Function at 0x14006e2c0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xe0
xor ebp, ebp
xor sil, sil
test ecx, ecx
mov r14, r9
mov r15, rdx
mov edi, ecx
mov r12d, ebp
je 0x14006e307
cmp ecx, 1
je 0x14006e307
cmp ecx, 1
jle 0x14006e43c
cmp ecx, 3
jle 0x14006e307
cmp ecx, 4
jne 0x14006e43c
mov sil, 1
cmp byte [r8], bpl
mov qword [rsp + 0x118], rbx
mov qword [rsp + 0x120], r13
mov r13, r8
je 0x14006e341
nop
cmp byte [r8], bpl
je 0x14006e32e
add r8, 1
cmp byte [r8], bpl
jne 0x14006e325
cmp byte [r8 + 1], bpl
je 0x14006e33c
mov byte [r8], 0x20
add r8, 1
cmp byte [r8], bpl
jne 0x14006e320
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.14004a070
mov ebx, dword [0x14008a0a0]
mov dword [rsp + 0x70], 0x68
test ebx, ebx
lea r9, [0x14008a0c0]
je 0x14006e398
lea r8d, [rbx - 1]
nop
movsxd rax, r8d
mov rdx, rax
and eax, 0x1f
sar rdx, 5
lea rcx, [rax + rax*4]
mov rax, qword [r9 + rdx*8]
add rcx, rcx
cmp byte [rax + rcx*8 + 8], bpl
jne 0x14006e398
sub r8d, 1
sub ebx, 1
jne 0x14006e370
test ebx, ebx
js 0x14006e5c3
cmp ebx, 0x1c71
jae 0x14006e5c3
movzx eax, bx
mov edx, 1
shl ax, 3
lea ecx, [rax + rbx + 4]
mov word [rsp + 0xb2], cx
movzx ecx, cx
call fcn.1400607a0
test rax, rax
mov qword [rsp + 0xb8], rax
je 0x14006e5c3
test ebx, ebx
mov dword [rax], ebx
mov rcx, qword [rsp + 0xb8]
movsxd r11, ebx
lea rdx, [rcx + 4]
lea r8, [r11 + rcx + 4]
jle 0x14006e492
mov r9, rbp
mov r10d, ebx
lea r11, [0x14008a0c0]
nop
nop
mov al, r9b
mov rcx, r9
and eax, 0x1f
sar rcx, 5
lea rax, [rax + rax*4]
shl rax, 4
add rax, qword [r11 + rcx*8]
movzx ecx, byte [rax + 8]
test cl, 0x10
jne 0x14006e46b
mov byte [rdx], cl
mov rax, qword [rax]
mov qword [r8], rax
jmp 0x14006e475
call fcn.14004c700
mov dword [rax], ebp
call fcn.14004c6d0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
mov qword [rsp + 0x20], rbp
call fcn.140059e70
or rax, 0xffffffffffffffff
jmp 0x14006e5e2
mov byte [rdx], bpl
mov qword [r8], 0xffffffffffffffff
add r9, 1
add rdx, 1
add r8, 8
sub r10, 1
jne 0x14006e410
mov rcx, qword [rsp + 0xb8]
movsxd r11, ebx
test sil, sil
je 0x14006e4ce
mov edx, 3
lea rax, [rcx + 4]
lea rcx, [r11 + rcx + 4]
cmp ebx, edx
cmovl edx, ebx
test edx, edx
jle 0x14006e4c8
nop
mov byte [rax], bpl
mov qword [rcx], 0xffffffffffffffff
add rcx, 8
add rax, 1
sub rdx, 1
jne 0x14006e4b0
mov r12d, 8
call fcn.14004c700
xor r9d, r9d
xor r8d, r8d
mov dword [rax], ebp
lea rax, [rsp + 0x50]
mov rdx, r13
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rcx, r15
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xb8]
mov esi, eax
call fcn.14004ad40
test ebx, ebx
jne 0x14006e539
mov ecx, esi
call fcn.14004c730
jmp 0x14006e5ce
cmp edi, 2
jne 0x14006e546
xor ecx, ecx
call fcn.14004cba0
int3
test edi, edi
jne 0x14006e58e
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x50]
movsxd rbp, dword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
jmp 0x14006e5d2
cmp edi, 4
jne 0x14006e5ae
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
jmp 0x14006e5d2
mov rcx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
jmp 0x14006e5d2
call fcn.14004c6d0
mov dword [rax], 0xc
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x118]
mov r13, qword [rsp + 0x120]
mov rbp, qword [rsp + 0x128]
add rsp, 0xe0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret