Function at 0x1401170fa
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov r13d, ecx
mov rax, qword [0x1401ee6a8]
xor rax, rsp
mov qword [rsp + 0xf0], rax
lea eax, [r13 - 5]
mov ebp, 5
cmp eax, 1
ja 0x140117546
mov rbx, r8
mov r12, rdx
mov rdi, qword [rsp + 0x160]
xorps xmm0, xmm0
cmp byte [rsp + 0x180], 0
je 0x1401173bc
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0xd0], 0
mov dword [rsp + 0x70], 0x70
cmp byte [r9 + 0x17], 0
jns 0x14011719e
mov r9, qword [r9]
mov rcx, r9
call fcn.14017b1f4
movzx ecx, byte [rdi + 0x17]
test cl, cl
mov qword [rsp + 0x58], rax
jns 0x1401171ba
mov rcx, qword [rdi + 8]
mov rdi, qword [rdi]
test rcx, rcx
cmove rdi, rcx
mov r14, qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov r15d, 1
lea rsi, [rsp + 0x68]
xor ecx, ecx
mov edx, 1
xor r8d, r8d
mov r9, rsi
call r14
mov rbp, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbp
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
mov qword [rsp + 0xd8], rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
mov r9, rsi
call r14
test eax, eax
je 0x140117507
lea r9, [rsp + 0x64]
mov dword [r9], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], 4
mov r8d, 0x2000e
mov rcx, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
mov rsi, qword [rsp + 0x58]
je 0x140117516
mov eax, dword [rsp + 0x178]
mov dword [rsp + 0xac], eax
mov r15b, byte [rbx + 0x17]
mov rbp, qword [rbx]
mov r14, qword [r12]
lea r8, [rsp + 0xe8]
mov rcx, r14
mov edx, 0xb
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140117575
mov r12d, dword [rsp + 0x170]
mov eax, r12d
or eax, 0x80000
test r15b, r15b
cmovs rbx, rbp
mov rcx, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0x168]
mov qword [rsp + 0x50], rdx
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rdi
xor edx, edx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x20], rdx
mov dword [rsp + 0x28], 0
mov rdx, rbx
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140117575
xor ebp, ebp
bt r12d, 0x12
setae bpl
shl ebp, 0xa
or ebp, 0x101801
cmp r13d, 6
mov r15d, 0x1fffff
cmove ebp, r15d
mov rdi, qword [rsp + 0x168]
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, rbx
mov r8, r14
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rbx, qword [rdi + 8]
test eax, eax
je 0x14011756c
add rdi, 8
test r12d, 0x40000
mov eax, 0x100c02
mov ebp, 0x100c43
cmovne ebp, eax
cmp r13d, 6
cmove ebp, r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 1
mov rcx, rax
mov rdx, rbx
mov r8, r14
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor r15d, r15d
test eax, eax
sete r15b
mov ebp, 5
jmp 0x140117580
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
xor r15d, r15d
mov qword [rsp + 0xd0], r15
mov dword [rsp + 0x70], 0x68
cmp byte [r9 + 0x17], r15b
jns 0x140117405
mov r9, qword [r9]
mov rcx, r9
call fcn.14017b1f4
mov r14, rax
movzx eax, byte [rdi + 0x17]
test al, al
jns 0x14011741f
mov rax, qword [rdi + 8]
mov rdi, qword [rdi]
test rax, rax
cmove rdi, rax
cmp byte [rbx + 0x17], r15b
jns 0x14011742f
mov rbx, qword [rbx]
mov r12, qword [r12]
mov rsi, qword [rsp + 0x168]
mov qword [rsp + 0x48], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140117532
cmp r13d, 6
mov r15d, 0x1fffff
mov edi, 0x101c01
cmove edi, r15d
mov rbx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, rbx
mov r8, r12
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rbx, qword [rsi + 8]
test eax, eax
je 0x140117526
add rsi, 8
cmp r13d, 6
mov edi, 0x100c43
cmove edi, r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, rbx
mov r8, r12
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
setne r15b
jmp 0x140117532
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rsi, qword [rsp + 0x58]
jmp 0x140117580
mov r15d, 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x140117580
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r15d, r15d
test r14, r14
je 0x14011753f
mov rcx, r14
call case.0x1400878dc.0
test r15b, r15b
je 0x140117546
xor ebp, ebp
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140163e00
mov eax, ebp
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, 5
mov r15d, 1
test rsi, rsi
je 0x14011758d
mov rcx, rsi
call case.0x1400878dc.0
test r15d, r15d
jne 0x140117546
jmp 0x140117544