Function at 0x140001000
Capabilities:
Create process on windows

Disassembly:
push r15
push rdi
push rsi
push rbp
sub rsp, 0x4f8
mov r15, rdx
mov ebp, ecx
xor ecx, ecx
mov rax, qword [section..data]
mov qword [rsp + 0x4f0], rax
call fcn.140007d3c
movsxd rdi, ebp
lea rax, [0x14000a2c0]
movaps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x450], xmm0
movaps xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x460], xmm1
movaps xmm2, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x470], xmm2
movaps xmm3, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x480], xmm3
movaps xmm4, xmmword [rax + 0x40]
movaps xmmword [rsp + 0x490], xmm4
movaps xmm5, xmmword [rax + 0x50]
movaps xmmword [rsp + 0x4a0], xmm5
mov rdx, qword [rax + 0x60]
mov qword [rsp + 0x4b0], rdx
xor esi, esi
cmp rdi, 3
jge 0x1400010ab
mov rcx, qword [rsp + 0x4f0]
call fcn.140001310
mov eax, 0xb
add rsp, 0x4f8
pop rbp
pop rsi
pop rdi
pop r15
ret
mov rcx, qword [r15 + 8]
mov dword [rsp + 0x4d0], 0x18
xor eax, eax
mov edx, 2
mov dword [rsp + 0x4e0], 1
mov qword [rsp + 0x4d8], rax
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x4d0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rbp, 0xffffffffffffffff
je 0x1400012cf
mov eax, 2
cmp rdi, 2
jle 0x140001151
mov r8, qword [r15 + rax*8]
movsx rcx, byte [r8]
movzx r9d, cl
mov edx, 1
test r9d, r9d
je 0x14000113f
mov byte [rsp + rsi + 0x50], cl
movsx rcx, byte [rdx + r8]
add rsi, 1
movzx r9d, cl
add rdx, 1
test r9d, r9d
jne 0x140001125
mov byte [rsp + rsi + 0x50], 0x20
add rsi, 1
add rax, 1
cmp rax, rdi
jl 0x14000110f
mov dword [rsp + 0x48c], 0x100
mov qword [rsp + 0x4a8], rbp
movsxd rax, esi
mov byte [rsp + rax + 0x4f], 0
mov qword [rsp + 0x4b0], rbp
xor esi, esi
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x4a0], rsi
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov qword [rsp + 0x38], rsi
lea rdi, [rsp + 0x450]
mov qword [rsp + 0x40], rdi
xor r9d, r9d
lea r10, [rsp + 0x4b8]
mov qword [rsp + 0x48], r10
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400012ab
mov rcx, qword [rsp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x4b8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x140001279
mov rcx, qword [rsp + 0x4b8]
lea rdx, [rsp + 0x4e8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x140001248
mov rcx, qword [rsp + 0x4b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, qword [rsp + 0x4f0]
call fcn.140001310
mov eax, ebp
add rsp, 0x4f8
pop rbp
pop rsi
pop rdi
pop r15
ret
mov rcx, qword [rsp + 0x4b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [rsp + 0x4e8]
mov rcx, qword [rsp + 0x4f0]
call fcn.140001310
mov eax, ebp
add rsp, 0x4f8
pop rbp
pop rsi
pop rdi
pop r15
ret
mov rcx, qword [rsp + 0x4b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, qword [rsp + 0x4f0]
call fcn.140001310
mov eax, ebp
add rsp, 0x4f8
pop rbp
pop rsi
pop rdi
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, qword [rsp + 0x4f0]
call fcn.140001310
mov eax, ebp
add rsp, 0x4f8
pop rbp
pop rsi
pop rdi
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, qword [rsp + 0x4f0]
call fcn.140001310
mov eax, ebp
add rsp, 0x4f8
pop rbp
pop rsi
pop rdi
pop r15
ret