Function at 0x14000d590
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x14002e0b0]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov r14, rdx
mov rsi, rcx
mov qword [r11 - 0x48], 7
xor r12d, r12d
mov qword [r11 - 0x50], r12
mov word [r11 - 0x60], r12w
xor r8d, r8d
lea edx, [r12 + 0x18]
lea rcx, [r11 - 0x68]
call fcn.1400053f0
lea rcx, [rsp + 0x108]
mov rdx, qword [rsp + 0x120]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x108]
add rdx, rdx
lea r9d, [r12 + 0x30]
lea r8, str.ProcUtil::ExecuteProcess
call fcn.1400100b0
mov qword [rsp + 0x118], 0x18
lea rax, [rsp + 0x108]
cmp qword [rsp + 0x120], 8
cmovae rax, qword [rsp + 0x108]
mov word [rax + 0x30], r12w
lea r9, [rsp + 0x108]
cmp qword [rsp + 0x120], 8
cmovae r9, qword [rsp + 0x108]
lea r8, str._s__entering
lea edx, [r12 + 0x65]
lea rcx, [0x14002f750]
call fcn.14000bba0
nop
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
or rbp, 0xffffffffffffffff
test rsi, rsi
je 0x14000d6e9
test rsi, 0xffffffffffff0000
jne 0x14000d6d5
movzx edi, si
xor edx, edx
mov ecx, edi
call fcn.140004bf0
test rax, rax
je 0x14000d701
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004840
mov rbx, qword [rsp + 0x50]
jmp 0x14000d701
xor eax, eax
mov rcx, rbp
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
jmp 0x14000d6ec
mov ecx, r12d
mov r8d, ecx
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.1400046e0
mov rbx, qword [rsp + 0x50]
mov edx, dword [rbx - 0x10]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or ecx, eax
jge 0x14000d724
lea rcx, [rsp + 0x50]
call fcn.1400049e0
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
test rbx, rbx
jne 0x14000d737
mov ecx, r12d
jmp 0x14000d751
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x14000db49
cmp ecx, dword [rbx - 0xc]
jg 0x14000db49
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
mov edx, dword [rbx - 0x10]
add edx, 2
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x14000d78c
lea rcx, [rsp + 0x50]
call fcn.1400049e0
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
test rbx, rbx
jne 0x14000d79f
mov ecx, r12d
jmp 0x14000d7b9
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x14000db3e
cmp ecx, dword [rbx - 0xc]
jg 0x14000db3e
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
lea rsi, [rbx - 0x18]
mov rcx, qword [rsi]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rsi + 0x10], 0
jl 0x14000d7f3
cmp rax, qword [rsi]
jne 0x14000d7f3
mov rbx, rsi
lock add dword [rsi + 0x10], 1
jmp 0x14000d832
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rsi + 8]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x14000d80f
call fcn.1400049d0
int3
mov eax, dword [rsi + 8]
mov dword [rbx + 8], eax
mov eax, dword [rsi + 8]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
lea r8, [rsi + 0x18]
add rdx, rdx
lea rcx, [rbx + 0x18]
call fcn.1400100b0
add rbx, 0x18
mov qword [rsp + 0x58], rbx
test r14, r14
je 0x14000d969
xor eax, eax
mov rcx, rbp
lea r13, [0x140028484]
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0x60], rcx
mov r12, r13
sub r12, rbx
sar r12, 1
mov r15d, dword [rbx - 0x10]
lea edi, [r15 + rcx]
mov edx, 1
sub edx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, edx
jge 0x14000d89a
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.1400049e0
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
cmp r12, r15
ja 0x14000d8a3
lea r13, [rbx + r12*2]
movsxd rdx, ecx
add rdx, rdx
lea rcx, [rbx + r15*2]
mov r9, rdx
mov r8, r13
call fcn.1400100b0
test edi, edi
js 0x14000d95e
cmp edi, dword [rbx - 0xc]
jg 0x14000d95e
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], 0
xor eax, eax
mov rcx, rbp
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
lea r15, [rcx - 1]
mov r12, r14
sub r12, rbx
sar r12, 1
mov r13d, dword [rbx - 0x10]
lea edi, [r13 + rcx - 1]
mov edx, 1
sub edx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, edx
jge 0x14000d91b
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.1400049e0
mov rbx, qword [rsp + 0x58]
cmp r12, r13
ja 0x14000d924
lea r14, [rbx + r12*2]
movsxd rdx, r15d
add rdx, rdx
lea rcx, [rbx + r13*2]
mov r9, rdx
mov r8, r14
call fcn.1400100b0
test edi, edi
js 0x14000d953
cmp edi, dword [rbx - 0xc]
jg 0x14000d953
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], 0
xor r12d, r12d
jmp 0x14000d969
mov ecx, 0x80070057
call fcn.140004d20
int3
mov ecx, 0x80070057
call fcn.140004d20
int3
mov r9, rbx
lea r8, [0x140028488]
mov edx, 2
lea rcx, [0x14002f750]
call fcn.14000bba0
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0x98]
call fcn.140011570
mov qword [rsp + 0x68], r12
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x90], 0x68
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000da98
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000da2a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lock xadd dword [rsi + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x14000da43
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
nop
lea r9, [rsp + 0x108]
cmp qword [rsp + 0x120], 8
cmovae r9, qword [rsp + 0x108]
lea r8, str._s__leaving
mov edx, 0x65
lea rcx, [0x14002f750]
call fcn.14000bba0
nop
cmp qword [rsp + 0x120], 8
jb 0x14000da8e
mov rcx, qword [rsp + 0x108]
call fcn.14000eef0
mov eax, 1
jmp 0x14000db54
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.CreateProcess_failed_0x_x__n
mov edx, 5
lea rcx, [0x14002f750]
call fcn.14000bba0
nop
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000dad6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lock xadd dword [rsi + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x14000daef
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
nop
lea r9, [rsp + 0x108]
cmp qword [rsp + 0x120], 8
cmovae r9, qword [rsp + 0x108]
lea r8, str._s__leaving
mov edx, 0x65
lea rcx, [0x14002f750]
call fcn.14000bba0
nop
cmp qword [rsp + 0x120], 8
jb 0x14000db3a
mov rcx, qword [rsp + 0x108]
call fcn.14000eef0
xor eax, eax
jmp 0x14000db54
mov ecx, 0x80070057
call fcn.140004d20
int3
mov ecx, 0x80070057
call fcn.140004d20
nop
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.14000f470
mov rbx, qword [rsp + 0x180]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret