Function at 0x140069780
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov qword [rbp - 0x59], 0xfffffffffffffffe
mov qword [rsp + 0x130], rbx
mov r12, rdx
call fcn.140068a20
test al, al
je 0x140069ae5
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rbp - 0x41]
call sub.MSVCR100.dll_memset
xor r13d, r13d
mov qword [rbp - 0x79], r13
xor eax, eax
mov qword [rbp - 0x71], rax
mov qword [rbp - 0x69], rax
mov dword [rbp - 0x49], 0x68
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x77], rbx
or rsi, 0xffffffffffffffff
test r12, r12
je 0x140069840
test r12, 0xffffffffffff0000
jne 0x14006982d
movzx edi, r12w
xor edx, edx
mov ecx, edi
call fcn.1400017e0
test rax, rax
je 0x140069856
mov r8d, edi
mov rdx, rax
lea rcx, [rbp + 0x77]
call fcn.140001f70
jmp 0x140069852
xor eax, eax
mov rcx, rsi
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x140069843
mov ecx, r13d
mov r8d, ecx
mov rdx, r12
lea rcx, [rbp + 0x77]
call fcn.140001e80
mov rbx, qword [rbp + 0x77]
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp + 0x7f], rdi
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_wcsrchr]
test rax, rax
je 0x140069a1c
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x140069a1c
lea r8d, [rax + 1]
lea rdx, [rbp - 0x61]
lea rcx, [rbp + 0x77]
call fcn.140001d30
nop
mov r14, qword [rax]
lea rcx, [r14 - 0x18]
lea rbx, [rdi - 0x18]
cmp rcx, rbx
je 0x1400699f6
cmp dword [rbx + 0x10], 0
jl 0x1400698f3
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400698f3
call fcn.140001b90
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400698ea
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
lea rax, [rdi + 0x18]
jmp 0x1400699f2
movsxd r12, dword [r14 - 0x10]
test r12d, r12d
jne 0x140069959
mov r12, qword [rbx]
cmp dword [rbx + 8], 0
je 0x1400699f6
cmp dword [rbx + 0x10], 0
jge 0x14006992d
cmp dword [rdi - 0xc], 0
jge 0x140069920
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rdi - 0x10], r13d
mov word [rdi], r13w
jmp 0x1400699f6
mov eax, esi
lock xadd dword [rbx + 0x10], eax
dec eax
test eax, eax
jg 0x140069946
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x18]
add rax, 0x18
jmp 0x1400699f2
test r14, r14
jne 0x140069969
mov ecx, 0x80070057
call fcn.140001000
int3
mov r15d, dword [rdi - 0x10]
mov r13, r14
sub r13, rdi
sar r13, 1
test r12d, r12d
jns 0x140069986
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 1
sub ecx, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
sub eax, r12d
or eax, ecx
jge 0x1400699a8
mov edx, r12d
lea rcx, [rbp + 0x7f]
call fcn.140001c20
mov rdi, qword [rbp + 0x7f]
lea rbx, [r12 + r12]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
mov r9, rbx
add rdx, rdx
cmp r13, r15
ja 0x1400699ca
lea r8, [rdi + r13*2]
call qword [sym.imp.MSVCR100.dll_memmove_s]
jmp 0x1400699d3
mov r8, r14
call qword [sym.imp.MSVCR100.dll_memcpy_s]
cmp r12d, dword [rdi - 0xc]
jg 0x1400699e7
mov dword [rdi - 0x10], r12d
xor r13d, r13d
mov word [rbx + rdi], r13w
jmp 0x1400699f6
mov ecx, 0x80070057
call fcn.140001000
int3
mov qword [rbp + 0x7f], rax
mov rdx, qword [rbp - 0x61]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140069a14
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rbp + 0x7f]
mov rbx, qword [rbp + 0x77]
cmp dword [rbx - 8], 1
jle 0x140069a32
mov edx, dword [rbx - 0x10]
lea rcx, [rbp + 0x77]
call fcn.140001930
mov rbx, qword [rbp + 0x77]
lea rax, [rbp - 0x79]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140069a81
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_wcsnlen]
test eax, eax
js 0x140069ada
cmp eax, dword [rbx - 0xc]
jg 0x140069ada
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r13w
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140069abc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x77]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140069ae5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140069ae5
mov ecx, 0x80070057
call fcn.140001000
nop
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret