Function at 0x140011850
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x268]
sub rsp, 0x340
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14007a6a0]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov r15, rcx
lea r12, [rcx + 0x260]
mov rcx, qword [r12]
sub rcx, 0x18
call fcn.140002a10
lea rdi, [rax + 0x18]
mov qword [rsp + 0x70], rdi
call fcn.1400179f4
mov rcx, rax
test rax, rax
je 0x140011cc9
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov rcx, qword [r12]
mov rsi, 0xffffffffffffffff
cmp dword [rcx - 0x10], 0
jle 0x140011a68
lea edx, [rsi + 0x5d]
call fcn.140037e10
mov rbx, rax
test rax, rax
je 0x140011a68
mov rax, qword [r12]
sub rbx, rax
sar rbx, 1
test ebx, ebx
js 0x140011a68
lea r8d, [rbx + 1]
mov r9d, dword [rax - 0x10]
sub r9d, r8d
lea rdx, [rbp - 0x60]
mov rcx, r12
call fcn.14000c560
nop
mov rdx, qword [rbp - 0x60]
lea r14, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp r14, rdi
je 0x14001197f
cmp dword [rdi + 0x10], 0
jl 0x140011970
mov rax, qword [rdi]
cmp qword [r14], rax
jne 0x140011970
mov rcx, r14
call fcn.140002a10
mov r13, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x140011965
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r13 + 0x18]
mov qword [rsp + 0x70], rax
jmp 0x14001197f
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x70]
call fcn.140002300
nop
mov eax, esi
lock xadd dword [r14 + 0x10], eax
sub eax, 1
jg 0x140011998
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [r12]
cmp ebx, dword [rax - 0x10]
jl 0x1400119b4
lea rcx, [rax - 0x18]
call fcn.140002a10
lea rdx, [rax + 0x18]
mov qword [rbp - 0x80], rdx
jmp 0x1400119ed
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x1400119c8
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x1400119d6
call fcn.1400179f4
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov r9, rax
mov r8d, ebx
mov rdx, qword [r12]
lea rcx, [rbp - 0x80]
call fcn.14000c710
mov rdx, qword [rbp - 0x80]
lea rbx, [rdx - 0x18]
mov rdi, qword [rsp + 0x68]
add rdi, 0xffffffffffffffe8
cmp rbx, rdi
je 0x140011a4b
cmp dword [rdi + 0x10], 0
jl 0x140011a3c
mov rax, qword [rdi]
cmp qword [rbx], rax
jne 0x140011a3c
mov rcx, rbx
call fcn.140002a10
mov r14, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x140011a31
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r14 + 0x18]
mov qword [rsp + 0x68], rax
jmp 0x140011a4b
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x68]
call fcn.140002300
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140011a63
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x70]
mov r8d, 0x104
lea rdx, [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.1400179f4
mov rcx, rax
test rax, rax
je 0x140011cd4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea r12, [0x140066ae0]
mov rax, rsi
inc rax
cmp word [r12 + rax*2], 0
jne 0x140011aa4
mov r8d, eax
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.140002920
lea rcx, [rbp + 0x20]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], 0
jne 0x140011ac6
mov r8d, eax
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140002920
lea rdx, str.______
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140011af0
mov r8d, eax
lea rcx, [rsp + 0x60]
call fcn.140002920
xor r13d, r13d
mov r14d, r13d
cmp qword [r15 + 0x2a8], r13
jle 0x140011b8b
mov ebx, r13d
nop dword [rax]
mov r8d, 2
lea rdx, [0x140066afc]
lea rcx, [rsp + 0x60]
call fcn.140002920
test rbx, rbx
js 0x140011cc3
cmp rbx, qword [r15 + 0x2a8]
jge 0x140011cc3
mov rax, qword [r15 + 0x2a0]
mov rdx, qword [rax + rbx*8]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140002920
mov r8d, 1
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.140002920
inc r14d
inc rbx
movsxd rax, r14d
cmp rax, qword [r15 + 0x2a8]
jl 0x140011b20
xor eax, eax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
xor edx, edx
lea r8d, [rax + 0x64]
lea rcx, [rbp - 0x4c]
call fcn.140038400
mov dword [rbp - 0x50], 0x68
lea rax, [rbp - 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], 0x400
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r13
mov r9d, 1
mov r8, qword [r15 + 0x268]
mov rdx, qword [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
je 0x140011cdf
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x78]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rsp + 0x78]
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011c55
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011c74
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140011c91
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, edi
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.1400361e0
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140017cfc
nop
mov ecx, 0x80004005
call fcn.1400024c0
nop
mov ecx, 0x80004005
call fcn.1400024c0
nop
mov rcx, r15
call fcn.1400117a0
int3