Function at 0x110148340
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov r14, rcx
xor r13d, r13d
mov qword [rsp + 0x68], r13
mov r12d, r13d
mov qword [rsp + 0x58], r13
mov byte [rax + 0xa], r13b
mov dword [rax + 0x18], r13d
test rcx, rcx
jne 0x11014839b
call sym.msvcrt.dll__errno
mov dword [rax], 0x16
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sym.msvcrt.dll__invalid_parameter
xor eax, eax
jmp 0x1101489d4
test rdx, rdx
je 0x110148375
mov cl, 0x20
mov esi, 1
mov al, byte [rdx]
cmp al, cl
jne 0x1101483b2
add rdx, rsi
jmp 0x1101483a7
cmp al, 0x77
je 0x1101483ba
cmp al, 0x72
jne 0x110148375
mov byte [rsp + 0x170], al
add rdx, rsi
mov al, byte [rdx]
cmp al, cl
je 0x1101483c1
test al, al
je 0x1101483d6
cmp al, 0x74
je 0x1101483d6
cmp al, 0x62
jne 0x110148375
mov byte [rsp + 0x171], al
cmp al, 0x74
jne 0x1101483e9
mov r8d, 0x4000
jmp 0x1101483f7
mov r8d, r13d
mov ecx, 0x8000
cmp al, 0x62
cmove r8d, ecx
bts r8d, 7
mov edx, 0x400
lea rcx, [rsp + 0x188]
call sym.msvcrt.dll__pipe
cmp eax, 0xffffffff
je 0x1101489d1
cmp byte [rsp + 0x170], 0x77
jne 0x11014845b
mov ebx, r13d
lea rdi, [rsp + 0x18c]
lea r13, [rsp + 0x54]
mov qword [rsp + 0x80], r13
lea r15, [rsp + 0x18c]
mov qword [rsp + 0x90], r15
lea r15, [rsp + 0x54]
mov qword [rsp + 0x88], r15
xor r13d, r13d
jmp 0x11014848f
mov ebx, esi
lea rdi, [rsp + 0x188]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x188]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
mov r15d, 9
mov ecx, r15d
call fcn.11013b11c
test eax, eax
jne 0x1101484be
mov ecx, dword [rsp + 0x188]
call sym.msvcrt.dll__close
mov ecx, dword [rsp + 0x18c]
call sym.msvcrt.dll__close
jmp 0x110148394
mov ecx, r15d
call sym.msvcrt.dll__lock
nop
mov dword [rsp + 0x54], esi
mov dword [rsp + 0x50], esi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov r15d, ebx
mov qword [rsp + 0x70], r15
movsxd rdx, dword [rsp + r15*4 + 0x188]
mov rcx, rdx
sar rcx, 5
lea r8, [sym.msvcrt.dll___pioinfo]
and edx, 0x1f
imul r10, rdx, 0x38
mov rdx, qword [r8 + rcx*8]
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r13d
lea r9, [rsp + 0x68]
mov r8, rax
mov rdx, qword [rdx + r10]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_DuplicateHandle]
test eax, eax
je 0x110148996
mov ecx, dword [rsp + r15*4 + 0x188]
call sym.msvcrt.dll__close
mov dword [rsp + r15*4 + 0x50], r13d
lea rdx, [rsp + 0x170]
mov ecx, dword [rdi]
call sym.msvcrt.dll__fdopen
mov r12, rax
mov qword [rsp + 0xa0], rax
test rax, rax
je 0x110148996
xor ecx, ecx
call fcn.1101489f0
mov qword [rsp + 0x78], rax
test rax, rax
je 0x110148978
lea r8, str.COMSPEC
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.11012f4d0
mov edi, eax
cmp eax, 0x16
jne 0x1101485a4
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bbfc
test edi, edi
jne 0x1101485b2
mov r15, qword [rsp + 0x58]
test r15, r15
jne 0x1101485b9
lea r15, str.cmd.exe
mov edi, 0x68
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0xc0]
call sym.msvcrt.dll_memset
mov dword [rsp + 0xc0], edi
mov dword [rsp + 0xfc], 0x100
mov rax, qword [rsp + 0x68]
mov rcx, qword [sym.msvcrt.dll___pioinfo]
test ebx, ebx
mov rdx, rax
je 0x1101485f8
mov rdx, qword [rcx]
mov qword [rsp + 0x110], rdx
cmp ebx, esi
je 0x110148608
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x118], rax
mov rax, qword [rcx + 0x70]
mov qword [rsp + 0x120], rax
or rax, 0xffffffffffffffff
mov rcx, rax
inc rcx
cmp byte [r15 + rcx], r13b
jne 0x110148623
inc rax
cmp byte [r14 + rax], r13b
jne 0x11014862c
lea rbx, [rax + 5]
add rbx, rcx
mov rdx, rsi
mov rcx, rbx
call fcn.110119e8c
mov rdi, rax
test rax, rax
je 0x110148973
mov r8, r15
mov rdx, rbx
mov rcx, rax
call sym.msvcrt.dll_strcpy_s
test eax, eax
