Function at 0x140006b08
Capabilities:
Create process on windows

Disassembly:
push rbp
sub rsp, 0x5d0
lea rbp, [rsp + 0x50]
mov qword [rbp + 0x168], rsi
mov qword [rbp + 0x160], rbx
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
mov qword [rbp + 0x590], rcx
mov qword [rbp + 0x598], rdx
mov qword [rbp + 0x5a0], r8
mov dword [rbp + 0x5a8], r9d
mov rax, qword [0x1400e0a40]
xor rax, rbp
mov qword [rbp + 0x570], rax
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0x400
mov rax, qword [rbp + 0x598]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x58]
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x40]
cmp rax, rdx
jbe 0x140006f54
lea rax, [rbp + 0x170]
mov rdx, qword [rbp + 0x598]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x40]
neg rax
add rax, qword [rbp + 0x50]
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x48], 0
mov rax, qword [rbp + 0x48]
mov edx, dword [rbp + 0x5a8]
movsxd rdx, edx
cmp rax, rdx
jae 0x140006d38
mov rax, qword [rbp + 0x50]
cmp rax, 1
jbe 0x140006f54
lea rax, [rbp + 0x170]
lea rdx, [0x1400b0470]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
mov qword [rbp + 0x68], rax
mov rax, 0xffffffffffffffff
add rax, qword [rbp + 0x50]
mov qword [rbp + 0x50], rax
mov rax, qword [rbp + 0x48]
imul rax, rax, 8
add rax, qword [rbp + 0x5a0]
mov rax, qword [rax]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x78]
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x40]
cmp rax, rdx
jbe 0x140006f54
mov rax, qword [rbp + 0x48]
imul rax, rax, 8
add rax, qword [rbp + 0x5a0]
mov rax, qword [rax]
mov edx, 0x20
mov rcx, rax
call sub.VCRUNTIME140.dll_strchr
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
test rax, rax
je 0x140006cef
lea rax, [rbp + 0x170]
lea rdx, [0x1400b0474]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
mov qword [rbp + 0x120], rax
lea rax, [rbp + 0x170]
mov rdx, qword [rbp + 0x48]
imul rdx, rdx, 8
add rdx, qword [rbp + 0x5a0]
mov rdx, qword [rdx]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
mov qword [rbp + 0x130], rax
lea rax, [rbp + 0x170]
lea rdx, [0x1400b0474]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
mov qword [rbp + 0x138], rax
jmp 0x140006d17
lea rax, [rbp + 0x170]
mov rdx, qword [rbp + 0x48]
imul rdx, rdx, 8
add rdx, qword [rbp + 0x5a0]
mov rdx, qword [rdx]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x40]
neg rax
add rax, qword [rbp + 0x50]
mov qword [rbp + 0x50], rax
mov eax, 1
add rax, qword [rbp + 0x48]
mov qword [rbp + 0x48], rax
jmp 0x140006bd5
mov rax, qword [rbp + 0x50]
cmp rax, 5
jbe 0x140006f54
lea rax, [rbp + 0x170]
lea rdx, str.__win
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
mov qword [rbp + 0x70], rax
mov rax, 0xfffffffffffffffb
add rax, qword [rbp + 0x50]
mov qword [rbp + 0x50], rax
call fcn.14003d2c0
mov dword [rbp], eax
mov eax, dword [rbp]
test eax, eax
je 0x140006da5
mov rax, qword [rbp + 0x50]
cmp rax, 7
jbe 0x140006da5
lea rax, [rbp + 0x170]
lea rdx, str.__debug
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
mov qword [rbp + 0xf8], rax
lea rax, [rbp + 0x88]
mov edx, 0
mov ecx, 0x68
mov qword [rbp + 0x140], rcx
mov rcx, rax
mov rax, qword [rbp + 0x140]
mov r8, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0x100]
mov edx, 0
mov ecx, 0x18
mov qword [rbp + 0x148], rcx
mov rcx, rax
mov rax, qword [rbp + 0x148]
mov r8, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x118], rax
mov eax, 0
lea rdx, [rbp + 0x170]
mov ecx, 0
mov ebx, 0
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rsi, [rbp + 0x88]
mov qword [rsp + 0x40], rsi
lea rsi, [rbp + 0x100]
mov qword [rsp + 0x48], rsi
mov rsi, qword [sym.imp.orauts.dll_CreateProcessA]
mov qword [rbp + 0x150], rcx
mov rcx, rax
mov rax, qword [rbp + 0x150]
mov r8, rax
mov r9, rbx
call rsi
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
test eax, eax
je 0x140006ec1
mov eax, dword [rbp + 0x110]
mov dword [rbp + 0x10], eax
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x570], 0
xor rax, rbp
mov rcx, rax
call fcn.1400aab50
mov eax, dword [rbp + 0x10]
mov rbx, qword [rbp + 0x160]
mov rsi, qword [rbp + 0x168]
lea rsp, [rbp + 0x580]
pop rbp
ret
mov rax, qword [sym.imp.orauts.dll_GetLastError]
call rax
mov dword [rbp + 8], eax
mov rax, qword [rbp + 0x590]
lea rdx, str.CreateProcess
mov ecx, dword [rbp + 8]
mov ebx, 0
lea rsi, str.sprvfexCreateProcess
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], 0
mov dword [rbp + 0x158], ecx
mov rcx, rax
mov eax, dword [rbp + 0x158]
mov r8d, eax
mov r9, rbx
call fcn.14002cda8
mov dword [rbp + 0xc], eax
mov eax, 0xffffffff
mov dword [rbp + 0x14], eax
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x570], 0
xor rax, rbp
mov rcx, rax
call fcn.1400aab50
mov eax, dword [rbp + 0x14]
mov rbx, qword [rbp + 0x160]
mov rsi, qword [rbp + 0x168]
lea rsp, [rbp + 0x580]
pop rbp
ret
mov eax, 0xffffffff
mov dword [rbp + 0x18], eax
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x570], 0
xor rax, rbp
mov rcx, rax
call fcn.1400aab50
mov eax, dword [rbp + 0x18]
mov rbx, qword [rbp + 0x160]
mov rsi, qword [rbp + 0x168]
lea rsp, [rbp + 0x580]
pop rbp
ret