Function at 0x140009f74
Capabilities:
Create pipe
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x6c8]
sub rsp, 0x790
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x140042038]
xor rax, rsp
mov qword [rbp + 0x680], rax
mov rbx, rdx
mov r15, rcx
lea rdx, [0x1400386fc]
lea rcx, [rbp + 0x60]
call fcn.140017878
lea rdi, [r15 + 0x8a0]
mov rdx, rdi
lea rcx, [rbp + 0x60]
call fcn.14001784c
lea rdx, [0x140038700]
lea rcx, [rbp + 0x60]
call fcn.14001784c
mov rdx, rbx
lea rcx, [rbp + 0x60]
call fcn.14001784c
lea rdx, [0x1400386fc]
lea rcx, [rbp + 0x60]
call fcn.14001784c
xor r12d, r12d
mov qword [rsp + 0x60], 4
mov qword [rsp + 0x68], r12
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
lea esi, [r12 + 4]
lea ebx, [rsi + 0x64]
mov r8d, ebx
xor edx, edx
lea rcx, [rbp - 0x10]
call fcn.140017af0
mov dword [rbp - 0x10], ebx
mov dword [rbp + 0x2c], 0x101
mov word [rbp + 0x30], r12w
mov eax, dword [rsp + 0x60]
shr eax, 3
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rsp + 0x70]
lea r13d, [r12 + 1]
test r13b, al
je 0x14000a0ce
test rdx, rdx
je 0x14000a07d
cmp qword [rsp + 0x68], r12
je 0x14000a07d
mov rax, rdx
jmp 0x14000a0d1
test rcx, rcx
je 0x14000a0ce
cmp qword [rsp + 0x78], r12
je 0x14000a0ce
lea rcx, [rsp + 0x70]
call fcn.14000fe1c
lea rcx, [rsp + 0x68]
call fcn.14000fe1c
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, qword [rbp - 0x80]
call fcn.14000fe40
xor r8d, r8d
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
call fcn.14000fe40
mov rcx, qword [rbp - 0x80]
mov rax, rcx
mov rdx, qword [rsp + 0x70]
jmp 0x14000a0d1
mov rax, r12
mov r14d, 2
test rax, rax
jne 0x14000a107
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
mov r8d, 0xfffffff5
mov edx, r14d
lea rcx, [rsp + 0x60]
call fcn.14000ff70
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rsp + 0x70]
mov qword [rbp + 0x48], rax
mov eax, dword [rsp + 0x60]
shr eax, 3
test r13b, al
je 0x14000a16c
test rcx, rcx
je 0x14000a123
cmp qword [rsp + 0x78], r12
jne 0x14000a16f
test rdx, rdx
je 0x14000a16c
cmp qword [rsp + 0x68], r12
je 0x14000a16c
lea rcx, [rbp - 0x80]
call fcn.14000fe1c
lea rcx, [rsp + 0x78]
call fcn.14000fe1c
xor r8d, r8d
lea rdx, [rbp - 0x80]
mov rcx, qword [rsp + 0x70]
call fcn.14000fe40
xor r8d, r8d
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
call fcn.14000fe40
mov rcx, qword [rsp + 0x70]
jmp 0x14000a16f
mov rcx, r12
test rcx, rcx
jne 0x14000a197
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x80]
mov r8d, 0xfffffff4
mov edx, esi
lea rcx, [rsp + 0x60]
call fcn.14000ff70
mov rcx, rax
mov qword [rbp + 0x50], rcx
mov dword [rbp - 0x30], 0x18
mov dword [rbp - 0x20], r12d
mov qword [rbp - 0x28], r12
or rsi, 0xffffffffffffffff
test byte [rsp + 0x60], 0x10
je 0x14000a1e1
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp - 0x70], rax
cmp rax, rsi
je 0x14000a274
mov r8d, r13d
lea rdx, [rbp - 0x70]
mov rcx, rax
call fcn.14000fe40
jmp 0x14000a29a
test byte [rsp + 0x60], r13b
je 0x14000a21c
mov rax, qword [rbp - 0x70]
test rax, rax
jne 0x14000a29e
xor r9d, r9d
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x14000a216
mov rax, rsi
jmp 0x14000a29e
mov rax, qword [rbp - 0x70]
jmp 0x14000a27a
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp - 0x70], rax
lea rcx, [rax - 1]
mov r8d, r13d
cmp rcx, 0xfffffffffffffffd
jbe 0x14000a1d0
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r9, [rbp - 0x30]
mov edx, 0x80000000
lea rcx, [0x14003bd38]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x70], rax
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x14000a27a
mov qword [rbp - 0x70], r12
jmp 0x14000a29a
mov r8d, r13d
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.14000fe40
lea rcx, [rbp - 0x70]
call fcn.14000fe1c
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x70], rax
mov rax, qword [rbp - 0x70]
mov qword [rbp + 0x40], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000a2f3
mov edx, 0xa03d
mov rcx, r15
call fcn.140004c40
or ebx, 0xffffffff
jmp 0x14000a452
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x70]
call fcn.14000fe1c
lea rcx, [rsp + 0x70]
call fcn.14000fe1c
lea rcx, [rbp - 0x80]
call fcn.14000fe1c
lea rcx, [rsp + 0x60]
call fcn.14000feb0
lea rdx, [rsp + 0x50]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ebx, 0x103
jmp 0x14000a353
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x50]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x50], ebx
je 0x14000a339
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x50], r12d
je 0x14000a44e
mov rdi, qword [rbp - 0x60]
test rdi, rdi
je 0x14000a393
lea rbx, [rdi + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdi, qword [rdi + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14000a396
mov rdi, r12
test rdi, rdi
je 0x14000a441
lea rcx, [rdi + 0x100]
mov rax, r14
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.140015698
mov r14, rax
lea rcx, [rdi + 1]
call fcn.140015698
mov rsi, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r9d, 0x100
lea r8, [rbp + 0x480]
mov edx, 0xa03a
call qword [sym.imp.USER32.dll_LoadStringW]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14000a3fb
mov rdx, rsi
call fcn.140010180
mov byte [rsi + rdi], r12b
mov rcx, rsi
call fcn.140011ec0
mov rbx, rax
mov r8, rax
lea rdx, [rbp + 0x480]
mov rcx, r14
call fcn.140018288
mov rdx, r14
mov rcx, r15
call fcn.140004bbc
mov rcx, rsi
call fcn.140017d1c
mov rcx, r14
call fcn.140017d1c
mov rcx, rbx
call fcn.140017d1c
jmp 0x14000a44e
mov edx, 0xa03e
mov rcx, r15
call fcn.140004c40
mov ebx, dword [rsp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.14000fe1c
lea rcx, [rsp + 0x70]
call fcn.14000fe1c
lea rcx, [rbp - 0x80]
call fcn.14000fe1c
lea rcx, [rsp + 0x68]
call fcn.14000fe1c
lea rcx, [rsp + 0x78]
call fcn.14000fe1c
lea rcx, [rbp - 0x78]
call fcn.14000fe1c
mov dword [rsp + 0x64], r12d
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14000a4aa
dec dword [rcx + 8]
cmp dword [rcx + 8], r12d
jne 0x14000a4aa
mov rax, qword [rcx]
mov edx, r13d
call qword [rax]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14000a4c5
dec dword [rcx + 8]
cmp dword [rcx + 8], r12d
jne 0x14000a4c5
mov r8, qword [rcx]
mov edx, r13d
call qword [r8]
mov eax, ebx
mov rcx, qword [rbp + 0x680]
xor rcx, rsp
call fcn.140015ef0
mov rbx, qword [rsp + 0x7e0]
add rsp, 0x790
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret