Function at 0x180067374
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x650]
sub rsp, 0x750
mov rax, qword [0x180122658]
xor rax, rsp
mov qword [rbp + 0x640], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rbp + 0x210]
mov r8d, 0x42a
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov edi, reloc.combase.dll_Ordinal_104
lea rcx, [rsp + 0x70]
mov r8d, edi
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
movzx ecx, word [rbx + 0x92]
lea r14d, [rdi - 0x67]
xor esi, esi
mov dword [rsp + 0x70], edi
mov word [rbp - 0x50], r14w
mov dword [rbp - 0x54], r14d
mov dword [rbx + 0xf0], esi
test cx, cx
jne 0x1800673f9
xor eax, eax
jmp 0x1800675be
call fcn.180068d8c
mov rdx, rax
mov qword [rsp + 0x28], rsi
lea rax, [rbp + 0x210]
mov r9d, 0x215
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SearchPathW]
dec eax
cmp eax, 0x214
jbe 0x180067446
movzx ecx, word [rbx + 0x92]
lea rdx, [rbp + 0x210]
mov r8d, 0x215
call qword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
mov edi, 0x111
lea r8, str.__Embedding
mov edx, edi
lea rcx, [rbp - 0x20]
call fcn.18000dd00
test eax, eax
js 0x1800673f2
cmp dword [rbx + 0x7c], r14d
jne 0x180067492
movzx ecx, word [rbx + 0x94]
call fcn.180068d8c
test rax, rax
je 0x1800673f2
mov r8, rax
lea rcx, [rbp - 0x20]
mov edx, edi
call fcn.18000dc7c
test eax, eax
js 0x1800673f2
mov rax, qword [rbx + 0x80]
sub rax, qword [0x180103ab8]
jne 0x1800674b0
mov rax, qword [rbx + 0x88]
sub rax, qword [0x180103ac0]
test rax, rax
je 0x18006751e
mov rax, qword [rbx + 0x80]
sub rax, qword [0x180103a98]
jne 0x1800674d3
mov rax, qword [rbx + 0x88]
sub rax, qword [0x180103aa0]
test rax, rax
je 0x18006751e
mov rax, qword [rbx + 0x80]
sub rax, qword [0x180103aa8]
jne 0x1800674f6
mov rax, qword [rbx + 0x88]
sub rax, qword [0x180103ab0]
test rax, rax
je 0x18006751e
mov rax, qword [rbx + 0x80]
sub rax, qword [0x1800f2170]
jne 0x180067519
mov rax, qword [rbx + 0x88]
sub rax, qword [0x1800f2178]
test rax, rax
jne 0x180067527
mov eax, 7
mov word [rbp - 0x50], ax
lea r8, [rbp - 0x20]
mov edx, 0x215
lea rcx, [rbp + 0x210]
call fcn.18000dc7c
test eax, eax
js 0x1800673f2
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x210]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
mov edi, eax
test eax, eax
je 0x1800675bc
mov rcx, qword [rsp + 0x50]
mov edx, 0x7530
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor edx, edx
mov rcx, rbx
call fcn.180066e44
mov dword [rbx + 0xf0], r14d
mov eax, edi
mov rcx, qword [rbp + 0x640]
xor rcx, rsp
call fcn.180023ec0
lea r11, [rsp + 0x750]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret