Function at 0x140002680
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x178
movaps xmmword [rsp + 0x160], xmm6
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rsi, rax
mov edx, 0xfa00
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
xor r13d, r13d
xor ecx, ecx
mov rdx, rax
mov r8d, 0x7d00
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, rdi
mov dx, 0x2e
call sub.api_ms_win_crt_private_l1_1_0.dll_wcsrchr
lea rcx, [rax + 2]
lea rdx, [0x140003558]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscpy
lea rcx, str._started_from_console
lea rdx, [0x14000358c]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x54], 1
xorps xmm6, xmm6
movaps xmmword [rsp + 0xf0], xmm6
movaps xmmword [rsp + 0x140], xmm6
movaps xmmword [rsp + 0x130], xmm6
movaps xmmword [rsp + 0x120], xmm6
movaps xmmword [rsp + 0x110], xmm6
movaps xmmword [rsp + 0x100], xmm6
mov qword [rsp + 0x150], 0
mov dword [rsp + 0xf0], 0x68
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov r15, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call r15
mov rbx, rax
mov ecx, 0xfffffff5
call r15
mov r14, rax
mov ecx, 0xfffffff4
call r15
mov r15, rax
mov dword [rsp + 0x88], 0x68
movups xmmword [rsp + 0x90], xmm6
movups xmmword [rsp + 0xa0], xmm6
movups xmmword [rsp + 0xb0], xmm6
movups xmmword [rsp + 0xba], xmm6
movzx eax, word [rsp + 0x132]
mov word [rsp + 0xca], ax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0xd0], rax
mov rbp, qword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea r12, [rsp + 0x84]
mov rcx, rbx
mov rdx, r12
call rbp
test eax, eax
cmovne rbx, r13
mov qword [rsp + 0xd8], rbx
mov rcx, r14
mov rdx, r12
call rbp
test eax, eax
cmovne r14, r13
mov qword [rsp + 0xe0], r14
mov rcx, r15
mov rdx, r12
call rbp
test eax, eax
cmovne r15, r13
xor eax, eax
test r15, r15
setne al
shl eax, 8
or r14, rbx
mov ecx, 0x100
cmove ecx, eax
mov qword [rsp + 0xe8], r15
mov dword [rsp + 0xc4], ecx
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400028c7
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x60]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x68]
call rsi
mov eax, dword [rsp + 0x54]
jmp 0x140002934
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov ecx, 0x1300
xor edx, edx
mov r8d, eax
mov r9d, 0x400
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, qword [rsp + 0x58]
lea rdx, str._ls:__ls
lea r8, str.CreateProcess
mov rcx, rax
call fcn.140001f50
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
movaps xmm6, xmmword [rsp + 0x160]
add rsp, 0x178
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret