Function at 0x14000a6b0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x100
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
mov rbp, r9
mov r13, r8
mov r12, rdx
call fcn.14003c3f0
mov r11, rax
xor r14d, r14d
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000a70a
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x50], rax
call fcn.14003c3f0
mov r11, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000a73c
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov r8, qword [r12]
lea rdx, str.__s_
lea rcx, [rsp + 0x50]
call fcn.140006f70
mov r8, r13
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x78]
call fcn.140006b70
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x50]
add rdi, 0xffffffffffffffe8
or ebx, 0xffffffff
cmp rcx, rdi
je 0x14000a7d8
cmp dword [rdi + 0x10], 0
jl 0x14000a7c9
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14000a7c9
call fcn.140004470
mov rsi, rax
mov ecx, ebx
lock xadd dword [rdi + 0x10], ecx
add ecx, ebx
test ecx, ecx
jg 0x14000a7be
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x50], rax
jmp 0x14000a7d8
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140006310
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000a7f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x90]
call fcn.1400a09f0
mov dword [rsp + 0x90], reloc.OLEAUT32.dll_VarCyFromDisp
mov edi, 1
cmp dword [rsp + 0x158], 0
je 0x14000a836
mov dword [rsp + 0xcc], edi
mov word [rsp + 0xd0], 0
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000a8c7
cmp dword [rsp + 0x150], 0
je 0x14000a8af
or edx, 0xffffffff
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, rbp
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000a8d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp], eax
mov edi, r14d
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000a8f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000a915
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000a935
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x14000a953
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, edi
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret