Function at 0x140002d09
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x518
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x4b0], rcx
cmp qword [rbp + 0x4b0], 0
jne 0x140002d50
mov ecx, 2
mov rax, qword [fcn.14000e790]
call rax
mov rcx, rax
lea rax, str.Command_is_NULL_n
mov rdx, rax
call fcn.140001450
jmp 0x140003070
mov rax, qword [rbp + 0x4b0]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rax
mov edx, 0
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
mov dword [rbp + 0x48c], eax
mov eax, dword [rbp + 0x48c]
cdqe
add rax, rax
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x480], rax
mov rdx, qword [rbp + 0x4b0]
mov eax, dword [rbp + 0x48c]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x480]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
mov rax, qword [rbp + 0x480]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rax
mov edx, 0
mov ecx, 0xd698
mov rax, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call rax
mov dword [rbp + 0x47c], eax
mov eax, dword [rbp + 0x47c]
cdqe
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x470], rax
mov rdx, qword [rbp + 0x480]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rbp + 0x47c]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x470]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0xd698
mov rax, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call rax
lea rax, [rbp + 0x400]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rbp + 0x400], 0x68
mov dword [rbp + 0x43c], 1
mov word [rbp + 0x440], 0
lea rax, [rbp + 0x3e0]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov rdx, qword [rbp + 0x470]
lea rax, [rbp - 0x30]
mov r9, rdx
lea r8, str.cmd.exe__C___s_
mov edx, 0x400
mov rcx, rax
call fcn.1400014e7
lea rax, [rbp - 0x30]
lea rdx, [rbp + 0x3e0]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp + 0x400]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
jne 0x140002fae
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
mov ecx, 2
mov rax, qword [fcn.14000e790]
call rax
mov rcx, rax
mov r8d, ebx
lea rax, str.CreateProcess_failed___d_._n
mov rdx, rax
call fcn.140001450
mov rax, qword [rbp + 0x480]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp + 0x470]
mov rcx, rax
call sub.msvcrt.dll_free
jmp 0x140003070
mov rax, qword [rbp + 0x3e0]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x3e0]
lea rdx, [rbp + 0x3dc]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call rax
test eax, eax
jne 0x140003014
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
mov ecx, 2
mov rax, qword [fcn.14000e790]
call rax
mov rcx, rax
mov r8d, ebx
lea rax, str.GetExitCodeProcess_failed___d_._n
mov rdx, rax
call fcn.140001450
jmp 0x14000302b
mov eax, dword [rbp + 0x3dc]
mov edx, eax
lea rax, str.Command_executed_with_exit_status:__lu_n
mov rcx, rax
call fcn.140001493
mov rax, qword [rbp + 0x3e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x3e8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x480]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp + 0x470]
mov rcx, rax
call sub.msvcrt.dll_free
nop
add rsp, 0x518
pop rbx
pop rbp
ret