Function at 0x140032ba0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x1400cd548]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov rbx, rdx
call fcn.14005d740
test eax, eax
je 0x140032e35
mov qword [rsp + 0x520], rdi
xor edi, edi
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x50], edi
je 0x140032d2f
xorps xmm0, xmm0
lea rcx, str.kernel32.dll
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x70], 0x68
movups xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x54], 1
movups xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x50], di
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x30], rax
movups xmmword [rbp - 0x70], xmm0
mov qword [rsp + 0x68], rax
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.Wow64EnableWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
xor ecx, ecx
call rbx
xor edx, edx
lea rcx, [rbp - 0x20]
mov r8d, 0x208
call fcn.140070390
mov edx, 0x208
lea rcx, [rbp - 0x20]
call fcn.14005c350
xor edx, edx
lea rcx, [rbp + 0x1f0]
mov r8d, 0x208
call fcn.140070390
lea rax, str.nViewMain64.exe
mov edx, 0x208
lea r9, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea rcx, [rbp + 0x1f0]
call fcn.140007050
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x1f0]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ecx, [rdi + 1]
call rbx
mov rcx, qword [rsp + 0x58]
mov edx, 0xffffffff
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140032e2d
lea r8, str.nView_Main_Process_Active
mov edx, 1
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenEventW]
test rax, rax
jne 0x140032e2d
lea r9, str.nView_Main_Process_Active
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
call fcn.1400588c0
mov rcx, rax
lea r9, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nView_nViewMain_nViewMain.cpp
lea rax, str.nView64_starting_up
mov edx, 3
mov qword [rsp + 0x28], rax
lea r8, [0x1400a0bb8]
mov dword [rsp + 0x20], 0xdf
call fcn.140058e40
mov rcx, rbx
call fcn.1400324a0
mov rcx, qword [0x1400d5770]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
call fcn.1400588c0
mov rcx, rax
lea r9, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nView_nViewMain_nViewMain.cpp
lea rax, str.signal_shutdown_event
mov edx, 3
mov qword [rsp + 0x28], rax
lea r8, [0x1400a0bb8]
mov dword [rsp + 0x20], 0xf4
call fcn.140058e40
mov rcx, qword [0x1400d57a8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.1400588c0
mov rcx, rax
lea r9, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nView_nViewMain_nViewMain.cpp
lea rax, str.posting__TVMSG_NVIEW_LOAD__FALSE__to_UI
mov edx, 3
mov qword [rsp + 0x28], rax
lea r8, [0x1400a0bb8]
mov dword [rsp + 0x20], 0xf7
call fcn.140058e40
xor edx, edx
mov ecx, 0x107
call fcn.140006fe0
mov rdi, qword [rsp + 0x520]
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.14006ed70
mov rbx, qword [rsp + 0x530]
add rsp, 0x510
pop rbp
ret