Function at 0x180002d50
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x1803d4070]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
xor r14d, r14d
mov dword [rsp + 0x70], r14d
call fcn.18000fa70
lea rcx, str.NeacSafe.sys
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], 0xc
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rbp - 0x70]
call fcn.180001d90
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1803ce3b0]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], r14w
mov dword [rsp + 0x70], 7
lea rcx, [rsp + 0x50]
call fcn.180002be0
test eax, eax
jne 0x180003891
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x120]
call fcn.1800022d0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180002e48
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002e43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180002e43
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180010604
movdqa xmm0, xmmword [0x1803ce3b0]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r14w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x180002e9f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002e9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180002e9a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180010604
movdqa xmm0, xmmword [0x1803ce3b0]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r14w
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp - 0x10]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x120]
cmp qword [rbp + 0x138], 8
cmovae rdx, qword [rbp + 0x120]
lea rcx, [rbp - 0x10]
call fcn.18000f270
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x10], rax
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x14], edx
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx], 6
je 0x18000302a
lea rdx, [0x1800139e0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.18000dff0
mov rbx, rax
lea rcx, [rbp + 0x120]
cmp qword [rbp + 0x138], 8
cmovae rcx, qword [rbp + 0x120]
mov qword [rsp + 0x70], rcx
mov rcx, qword [rbp + 0x130]
mov qword [rsp + 0x78], rcx
call fcn.18000fa70
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.18000dd50
nop
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rax, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x78], rax
mov word [rbp - 0x80], 0x5c22
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.18000f5f0
mov rbx, rax
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x180002ff1
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002fec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180002fec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180010604
movdqa xmm0, xmmword [0x1803ce3c0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
lea rdx, [0x1800139d0]
mov rcx, rbx
call fcn.18000dff0
lea rdx, [0x18000e1c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
jmp 0x180003800
mov r8d, 0x3b9000
lea rdx, [0x180015250]
lea rcx, [rbp - 0x10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp - 8]
call fcn.18000d5f0
test rax, rax
jne 0x18000306b
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x10]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
mov dword [rsp + 0x70], 0x6361654e
mov dword [rsp + 0x74], 0x65666153
mov dword [rsp + 0x78], 0x78652e61
mov byte [rsp + 0x7c], 0x65
mov ecx, 0xd
call fcn.180010248
mov rdi, rax
mov qword [rbp + 0x140], rax
lea rsi, [rax + 0xd]
mov qword [rbp + 0x150], rsi
mov r8d, 0xd
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x148], rsi
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
cmp rdi, rsi
jne 0x1800030f9
mov qword [rbp + 0x110], r14
mov qword [rbp + 0x118], 7
mov word [rbp + 0x100], r14w
jmp 0x1800031ab
mov rcx, rsi
sub rcx, rdi
mov rbx, rdi
mov rdx, r14
mov qword [rbp + 0x110], rdx
mov eax, 7
mov qword [rbp + 0x118], rax
movabs r8, 0x7ffffffffffffffe
cmp rcx, r8
ja 0x180003899
cmp rcx, 8
jb 0x180003153
lea ecx, [rax + 0x19]
call fcn.180010248
mov qword [rbp + 0x100], rax
mov eax, 0xf
mov qword [rbp + 0x118], rax
mov rdx, qword [rbp + 0x110]
lea rcx, [rbp + 0x100]
cmp rax, 8
cmovae rcx, qword [rbp + 0x100]
movzx eax, byte [rbx]
mov word [rcx + rdx*2], ax
mov rdx, qword [rbp + 0x110]
inc rdx
mov qword [rbp + 0x110], rdx
inc rbx
cmp rbx, rsi
je 0x18000318f
mov rax, qword [rbp + 0x118]
jmp 0x180003153
lea rax, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rax, qword [rbp + 0x100]
mov word [rax + rdx*2], r14w
lea rdx, [rbp + 0x100]
lea rcx, [rbp - 0x50]
call fcn.18000f490
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x1803ce3b0]
movdqu xmmword [rbp - 0x60], xmm1
mov word [rbp - 0x70], r14w
mov dword [rsp + 0x70], 0x43
lea rcx, [rbp - 0x70]
call fcn.180002be0
test eax, eax
jne 0x18000389f
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x50]
call fcn.18000d020
mov dword [rsp + 0x70], 0xc3
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.180001fe0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rcx, [rbp + 0x120]
cmp qword [rbp + 0x138], 8
cmovae rcx, qword [rbp + 0x120]
call fcn.18000fd0c
test eax, eax
jne 0x1800038a7
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000328c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003287
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180003287
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180010604
movdqa xmm0, xmmword [0x1803ce3b0]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r14w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x1800032e3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800032de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800032de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180010604
