Function at 0x14000a8b0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x100
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
mov rbp, r9
mov r13, r8
mov r12, rdx
call fcn.140055b68
mov r11, rax
xor r14d, r14d
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000a90a
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x50], rax
call fcn.140055b68
mov r11, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000a93c
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov r8, qword [r12]
lea rdx, str.__s_
lea rcx, [rsp + 0x50]
call fcn.140006f20
mov r8, r13
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x78]
call fcn.140006b20
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x50]
add rdi, 0xffffffffffffffe8
or ebx, 0xffffffff
cmp rcx, rdi
je 0x14000a9d8
cmp dword [rdi + 0x10], 0
jl 0x14000a9c9
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14000a9c9
call fcn.1400046d0
mov rsi, rax
mov ecx, ebx
lock xadd dword [rdi + 0x10], ecx
add ecx, ebx
test ecx, ecx
jg 0x14000a9be
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x50], rax
jmp 0x14000a9d8
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.1400062e0
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000a9f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x90]
call fcn.14009c4e0
mov dword [rsp + 0x90], reloc.OLEAUT32.dll_VarCyFromDisp
mov edi, 1
cmp dword [rsp + 0x158], 0
je 0x14000aa36
mov dword [rsp + 0xcc], edi
mov word [rsp + 0xd0], 0
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000aac7
cmp dword [rsp + 0x150], 0
je 0x14000aaaf
or edx, 0xffffffff
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, rbp
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000aad3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp], eax
mov edi, r14d
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000aaf4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000ab15
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000ab35
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x14000ab53
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, edi
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret