0x18003a704]
mov word [rdi + 0x1c], ax
movzx eax, byte [0x18003a706]
mov byte [rdi + 0x1e], al
lea rcx, [rdi + 0x1f]
mov r8, r15
mov rdx, rsi
call fcn.18002cdb0
mov byte [rdi + r14], r12b
lea rcx, [rsp + 0x50]
call fcn.180001fe0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x18000301d
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003018
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000304f
call fcn.18000c490
mov al, 1
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.18000c470
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18001472c
nop
call fcn.1800013a0
nop
call fcn.1800013a0
nop
call fcn.180001440
int3
call fcn.18001472c
nop
call fcn.18001472c
nop
call fcn.18001472c
nop
call fcn.18001472c
nop
call fcn.18001472c
nop
call fcn.18001472c
int3
call fcn.180001440
int3