movdqa xmm0, xmmword [0x1803ce3b0]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r14w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180003338
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003333
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180003333
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180010604
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x160]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x180015010]
mov qword [rbp + 0x160], rax
lea rax, [0x180015190]
mov qword [rbp + 0x170], rax
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
mov dword [rsp + 0x70], 0x103
xor r8d, r8d
lea rdx, [rbp + 0x178]
lea rcx, [rbp + 0x160]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__::constructor_class_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t______ptr64____ptr64]
nop
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
lea r15, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x160], r15
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x15c], edx
lea rcx, [rbp + 0x178]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x1e0], r14
mov dword [rbp + 0x1e8], r14d
lea rdx, [0x1800139f0]
lea rcx, [rbp + 0x170]
call fcn.18000e200
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x1803ce3b0]
movdqu xmmword [rbp - 0x60], xmm1
mov word [rbp - 0x70], r14w
mov dword [rsp + 0x70], 0x303
lea rcx, [rbp - 0x70]
call fcn.180002be0
test eax, eax
jne 0x180003889
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x50]
call fcn.18000d020
mov dword [rsp + 0x70], 0x703
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rcx, rbx
call fcn.18000f880
lea rdx, [0x1800139a4]
mov rcx, rax
call fcn.18000e200
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x110]
mov rcx, rax
call fcn.18000f880
mov rcx, rax
lea rdx, [0x1800139f0]
call fcn.18000e200
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1800034f7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800034f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800034f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180010604
movdqa xmm0, xmmword [0x1803ce3b0]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r14w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x18000354e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003549
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180003549
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180010604
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x264], xmm0
movups xmmword [rbp + 0x274], xmm0
movups xmmword [rbp + 0x284], xmm0
movups xmmword [rbp + 0x294], xmm0
movups xmmword [rbp + 0x2a4], xmm0
movups xmmword [rbp + 0x2b4], xmm0
mov dword [rbp + 0x2c4], eax
mov dword [rbp + 0x260], 0x68
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rax
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r14w
mov dword [rsp + 0x70], 0x1503
movups xmmword [rbp - 0x70], xmm0
mov rcx, r14
mov r8d, dword [rbp + 0x1e8]
mov eax, r8d
and al, 0x22
cmp al, 2
je 0x180003600
mov rax, qword [rbp + 0x1b8]
mov rdx, qword [rax]
test rdx, rdx
je 0x180003600
mov rax, qword [rbp + 0x198]
mov r9, qword [rax]
cmp rdx, qword [rbp + 0x1e0]
cmovb rdx, qword [rbp + 0x1e0]
sub rdx, r9
sar rdx, 1
mov rcx, r9
jmp 0x180003641
test r8b, 4
jne 0x180003673
mov rax, qword [rbp + 0x1b0]
mov r8, qword [rax]
mov rdx, r14
test r8, r8
je 0x18000363d
mov rax, qword [rbp + 0x190]
mov r9, qword [rax]
mov rax, qword [rbp + 0x1c8]
movsxd rdx, dword [rax]
add rdx, rdx
sub rdx, r9
add rdx, r8
sar rdx, 1
mov rcx, r9
jmp 0x180003641
mov r9, qword [rbp - 0x70]
test rcx, rcx
je 0x180003673
lea rcx, [rsp + 0x50]
cmp rdx, 7
ja 0x18000366d
mov qword [rsp + 0x60], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rsp + rbx + 0x50], r14w
jmp 0x180003673
call fcn.18000ea90
nop
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180003700
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800036fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800036fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180010604
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x160], r15
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x15c], edx
lea rcx, [rbp + 0x178]
call fcn.18000bf50
lea rcx, [rbp + 0x180]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 8
jb 0x1800037b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800037ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800037ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180010604
mov qword [rbp + 0x110], r14
mov qword [rbp + 0x118], 7
mov word [rbp + 0x100], r14w
test rdi, rdi
je 0x180003800
sub rsi, rdi
cmp rsi, 0x1000
jb 0x1800037f4
add rsi, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x18000384e
mov rdi, rcx
mov rdx, rsi
mov rcx, rdi
call fcn.180010604
nop
lea rcx, [rbp - 0x10]
call fcn.1800038c0
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 8
jb 0x18000385a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003855
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180003855
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.180010604
movzx eax, bl
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.18000ffc0
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov edx, eax
call fcn.180002a70
nop
mov edx, eax
call fcn.180002a70
nop
call fcn.1800011e0
nop
mov edx, eax
call fcn.180002a70
nop
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x120]
mov edx, eax
call fcn.180002b60
int3