Function at 0x11011859c
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
xor ebx, ebx
mov r14d, ecx
mov r13d, ebx
mov r12b, bl
lea eax, [rbx + 4]
lea esi, [rbx + 3]
cmp ecx, 1
jbe 0x1101185e4
jle 0x1101185ea
cmp ecx, esi
jle 0x1101185e4
cmp ecx, eax
jne 0x1101185ea
mov r12b, 1
mov qword [rbp - 0x51], r8
jmp 0x11011862c
call sym.msvcrt.dll___doserrno
mov dword [rax], ebx
call sym.msvcrt.dll__errno
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
call sym.msvcrt.dll__invalid_parameter
jmp 0x1101188d8
inc r8
cmp byte [r8], bl
jne 0x110118615
lea rax, [r8 + 1]
cmp byte [rax], bl
je 0x11011862c
mov byte [r8], 0x20
mov r8, rax
mov al, byte [r8]
test al, al
jne 0x110118615
xor edx, edx
lea rcx, [rbp - 0x45]
lea r8d, [rdx + 0x64]
call sym.msvcrt.dll_memset
mov edi, dword [0x110195924]
lea rdx, [sym.msvcrt.dll___pioinfo]
mov dword [rbp - 0x49], 0x68
test edi, edi
je 0x11011867f
movsxd rcx, edi
dec rcx
mov rax, rcx
and ecx, 0x1f
sar rax, 5
imul rcx, rcx, 0x38
mov rax, qword [rdx + rax*8]
cmp byte [rax + rcx + 8], bl
jne 0x11011867d
sub edi, 1
jne 0x11011865a
test edi, edi
js 0x1101188cd
movsxd r15, edi
cmp r15, 0x1c71
jae 0x1101188cd
movzx eax, di
lea ecx, [rdi + 4]
shl ax, 3
mov edx, 1
add cx, ax
movzx ecx, cx
mov word [rbp - 7], cx
call fcn.110119eec
mov qword [rbp - 1], rax
test rax, rax
je 0x1101188cd
mov dword [rax], edi
or rbx, 0xffffffffffffffff
mov rax, qword [rbp - 1]
lea r9, [rax + 4]
add r9, r15
lea rdx, [rax + 4]
test edi, edi
jle 0x11011872a
xor r8d, r8d
mov r11d, edi
lea r15, [sym.msvcrt.dll___pioinfo]
mov rax, r8
mov rcx, r8
and eax, 0x1f
sar rcx, 5
imul r10, rax, 0x38
add r10, qword [r15 + rcx*8]
mov al, byte [r10 + 8]
test al, 0x10
jne 0x11011870a
mov byte [rdx], al
mov rax, qword [r10]
jmp 0x110118710
mov byte [rdx], r13b
mov rax, rbx
mov qword [r9], rax
inc r8
add r9, 8
inc rdx
sub r11, 1
jne 0x1101186e6
mov rax, qword [rbp - 1]
movsxd r15, edi
test r12b, r12b
je 0x1101187e8
lea r12, [rax + 4]
add r12, r15
lea r13, [rax + 4]
cmp edi, esi
cmovl esi, edi
xor r15d, r15d
test esi, esi
jle 0x1101187e2
cmp esi, 2
jb 0x1101187c1
lea eax, [rsi - 1]
movsxd rcx, eax
lea rax, [r12 + rcx*8]
lea rdx, [rcx + r13]
cmp r13, rax
ja 0x11011876b
cmp rdx, r12
jae 0x1101187c1
mov eax, esi
and eax, 0x80000001
jge 0x11011877b
dec eax
or eax, 0xfffffffe
inc eax
mov ecx, esi
sub ecx, eax
add r15d, 2
cmp r15d, ecx
jl 0x11011877f
lea eax, [rcx + 1]
cdq
sub eax, edx
xor edx, edx
sar eax, 1
movsxd rcx, eax
lea rdi, [rcx + rcx]
mov rcx, r13
mov r8, rdi
call sym.msvcrt.dll_memset
mov rdx, rdi
add r13, rdi
shl rdx, 3
mov rdi, r12
mov rcx, rdx
mov rax, rbx
shr rcx, 3
rep stosq qword [rdi], rax
add r12, rdx
cmp r15d, esi
jge 0x1101187e2
sub esi, r15d
mov eax, esi
mov byte [r13], 0
inc r13
mov qword [r12], rbx
lea r12, [r12 + 8]
sub rax, 1
jne 0x1101187cb
mov r13d, 8
call sym.msvcrt.dll___doserrno
mov rdx, qword [rbp - 0x51]
xor r9d, r9d
mov rcx, qword [rbp + 0x6f]
xor r8d, r8d
and dword [rax], 0
lea rax, [rbp - 0x69]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
mov rax, qword [rbp + 0x7f]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 1
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessA]
mov edi, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, qword [rbp - 1]
mov esi, eax
call sym.msvcrt.dll_free
test edi, edi
jne 0x110118858
mov ecx, esi
call fcn.110107d48
mov rax, rbx
jmp 0x1101188dc
cmp r14d, 2
je 0x1101188f7
test r14d, r14d
jne 0x1101188a5
mov rcx, qword [rbp - 0x69]
or edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x69]
lea rdx, [rbp + 0x67]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
test eax, eax
je 0x11011888c
movsxd rbx, dword [rbp + 0x67]
jmp 0x110118899
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.110107d48
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x1101188c1
mov eax, 4
cmp r14d, eax
jne 0x1101188bd
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor ebx, ebx
jmp 0x1101188c1
mov rbx, qword [rbp - 0x69]
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x110118850
call sym.msvcrt.dll__errno
mov dword [rax], 0xc
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x130]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor ecx, ecx
call sym.msvcrt.dll__exit
int3