Function at 0x1800601f0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x2f0
mov rax, qword [0x18017c280]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
xor esi, esi
mov r14d, esi
mov dword [rsp + 0x50], esi
xorps xmm0, xmm0
mov dword [rsp + 0x190], 0x4ff4a1e0
mov dword [rsp + 0x194], 0xe387f610
mov dword [rsp + 0x198], 0x1ee3a5eb
mov dword [rsp + 0x19c], 0xaf666b8e
mov dword [rsp + 0x1a0], 0x41904f75
mov dword [rsp + 0x1a4], 0xae8bcc70
mov dword [rsp + 0x1a8], 0x568f84ce
mov dword [rsp + 0x1ac], 0xe9b92680
mov dword [rsp + 0x1b0], 0xed5809bc
mov dword [rsp + 0x1b4], 0xd265d73d
mov dword [rsp + 0x1b8], 0x239c5d65
mov dword [rsp + 0x1bc], 0x447ef946
mov dword [rsp + 0x1c0], 0x84752ea0
mov dword [rsp + 0x1c4], 0x7a713ee7
mov dword [rsp + 0x1c8], 0x17f56ccc
mov dword [rsp + 0x1cc], 0xfa61c88d
mov dword [rsp + 0x1d0], 0xcf56e5d6
mov dword [rsp + 0x1d4], 0x534981e5
mov dword [rsp + 0x1d8], 0x1695c027
mov dword [rsp + 0x1dc], 0x713bc49e
movdqu xmmword [rsp + 0x218], xmm0
mov qword [rsp + 0x228], rsi
mov edx, 0x50
lea rcx, [rsp + 0x218]
call fcn.180040480
mov rbx, qword [rsp + 0x218]
mov r8d, 0x50
lea rdx, [rsp + 0x190]
mov rcx, rbx
call fcn.1800b8e10
lea rax, [rbx + 0x50]
mov qword [rsp + 0x220], rax
xorps xmm0, xmm0
mov dword [rsp + 0x60], 0xd676bdab
mov dword [rsp + 0x64], 0xb0161cf4
mov dword [rsp + 0x68], 0xa3b40e0c
mov dword [rsp + 0x6c], 0x2773853d
mov dword [rsp + 0x70], 0x2a857440
mov dword [rsp + 0x74], 0x412460fe
mov dword [rsp + 0x78], 0x9d04ade7
mov dword [rsp + 0x7c], 0x456276fd
mov dword [rsp + 0x80], 0x9ac37582
mov dword [rsp + 0x84], 0x2abb15f9
mov dword [rsp + 0x88], 0x35318c6e
mov dword [rsp + 0x8c], 0xcd6c3a95
mov dword [rsp + 0x90], 0x7ed86e62
mov dword [rsp + 0x94], 0x4fdf96db
mov dword [rsp + 0x98], 0x698bccd6
mov dword [rsp + 0x9c], 0xf6e59daf
mov dword [rsp + 0xa0], 0xa4b6a4be
mov dword [rsp + 0xa4], 0x78828282
mov dword [rsp + 0xa8], 0xb94d0bd9
mov dword [rsp + 0xac], 0x426c9ceb
movdqu xmmword [rsp + 0x200], xmm0
mov qword [rsp + 0x210], rsi
mov edx, 0x50
lea rcx, [rsp + 0x200]
call fcn.180040480
mov rbx, qword [rsp + 0x200]
mov r8d, 0x50
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1800b8e10
lea rax, [rbx + 0x50]
mov qword [rsp + 0x208], rax
lea rdx, [rsp + 0x218]
lea rcx, [rsp + 0x170]
call fcn.18002aad0
nop
mov rdx, rax
lea rcx, [rsp + 0x2a0]
call fcn.180051370
nop
mov rcx, qword [rsp + 0x170]
test rcx, rcx
je 0x1800604e6
mov rdx, qword [rsp + 0x180]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800604cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180060c1f
call fcn.180085240
mov qword [rsp + 0x170], rsi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x178], xmm0
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0xd0]
call fcn.18002aad0
nop
mov rdx, rax
lea rcx, [rsp + 0x2c0]
call fcn.180051370
nop
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x180060550
mov rdx, qword [rsp + 0xe0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006054a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180060c25
call fcn.180085240
nop
lea rdi, [rsp + 0x2a0]
lea r15, [rsp + 0x2e0]
mov qword [rsp + 0xb8], r15
lea r12, str..exe
movabs rbx, 0xc000000000000010
movabs r13, 0xc000000000000000
mov qword [rsp + 0xb0], rdi
cmp rdi, r15
je 0x180060881
lea rcx, [rsp + 0x130]
call fcn.180005620
mov rdx, rax
mov qword [rsp + 0x120], r12
mov qword [rsp + 0x128], 9
lea rcx, [0x1801839e0]
cmp qword [0x1801839f8], 7
cmova rcx, qword [0x1801839e0]
mov qword [rsp + 0xf0], rcx
mov rax, qword [0x1801839f0]
mov qword [rsp + 0xf8], rax
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rsp + 0x1a0], xmm0
mov qword [rsp + 0x190], r13
mov rcx, rdx
cmp qword [rdx + 0x18], 7
jbe 0x18006060b
mov rcx, qword [rdx]
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x100], rcx
mov qword [rsp + 0x108], rax
movups xmm0, xmmword [rsp + 0x100]
movups xmmword [rsp + 0x1b0], xmm0
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x110], 2
lea rax, [rsp + 0x190]
mov qword [rsp + 0x118], rax
movaps xmm0, xmmword [rsp + 0x110]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x120]
movdqa xmmword [rsp + 0x170], xmm1
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x1e0]
call fcn.18000d570
or r14d, 1
mov dword [rsp + 0x50], r14d
mov rdx, qword [rsp + 0x148]
cmp rdx, 7
jbe 0x1800606e3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800606de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180060c2b
call fcn.180085240
mov qword [rsp + 0x140], rsi
mov qword [rsp + 0x148], 7
mov word [rsp + 0x130], si
lea r8, [rsp + 0x1e0]