je 0x110148679
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bbfc
lea r8, str.__c
mov rdx, rbx
mov rcx, rdi
call sym.msvcrt.dll_strcat_s
test eax, eax
je 0x1101486a3
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bbfc
mov r8, r14
mov rdx, rbx
mov rcx, rdi
call sym.msvcrt.dll_strcat_s
test eax, eax
je 0x1101486c9
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bbfc
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xa8], xmm0
mov qword [rsp + 0xb8], rax
call sym.msvcrt.dll__errno
mov r13d, dword [rax]
xor edx, edx
mov rcx, r15
call sym.msvcrt.dll__access_s
xor r14d, r14d
test eax, eax
jne 0x11014873d
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessA]
mov esi, eax
jmp 0x11014891c
mov qword [rsp + 0x60], r14
mov rdx, rsi
mov ecx, 0x104
call fcn.110119e8c
mov rbx, rax
test rax, rax
jne 0x110148780
xor ecx, ecx
call sym.msvcrt.dll_free
mov rcx, rdi
call sym.msvcrt.dll_free
mov rcx, qword [rsp + 0x58]
call sym.msvcrt.dll_free
call sym.msvcrt.dll__errno
mov dword [rax], r13d
xor r13d, r13d
jmp 0x110148973
lea r8, [0x110179dec]
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.11012f4d0
mov r14d, eax
cmp eax, 0x16
jne 0x1101487b0
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bbfc
mov rcx, qword [rsp + 0x60]
test r14d, r14d
je 0x1101487c4
call sym.msvcrt.dll_free
mov rcx, rbx
jmp 0x110148759
xor r14d, r14d
mov r8d, 0x103
mov rdx, rbx
call fcn.110130ac8
mov qword [rsp + 0x98], rax
test rax, rax
je 0x110148903
cmp byte [rbx], r14b
je 0x110148903
or rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], r14b
jne 0x1101487f3
lea r14, [rbx - 1]
add r14, rax
cmp byte [r14], 0x5c
jne 0x11014884c
mov edx, 0x5c
mov rcx, rbx
call sym.msvcrt.dll__mbsrchr
cmp r14, rax
je 0x110148852
lea r8, [0x110179df4]
mov edx, 0x104
mov rcx, rbx
call sym.msvcrt.dll_strcat_s
xor r14d, r14d
test eax, eax
je 0x110148855
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bbfc
jmp 0x110148855
cmp byte [r14], 0x2f
jmp 0x110148819
xor r14d, r14d
or rax, 0xffffffffffffffff
inc rax
cmp byte [r15 + rax], r14b
jne 0x110148859
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], r14b
jne 0x110148866
add rax, rcx
mov ecx, 0x104
cmp rax, rcx
jae 0x110148903
mov r8, r15
mov edx, ecx
mov rcx, rbx
call sym.msvcrt.dll_strcat_s
test eax, eax
je 0x1101488a5
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bbfc
xor edx, edx
mov rcx, rbx
call sym.msvcrt.dll__access_s
test eax, eax
jne 0x1101488f6
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessA]
mov esi, eax
jmp 0x11014890a
mov rcx, qword [rsp + 0x98]
jmp 0x1101487c7
mov esi, dword [rsp + 0x180]
mov rcx, qword [rsp + 0x60]
call sym.msvcrt.dll_free
mov rcx, rbx
call sym.msvcrt.dll_free
mov rcx, rdi
call sym.msvcrt.dll_free
mov rcx, qword [rsp + 0x58]
call sym.msvcrt.dll_free
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test esi, esi
je 0x11014894b
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
call sym.msvcrt.dll__errno
mov dword [rax], r13d
xor r13d, r13d
mov rcx, qword [rsp + 0x78]
test esi, esi
je 0x110148970
mov rax, qword [rsp + 0xa8]
mov qword [rcx + 8], rax
mov qword [rcx], r12
jmp 0x1101489c7
mov qword [rcx], r13
mov r15, qword [rsp + 0x70]
mov rcx, r12
call sym.msvcrt.dll_fclose
mov rax, qword [rsp + 0x80]
mov dword [rax], r13d
mov r12, r13
mov qword [rsp + 0xa0], r13
cmp dword [rsp + r15*4 + 0x50], r13d
je 0x1101489aa
mov ecx, dword [rsp + r15*4 + 0x188]
call sym.msvcrt.dll__close
mov rax, qword [rsp + 0x88]
cmp dword [rax], r13d
je 0x1101489c7
mov rax, qword [rsp + 0x90]
mov ecx, dword [rax]
call sym.msvcrt.dll__close
nop
mov ecx, 9
call sym.msvcrt.dll__unlock
mov rax, r12
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret