Function at 0x1800124e0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1804ca010]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rbx, rcx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
lea rdx, [rcx + 0x20]
lea rcx, [rbp]
call fcn.180004aa0
nop
cmp qword [rbx + 0x30], r12
jne 0x180012605
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x180012638
cmp qword [rbx + 0x10], r12
je 0x180012638
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
call qword [rax + 0x68]
mov rdi, rax
lea rax, [rbp]
cmp rax, rdi
je 0x18001258d
lea rcx, [rbp]
call fcn.180004df0
movups xmm0, xmmword [rdi]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 7
mov word [rdi], r12w
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x1800125d0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800125cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800125cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov r10, qword [rbx + 0x10]
mov edx, 0x11be
mov rcx, r10
call fcn.1802612b0
bt eax, 9
jae 0x180012605
mov edx, 0x12ee
mov rcx, r10
call fcn.180261830
mov edi, r12d
mov esi, r12d
mov eax, dword [rbx + 0x40]
mov r14d, 3
cmp eax, 0x9c52
jg 0x180012644
je 0x18001263f
cmp eax, 0x1074
je 0x180012659
cmp eax, 0x1353
je 0x18001263f
cmp eax, 0x9c51
jne 0x180012661
lea esi, [r14 + 1]
jmp 0x18001265c
xor bl, bl
jmp 0x180012bcb
mov esi, r14d
jmp 0x18001265c
cmp eax, 0x9cba
je 0x180012659
cmp eax, 0xc350
jne 0x180012661
mov esi, 2
jmp 0x18001265c
mov esi, r12d
mov edi, 5
xor r9d, r9d
lea r8, str.RCMainFrameWnd2345PicEdit
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov r15, rax
test rax, rax
je 0x180012840
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x180012840
cmp qword [rbp + 0x10], 0
je 0x180012825
mov qword [rsp + 0x38], r12
mov ecx, 0x58
call fcn.180385c34
mov rbx, rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov r8d, 0x19
lea rdx, str.RCMainFrameWnd2345PicEdit
lea rcx, [rbp - 0x40]
call fcn.180004e70
nop
mov dword [rsp + 0x30], 1
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
mov r8d, 0x43
lea rdx, str.RC_MAIN_INSTANCE_2345PICEDIT_C24237CB_7988_4196_8FBA_716DD0BC9F5D
lea rcx, [rbp - 0x20]
call fcn.180004e70
nop
mov dword [rsp + 0x30], r14d
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.180200410
mov rbx, rax
mov qword [rsp + 0x38], rax
and r14d, 0xfffffffd
mov dword [rsp + 0x30], r14d
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x180012784
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001277f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001277f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
and r14d, 0xfffffffe
mov dword [rsp + 0x30], r14d
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x1800127e1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800127dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800127dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov rcx, rbx
call fcn.180200750
test al, al
je 0x18001280b
lea rdx, [rbp]
mov rcx, rbx
call fcn.180200f40
nop
test rbx, rbx
je 0x180012825
mov rcx, rbx
call fcn.180200550
mov edx, 0x58
mov rcx, rbx
call fcn.180385c70
mov r9d, esi
mov r8d, edi
mov edx, 0x40b
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
mov bl, 1
jmp 0x180012bcb
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov r8d, 0xf
lea rdx, str.2345PicEdit.exe
lea rcx, [rbp - 0x40]
call fcn.180004e70
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x20]
call fcn.1801fdce0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x1800128c1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800128bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800128bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
lea rcx, [rbp + 0x20]
call fcn.180155ab0
test al, al
je 0x180012b75
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8b, 1
call fcn.180200020
test al, al
je 0x180012b75
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.18015adb0
mov rbx, rax
lea rax, [rbp + 0x20]
cmp rax, rbx
je 0x180012942
lea rcx, [rbp + 0x20]
call fcn.180004df0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x180012985
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180012980
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180012980
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r12w
cmp qword [rbp + 0x10], 0
je 0x180012a76
lea rdx, [rbp]
lea rcx, [rbp - 0x20]
call fcn.18015adb0
mov rbx, rax
lea rax, [rbp]
cmp rax, rbx
je 0x1800129fb
lea rcx, [rbp]
call fcn.180004df0
movups xmm0, xmmword [rbx]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x180012a3e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180012a39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180012a39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
lea r8, [rbp]
cmp qword [rbp + 0x18], 8
cmovae r8, qword [rbp]
mov dword [rsp + 0x20], esi
mov r9d, edi
lea rdx, str.__file_s___pagetype_d___subtype_d___source2345Pic___functionpic
lea rcx, [rbp + 0x40]
call fcn.180154c50
jmp 0x180012a8c
mov r9d, esi
mov r8d, edi
lea rdx, str.__pagetype_d___subtype_d
lea rcx, [rbp + 0x40]
call fcn.180154c50
xor eax, eax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov dword [rbp - 0x5c], eax
mov dword [rsp + 0x40], 0x70
mov dword [rsp + 0x44], 0x100000
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], r12
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rax, qword [rbp + 0x20]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rax, qword [rbp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x70], 1
mov qword [rbp - 0x58], r12
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x180012b1d
cmp qword [rsp + 0x78], 0x20
jbe 0x180012b1d
mov bl, 1
jmp 0x180012b1f
xor bl, bl
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180012b62
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180012b5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180012b5d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r12w
jmp 0x180012b77
xor bl, bl
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180012bba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180012bb5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180012bb5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r12w
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x180012c0e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180012c09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180012c09
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180385c70
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 7
mov word [rbp], r12w
movzx eax, bl
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.180385c10
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret