Function at 0x140098e00
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xe0
xor ebp, ebp
xor sil, sil
test ecx, ecx
mov r14, r9
mov r15, rdx
mov edi, ecx
mov r12d, ebp
je 0x140098e47
cmp ecx, 1
je 0x140098e47
cmp ecx, 1
jle 0x140098f89
cmp ecx, 3
jle 0x140098e47
cmp ecx, 4
jne 0x140098f89
mov sil, 1
cmp word [r8], bp
mov qword [rsp + 0x118], rbx
mov qword [rsp + 0x120], r13
mov r13, r8
je 0x140098e87
cmp word [r8], bp
je 0x140098e70
add r8, 2
cmp word [r8], bp
jne 0x140098e66
cmp word [r8 + 2], bp
je 0x140098e81
mov word [r8], 0x20
add r8, 2
cmp word [r8], bp
jne 0x140098e60
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.140082240
mov ebx, dword [0x1400f1428]
mov dword [rsp + 0x70], WSAGetLastError
test ebx, ebx
lea r9, [0x1400f1440]
je 0x140098ee7
lea r8d, [rbx - 1]
nop
nop
nop
movsxd rax, r8d
mov cl, al
mov rdx, rax
sar rdx, 5
and ecx, 0x1f
mov rax, qword [r9 + rdx*8]
imul rcx, rcx, 0x58
cmp byte [rax + rcx + 8], bpl
jne 0x140098ee7
sub r8d, 1
sub ebx, 1
jne 0x140098ec0
test ebx, ebx
js 0x140099118
cmp ebx, 0x1c71
jae 0x140099118
movzx eax, bx
mov edx, 1
shl ax, 3
lea ecx, [rax + rbx + 4]
mov word [rsp + 0xb2], cx
movzx ecx, cx
call fcn.140088de0
test rax, rax
mov qword [rsp + 0xb8], rax
je 0x140099118
test ebx, ebx
mov dword [rax], ebx
mov r8, qword [rsp + 0xb8]
movsxd r11, ebx
lea rcx, [r8 + 4]
lea rdx, [r11 + r8 + 4]
jle 0x140098fdf
mov r8, rbp
mov r10d, ebx
lea r11, [0x1400f1440]
nop
nop
nop
mov r9b, r8b
mov rax, r8
and r9d, 0x1f
sar rax, 5
imul r9, r9, 0x58
add r9, qword [r11 + rax*8]
movzx eax, byte [r9 + 8]
test al, 0x10
jne 0x140098fb8
mov byte [rcx], al
mov rax, qword [r9]
mov qword [rdx], rax
jmp 0x140098fc2
call fcn.14007f500
mov dword [rax], ebp
call fcn.14007f4d0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], socket
mov qword [rsp + 0x20], rbp
call fcn.14007e3a0
or rax, 0xffffffffffffffff
jmp 0x140099137
mov byte [rcx], bpl
mov qword [rdx], 0xffffffffffffffff
add r8, 1
add rcx, 1
add rdx, 8
sub r10, 1
jne 0x140098f60
mov r8, qword [rsp + 0xb8]
movsxd r11, ebx
test sil, sil
je 0x14009901e
mov edx, 3
lea rax, [r8 + 4]
lea rcx, [r11 + r8 + 4]
cmp ebx, edx
cmovl edx, ebx
test edx, edx
jle 0x140099018
nop
nop
mov byte [rax], bpl
mov qword [rcx], 0xffffffffffffffff
add rcx, 8
add rax, 1
sub rdx, 1
jne 0x140099000
mov r12d, 8
call fcn.14007f500
bts r12d, 0xa
xor r9d, r9d
mov dword [rax], ebp
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rdx, r13
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r14
mov rcx, r15
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xb8]
mov esi, eax
call fcn.140080070
test ebx, ebx
jne 0x14009908e
mov ecx, esi
call fcn.14007f530
jmp 0x140099123
cmp edi, 2
jne 0x14009909b
xor ecx, ecx
call fcn.140082000
int3
test edi, edi
jne 0x1400990e3
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x50]
movsxd rbp, dword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
jmp 0x140099127
cmp edi, 4
jne 0x140099103
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
jmp 0x140099127
mov rcx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
jmp 0x140099127
call fcn.14007f4d0
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x118]
mov r13, qword [rsp + 0x120]
mov rbp, qword [rsp + 0x128]
add rsp, 0xe0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret