Function at 0x140002cc0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x508
mov qword [rsp + 0x500], rcx
cmp qword [rsp + 0x500], 0
jne 0x140002cfd
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Command_is_NULL_n
call fcn.140004b20
jmp 0x140002fdd
mov r8, qword [rsp + 0x500]
mov ecx, 0xfde9
xor edx, edx
mov r9d, 0xffffffff
xor eax, eax
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x478], eax
movsxd rcx, dword [rsp + 0x478]
shl rcx, 1
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [rsp + 0x470], rax
mov r8, qword [rsp + 0x500]
mov r10, qword [rsp + 0x470]
mov eax, dword [rsp + 0x478]
mov ecx, 0xfde9
xor edx, edx
mov r9d, 0xffffffff
mov qword [rsp + 0x20], r10
mov dword [rsp + 0x28], eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8, qword [rsp + 0x470]
mov ecx, 0xd698
xor edx, edx
mov r9d, 0xffffffff
xor eax, eax
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rsp + 0x46c], eax
movsxd rcx, dword [rsp + 0x46c]
shl rcx, 0
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [rsp + 0x460], rax
mov r8, qword [rsp + 0x470]
mov r10, qword [rsp + 0x460]
mov eax, dword [rsp + 0x46c]
mov ecx, 0xd698
xor edx, edx
mov r9d, 0xffffffff
xor r11d, r11d
mov qword [rsp + 0x20], r10
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rsp + 0x498]
xor edx, edx
mov r8d, 0x68
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [rsp + 0x498], 0x68
mov dword [rsp + 0x4d4], 1
mov word [rsp + 0x4d8], 0
lea rcx, [rsp + 0x480]
xor edx, edx
mov r8d, 0x18
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rcx, [rsp + 0x60]
mov r9, qword [rsp + 0x460]
lea r8, str.cmd.exe__C___s_
mov edx, 0x400
call fcn.140004bb0
lea rdx, [rsp + 0x60]
xor eax, eax
mov r9d, eax
xor eax, eax
lea r10, [rsp + 0x498]
lea rax, [rsp + 0x480]
mov rcx, r9
mov r8, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 0
jne 0x140002f33
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x58]
mov r8d, eax
lea rdx, str.CreateProcess_failed___d_._n
call fcn.140004b20
mov rcx, qword [rsp + 0x470]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, qword [rsp + 0x460]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x140002fdd
mov rcx, qword [rsp + 0x480]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x480]
lea rdx, [rsp + 0x47c]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp eax, 0
jne 0x140002f94
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x50]
mov r8d, eax
lea rdx, str.GetExitCodeProcess_failed___d_._n
call fcn.140004b20
jmp 0x140002fa7
mov edx, dword [rsp + 0x47c]
lea rcx, str.Command_executed_with_exit_status:__lu_n
call fcn.140004b60
mov rcx, qword [rsp + 0x480]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x488]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x470]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, qword [rsp + 0x460]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
add rsp, 0x508
ret