mov rdx, rdi
lea rcx, [rsp + 0x190]
call fcn.18002c350
cmp byte [rsp + 0x1b0], 0
je 0x1800608eb
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x234], xmm0
movups xmmword [rsp + 0x244], xmm0
movups xmmword [rsp + 0x254], xmm0
movups xmmword [rsp + 0x264], xmm0
movups xmmword [rsp + 0x274], xmm0
movups xmmword [rsp + 0x284], xmm0
mov dword [rsp + 0x294], eax
movups xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], rax
mov dword [rsp + 0x230], Ordinal_106
lea rcx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 7
cmova rcx, qword [rsp + 0x1e0]
lea rax, [rsp + 0x170]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x230]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1800608eb
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 0xf
jbe 0x180060838
inc rdx
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180060832
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180060c31
call fcn.180085240
nop
mov rdx, qword [rsp + 0x1f8]
cmp rdx, 7
jbe 0x180060881
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006087b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180060c85
call fcn.180085240
nop
lea r9, [fcn.180006920]
mov edx, Ordinal_34
mov r8d, 2
lea rcx, [rsp + 0x2a0]
call fcn.180085644
nop
mov rcx, qword [rsp + 0x200]
test rcx, rcx
je 0x180060bab
mov rdx, qword [rsp + 0x210]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180060b92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180060c37
jmp 0x180060b92
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 0xf
jbe 0x18006092f
inc rdx
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180060929
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180060c3d
call fcn.180085240
nop
lea rdx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 7
cmova rdx, qword [rsp + 0x1e0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x190], xmm0
mov qword [rsp + 0x1a0], rsi
mov qword [rsp + 0x1a8], rsi
mov r8, qword [rsp + 0x1f0]
lea rcx, [rsp + 0x190]
call fcn.18000b080
or r14d, 6
mov dword [rsp + 0x50], r14d
mov r8d, 3
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x160]
call fcn.180022500
movsd xmm0, qword [rax]
movsd qword [rsp + 0x150], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0xd0], ecx
lea rax, [0x18017d270]
mov qword [rsp + 0xd8], rax
movaps xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0x170], xmm0
mov eax, dword [rsp + 0x150]
test eax, eax
je 0x180060a2a
cmp eax, 1
setne bl
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 7
jbe 0x180060a3b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180060a36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180060c43
jmp 0x180060a36
xor bl, bl
test ecx, ecx
jne 0x180060c49
jmp 0x1800609e5
call fcn.180085240
test bl, bl
je 0x180060b0d
lea rdx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 7
cmova rdx, qword [rsp + 0x1e0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x188], rsi
mov r8, qword [rsp + 0x1f0]
lea rcx, [rsp + 0x170]
call fcn.18000b080
or r14d, 0x18
mov dword [rsp + 0x50], r14d
lea rcx, [rsp + 0x170]
cmp qword [rsp + 0x188], 7
cmova rcx, qword [rsp + 0x170]
call fcn.1800842a4
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x180060c66
mov rdx, qword [rsp + 0x188]
cmp rdx, 7
jbe 0x180060b0d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180060b07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180060c7f
call fcn.180085240
nop
jmp 0x180060b37
movabs rbx, 0xc000000000000010
mov rdx, qword [rsp + 0x1f8]
cmp rdx, 7
jbe 0x180060b89
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180060b84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180060c85
call fcn.180085240
add rdi, 0x20
jmp 0x180060583
call fcn.180085240
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x200], xmm0
mov qword [rsp + 0x210], rsi
mov rcx, qword [rsp + 0x218]
test rcx, rcx
je 0x180060bed
mov rdx, qword [rsp + 0x228]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180060be8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180060c8b
call fcn.180085240
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.180085220
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.18009a08c
nop
call fcn.18009a08c
nop
call fcn.18009a08c
int3
call fcn.18009a08c
nop
call fcn.18009a08c
nop
call fcn.18009a08c
nop
call fcn.18009a08c
nop
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0x170]
lea rcx, [0x1800f71e8]
call fcn.180021a70
nop
shr rdx, 0x20
lea r8, [rsp + 0x170]
lea rcx, str.remove
call fcn.18002d9b0
nop
call fcn.18009a08c
nop
call fcn.18009a08c
nop
call fcn.18009a08c
int3