Function at 0x14002be70
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 8]
sub rsp, 0x108
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov r14, rcx
cmp dword [rcx + 0x9c], 0
jne 0x14002bea4
xor eax, eax
jmp 0x14002c277
xor edi, edi
mov dword [rcx + 0x9c], edi
mov rax, qword [0x140104018]
mov qword [rbp + 0x58], rax
lea rsi, [0x1400d0c90]
mov rax, rsi
shr rax, 0x10
test ax, ax
jne 0x14002bed8
movzx edx, si
lea rcx, [rbp + 0x58]
call fcn.140001ff0
jmp 0x14002bf12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
test eax, eax
je 0x14002bf12
mov edx, ebx
lea rcx, [rbp + 0x58]
call fcn.140001970
test eax, eax
je 0x14002bf12
mov r9, rbx
add r9, r9
lea eax, [rbx + 1]
movsxd rdx, eax
add rdx, rdx
mov r8, rsi
mov rcx, qword [rbp + 0x58]
call fcn.1400029b0
lea r13, [r14 + 0x5d8]
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x58]
mov rcx, r13
call fcn.140002330
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp - 0x6c]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x70], 0x68
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov rax, qword [0x140104018]
mov qword [rbp + 0x50], rax
mov rax, qword [r14 + 0xa0]
mov esi, 0xffffffff
lea r15, [r14 + 8]
mov edx, dword [r14 + 0x5c4]
mov rcx, r15
cmp dword [rax - 8], 0
jne 0x14002bfc8
call fcn.140009b60
mov rcx, rax
lea rdx, [rsp + 0x50]
call fcn.1400097e0
nop
mov r8, qword [rax]
lea rdx, [0x1400d0cd0]
lea rcx, [rbp + 0x50]
call fcn.1400086c0
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140104010]
je 0x14002c02d
mov eax, esi
lock xadd dword [rcx], eax
sub eax, 1
jg 0x14002c02d
mov rcx, qword [rsp + 0x50]
jmp 0x14002c024
call fcn.140009b60
mov rcx, rax
lea rdx, [rsp + 0x58]
call fcn.1400097e0
mov rbx, rax
xor edx, edx
lea rcx, [r14 + 0xa0]
call fcn.140001c10
mov r9, rax
mov r8, qword [rbx]
lea rdx, [0x1400d0ce0]
lea rcx, [rbp + 0x50]
call fcn.1400086c0
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xfffffffffffffff4
cmp rdx, qword [0x140104010]
je 0x14002c02d
mov eax, esi
lock xadd dword [rdx], eax
sub eax, 1
jg 0x14002c02d
mov rcx, qword [rsp + 0x58]
add rcx, 0xfffffffffffffff4
call fcn.1400bf5e4
mov edx, dword [r14 + 0x5c4]
mov rcx, r15
call fcn.140009b60
mov rcx, rax
lea rdx, [rsp + 0x60]
call fcn.1400097e0
mov r12, rax
mov rbx, qword [rbp + 0x50]
lea r14, [rbx - 0xc]
cmp dword [r14], 1
jg 0x14002c060
cmp dword [rbx - 4], 0
jge 0x14002c0cd
mov r15d, dword [rbx - 8]
mov ebx, r15d
test r15d, r15d
cmovle ebx, edi
mov edx, ebx
lea rcx, [rbp + 0x50]
call fcn.140001970
test eax, eax
jne 0x14002c085
mov rdx, rdi
mov rbx, qword [rbp + 0x50]
jmp 0x14002c0d0
lea eax, [r15 + 1]
movsxd r9, eax
add r9, r9
lea r8, [r14 + 0xc]
lea eax, [rbx + 1]
movsxd rdx, eax
add rdx, rdx
mov rbx, qword [rbp + 0x50]
mov rcx, rbx
call fcn.1400029b0
mov dword [rbx - 8], r15d
cmp r14, qword [0x140104010]
je 0x14002c0cd
mov eax, esi
lock xadd dword [r14], eax
sub eax, 1
jg 0x14002c0c9
mov rcx, r14
call fcn.1400bf5e4
mov rbx, qword [rbp + 0x50]
mov rdx, rbx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r14d, eax
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
cmp rcx, qword [0x140104010]
je 0x14002c137
mov eax, esi
lock xadd dword [rcx], eax
sub eax, 1
jg 0x14002c133
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
call fcn.1400bf5e4
mov rbx, qword [rbp + 0x50]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14002c14c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], rdi
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14002c161
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], rdi
mov rax, qword [0x140104018]
test r14d, r14d
jne 0x14002c1e3
mov qword [rbp + 0x60], rax
lea r15, [0x1400d0cf0]
mov rax, r15
shr rax, 0x10
test ax, ax
jne 0x14002c193
movzx edx, r15w
lea rcx, [rbp + 0x60]
call fcn.140001ff0
jmp 0x14002c1cf
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r14, eax
test eax, eax
je 0x14002c1cf
mov edx, r14d
lea rcx, [rbp + 0x60]
call fcn.140001970
test eax, eax
je 0x14002c1cf
mov r9, r14
add r9, r9
lea eax, [r14 + 1]
movsxd rdx, eax
add rdx, rdx
mov r8, r15
mov rcx, qword [rbp + 0x60]
call fcn.1400029b0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x60]
mov rcx, r13
call fcn.140002330
jmp 0x14002c25a
mov qword [rbp + 0x68], rax
lea r14, [0x1400d0d38]
mov rax, r14
shr rax, 0x10
test ax, ax
jne 0x14002c209
movzx edx, r14w
lea rcx, [rbp + 0x68]
call fcn.140001ff0
jmp 0x14002c243
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdi, eax
test eax, eax
je 0x14002c243
mov edx, edi
lea rcx, [rbp + 0x68]
call fcn.140001970
test eax, eax
je 0x14002c243
mov r9, rdi
add r9, r9
lea eax, [rdi + 1]
movsxd rdx, eax
add rdx, rdx
mov r8, r14
mov rcx, qword [rbp + 0x68]
call fcn.1400029b0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x68]
mov rcx, r13
call fcn.140002330
mov edi, 1
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x140104010]
je 0x14002c275
lock xadd dword [rcx], esi
sub esi, 1
jg 0x14002c275
call fcn.1400bf5e4
mov eax, edi
add rsp, 0x108
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret