Function at 0x140013020
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [0x1400a21a8]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov r14, r8
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x30], rdx
xor r9d, r9d
mov dword [rsp + 0x38], r9d
lea rbx, [rsp + 0x17d]
mov r8d, 1
nop
dec rbx
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [rbx], r8b
mov r8d, edx
test edx, edx
jne 0x140013070
xorps xmm0, xmm0
movups xmmword [rsp + 0x108], xmm0
mov qword [rsp + 0x118], r9
mov qword [rsp + 0x120], r9
lea rax, [rsp + 0x17d]
movabs r12, 0x7fffffffffffffff
cmp rbx, rax
jne 0x1400130fd
mov rdi, r9
mov qword [rsp + 0x118], r9
mov esi, 0xf
mov qword [rsp + 0x120], rsi
mov byte [rsp + 0x108], dil
lea r13d, [rdx + 0x16]
mov r15, qword [rsp + 0x108]
jmp 0x1400131c6
lea rdi, [rsp + 0x17d]
sub rdi, rbx
cmp rdi, r12
ja 0x140013607
cmp rdi, 0x10
jae 0x140013166
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x120], 0xf
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x108]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rdi + 0x108], 0
mov r13d, 0x16
mov rsi, qword [rsp + 0x120]
mov rdi, qword [rsp + 0x118]
mov r15, qword [rsp + 0x108]
jmp 0x1400131c3
mov rsi, rdi
or rsi, 0xf
mov r13d, 0x16
cmp rsi, r12
jbe 0x14001317d
mov rsi, r12
jmp 0x140013184
cmp rsi, r13
cmovb rsi, r13
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x108]
call fcn.140016b50
mov r15, rax
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x120], rsi
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + rdi], 0
xor r9d, r9d
mov qword [rsp + 0xa8], r9
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rsp + 0x70]
mov rdx, r14
lea rcx, [rsp + 0xe8]
call fcn.140007ea0
nop
xor edx, edx
mov rcx, rax
call fcn.14000d400
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x148], xmm0
mov qword [rsp + 0x158], 3
mov qword [rsp + 0x160], 0xf
mov eax, dword [0x14005ace4]
mov word [rsp + 0x148], ax
movzx eax, byte [0x14005ace6]
mov byte [rsp + 0x14a], al
mov byte [rsp + 0x14b], 0
lea rdx, [rsp + 0x148]
call fcn.14000d1c0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000a9e0
nop
movzx edx, byte [rsp + 0xe8]
lea rcx, [rsp + 0xf0]
call fcn.1400187c0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x128], xmm0
movdqa xmm1, xmmword [0x14005c890]
movdqu xmmword [rsp + 0x138], xmm1
mov byte [rsp + 0x128], 0
mov dword [rsp + 0x38], r13d
cmp byte [rsp + 0x40], 3
jne 0x14001360d
lea rax, [rsp + 0x128]
mov rdx, qword [rsp + 0x48]
cmp rax, rdx
je 0x1400132d3
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400132c5
mov rdx, qword [rdx]
lea rcx, [rsp + 0x128]
call fcn.140017060
nop
lea r8, [rsp + 0x128]
cmp qword [rsp + 0x140], 0x10
cmovae r8, qword [rsp + 0x128]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x140]
cmp rdx, 0x10
jb 0x140013356
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013351
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013351
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052a58
movdqa xmm0, xmmword [0x14005c890]
movdqu xmmword [rsp + 0x138], xmm0
mov byte [rsp + 0x128], 0
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.1400187c0
nop
mov rax, r12
sub rax, rdi
cmp rax, 0xa
jb 0x140013665
lea rdx, [rsp + 0x108]
cmp rsi, 0x10
cmovae rdx, r15
mov qword [rsp + 0x30], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0xe8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xf8], xmm1
lea rax, [rdi + 0xa]
mov ebx, 0xf
lea r14, [rsp + 0xe8]
cmp rax, rbx
jbe 0x140013461
mov rbx, rax
or rbx, 0xf
cmp rbx, r12
jbe 0x14001341a
mov rbx, r12
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140052a1c
test rax, rax
je 0x140013578
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
lea rax, [rdi + 0xa]
mov rdx, qword [rsp + 0x30]
jmp 0x140013459
cmp rbx, 0x16
cmovb rbx, r13
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14001343e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001366b
jmp 0x1400133f2
test rcx, rcx
je 0x140013456
call fcn.140052a1c
mov r14, rax
lea rax, [rdi + 0xa]
mov rdx, qword [rsp + 0x30]
jmp 0x140013459
xor r14d, r14d
mov qword [rsp + 0xe8], r14
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rbx
movsd xmm0, qword [str._count_:]
movsd qword [r14], xmm0
movzx eax, word [0x14005acb0]
mov word [r14 + 8], ax
lea rcx, [r14 + 0xa]
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rdi + 0xa], 0
mov rcx, qword [rsp + 0xf8]
mov rdx, qword [rsp + 0x100]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1400134e9
lea rax, [rcx + 1]
mov qword [rsp + 0xf8], rax
lea rax, [rsp + 0xe8]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0xe8]
mov word [rax + rcx], 0x7d
lea rax, [rsp + 0xe8]
jmp 0x14001350d
mov qword [rsp + 0x20], 1
lea r9, [0x14005aca4]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0xe8]
call fcn.1400039e0
xorps xmm0, xmm0
mov rbx, qword [rsp + 0x50]
movups xmmword [rbx], xmm0
xor ecx, ecx
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], rcx
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 0xf
mov byte [rax], cl
mov rdx, qword [rsp + 0x100]
cmp rdx, 0x10
jb 0x140013584
inc rdx
mov rcx, qword [rsp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001357f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001357f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052a58
movdqa xmm0, xmmword [0x14005c890]
movdqu xmmword [rsp + 0xf8], xmm0
mov byte [rsp + 0xe8], 0
cmp rsi, 0x10
jb 0x1400135d7
lea rdx, [rsi + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400135cf
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400135cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.140052a58
mov rax, rbx
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140052eb0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140016ab0
nop
lea rcx, [rsp + 0x40]
call fcn.140025550
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rdx, str.type_must_be_string__but_is
lea rcx, [rsp + 0x148]
call fcn.1400046f0
nop
lea r9, [rsp + 0x40]
mov r8, rax
mov edx, 0x12e
lea rcx, [rsp + 0xb0]
call fcn.140005510
lea rdx, [0x14009c468]
lea rcx, [rsp + 0xb0]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call fcn.140016ab0
int3
call fcn.140016820
int3