Function at 0x140053a20
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, reloc.MFC80U.DLL_Ordinal_1792
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x6f0], rax
mov rsi, rcx
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_754]
xor edx, edx
mov r8d, reloc.MFC80U.DLL_Ordinal_1022
mov word [rsp + reloc.MFC80U.DLL_Ordinal_752], 0
call sub.ntdll.dll_memset
lea rcx, [rsp + 0xf2]
xor edx, edx
mov r8d, Ordinal_512
mov word [rsp + 0xf0], 0
call sub.ntdll.dll_memset
mov ebx, dword [rsi]
mov rdi, qword [rsi + 8]
call fcn.140049400
lea rdx, [rsp + 0xf0]
mov r9d, ebx
mov r10, qword [rax]
mov r8d, 0x100
mov rcx, rax
mov qword [rsp + 0x20], rdi
call qword [r10 + 0x58]
test eax, eax
jne 0x140053b9a
call fcn.140049470
lea rbx, [0x140433950]
xor edx, edx
mov rcx, rbx
mov r8d, 0x80
mov rsi, rax
call sub.ntdll.dll_memset
lea rcx, str...cnvfat.cpp
mov edx, 0x5c
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
jne 0x140053af8
xor ebx, ebx
jmp 0x140053b80
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0xe0]
mov r8d, 0x2bd
mov byte [rsp + 0xe0], 0
mov qword [rsp + 0xe1], rax
mov word [rsp + 0xe9], ax
mov byte [rsp + 0xeb], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x140053b40
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0xe0]
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x140053b70
mov rax, qword [rsi]
lea rdx, str._s:_Get_guid_failed_for_chkdsk.exe
mov r8, rbx
mov rcx, rsi
call qword [rax + 0x10]
xor eax, eax
jmp 0x140053ca0
lea r8, [rsp + 0xf0]
lea rdx, str.chkdsk.exe__Volume_s__V
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_752]
call qword [sym.imp.MSVCR80.dll__swprintf]
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rdx
call sub.ntdll.dll_memset
mov rax, qword [rsi + 0x190]
or dword [rsp + 0xac], 0x101
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xc8], rax
mov rax, qword [rsi + reloc.MFC80U.DLL_Ordinal_376]
xor ebx, ebx
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_752]
mov qword [rsp + 0xc0], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0x20], 1
mov word [rsp + 0xb0], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140053c8f
call fcn.140049470
lea rcx, str...cnvfat.cpp
mov edx, 0x2e0
mov rbx, qword [rax]
mov rdi, rax
call fcn.140052f30
lea rdx, str._s:_CreateProcess_failed
mov rcx, rdi
mov r8, rax
call qword [rbx + 0x10]
xor eax, eax
jmp 0x140053ca0
mov rcx, qword [rsp + 0x50]
mov eax, 1
mov qword [0x140423220], rcx
mov rcx, qword [rsp + 0x6f0]
xor rcx, rsp
call fcn.140161080
lea r11, [rsp + reloc.MFC80U.DLL_Ordinal_1792]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret