Function at 0x1400ed5c0
Capabilities:
Check for protected handle exception
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xda0]
sub rsp, 0xea0
mov rax, qword [0x14021d798]
xor rax, rsp
mov qword [rbp + 0xd90], rax
mov rax, qword [rbp + 0xe18]
xorps xmm1, xmm1
movsxd r15, dword [rbp + 0xe20]
mov r13, rcx
mov rdi, qword [rbp + 0xe00]
xor ecx, ecx
mov rsi, qword [rbp + 0xe08]
xorps xmm0, xmm0
mov r14, qword [rbp + 0xe10]
mov r12d, ecx
mov qword [rsp + 0x58], rax
xor eax, eax
movups xmmword [rbp - 0x80], xmm1
mov qword [rsp + 0x70], rax
movups xmmword [rbp - 0x50], xmm1
mov qword [rbp - 0x20], rax
movups xmmword [rbp - 0x40], xmm1
mov qword [rsp + 0x78], r8
mov qword [rsp + 0x50], rdx
movups xmmword [rsp + 0x60], xmm0
mov dword [rbp - 0x80], 0x68
movups xmmword [rbp - 0x70], xmm1
mov dword [rbp - 0x44], 0x101
movups xmmword [rbp - 0x60], xmm1
mov word [rbp - 0x40], cx
movups xmmword [rbp - 0x30], xmm1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [rdi]
mov rbx, rax
call fcn.14018af90
mov dword [rsp + 0x30], 2
lea r9, [rbp - 0x30]
mov rdx, rax
mov dword [rsp + 0x28], 1
mov r8, rbx
mov dword [rsp + 0x20], r12d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [rsi + 4]
call fcn.14018af90
mov dword [rsp + 0x30], 2
lea r9, [rbp - 0x28]
mov rdx, rax
mov dword [rsp + 0x28], 1
mov r8, rbx
mov dword [rsp + 0x20], r12d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [r14 + 4]
call fcn.14018af90
mov dword [rsp + 0x30], 2
lea r9, [rbp - 0x20]
mov rdx, rax
mov dword [rsp + 0x28], 1
mov r8, rbx
mov dword [rsp + 0x20], r12d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [rdi + 4]
call fcn.14018af90
mov rcx, rax
lea edx, [r12 + 1]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov ecx, dword [rsi]
call fcn.14018af90
mov rcx, rax
lea edx, [r12 + 1]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov ecx, dword [r14]
call fcn.14018af90
mov rcx, rax
lea edx, [r12 + 1]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rcx, qword [r13 + 0x8e8]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rcx + r15*8 + 0xb8]
test rbx, rbx
je 0x1400ed778
mov r12, qword [rcx + r15*8 + 0xc0]
jmp 0x1400ed963
mov qword [rsp + 0x30], rdi
lea rax, [0x1401ba2d4]
mov qword [rsp + 0x28], rsi
lea r8, [rbp + 0x40]
mov r9d, 0x30c
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov word [rbp + 0x350], r12w
mov rcx, r13
call fcn.1400e46d0
cmp dword [rsp + 0x50], r12d
jne 0x1400edad1
movzx eax, byte [rbp + 0x40]
lea r8, [rbp + 0x40]
test al, al
je 0x1400ed8ed
movzx edx, al
movabs r9, 0xd0000404ffffffff
cmp dl, 0x3f
ja 0x1400ed7e7
movzx ecx, dl
bt r9, rcx
jb 0x1400ed8ed
cmp dl, 0x7c
je 0x1400ed8ed
movzx edx, byte [r8 + 1]
inc r8
test dl, dl
jne 0x1400ed7d5
lea rdx, [rbp + 0x40]
test al, al
je 0x1400ed8ed
cmp al, 0x3f
ja 0x1400ed819
movzx ecx, al
bt r9, rcx
jb 0x1400ed8ed
cmp al, 0x7c
je 0x1400ed8ed
movzx eax, byte [rdx + 1]
inc rdx
test al, al
jne 0x1400ed808
mov r9d, 0x104
lea r8, [rbp + 0x970]
lea rdx, [rbp + 0x40]
mov rcx, r13
call fcn.1400e7680
lea rcx, [rbp + 0x40]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], r12b
jne 0x1400ed850
test rax, rax
je 0x1400ed8ed
movzx ecx, byte [rbp + rax + 0x3f]
cmp cl, 0x20
je 0x1400ed8ed
cmp cl, 0x2e
je 0x1400ed8ed
lea r8, [rbp + 0x18]
xor edx, edx
lea rcx, [rbp + 0x970]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x1400ed8ed
mov r9d, 0x104
lea r8, [rbp + 0xb80]
lea rdx, [rbp + 0x40]
mov rcx, r13
call fcn.1400e7680
lea rdx, [0x1401b9a64]
lea rcx, [rbp + 0xb80]
call fcn.1401821a8
mov rbx, rax
test rax, rax
je 0x1400ed8ed
test rax, rax
je 0x1400ed8e6
mov r8, rax
lea rcx, [rbp + 0x350]
mov edx, 0x30c
call fcn.1401882bc
test rbx, rbx
je 0x1400ed8e6
mov rcx, rbx
call fcn.140181244
mov byte [rbp + 0x65b], r12b
cmp byte [rbp + 0x350], 0x23
jne 0x1400ed955
cmp byte [rbp + 0x351], 0x21
jne 0x1400ed955
lea rcx, [rbp + 0x352]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], r12b
jne 0x1400ed910
lea rbx, [rbp + 0x352]
add rbx, rax
lea rax, [rbp + 0x352]
cmp rbx, rax
jbe 0x1400ed95c
nop
movzx ecx, byte [rbx - 1]
lea rax, [rbx - 1]
mov rbx, rax
call fcn.140189e10
test eax, eax
je 0x1400ed95c
lea rax, [rbp + 0x352]
mov byte [rbx], r12b
cmp rbx, rax
ja 0x1400ed930
jmp 0x1400ed95c
mov byte [rbp + 0x352], r12b
lea rbx, [rbp + 0x352]
xor r9d, r9d
lea r8, [rbp + 0x660]
mov edx, 0x30c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
cmp byte [rbx], 0
je 0x1400eda0b
test r12, r12
je 0x1400ed9d0
cmp byte [r12], 0
je 0x1400ed9d0
mov qword [rsp + 0x40], rdi
lea rax, [rbp + 0x660]
mov qword [rsp + 0x38], rax
lea r8, [rbp + 0x40]
mov qword [rsp + 0x30], r12
lea rax, str.__s___s___s_s_
mov qword [rsp + 0x28], rbx
lea rdx, [rsp + 0x50]
mov r9d, 0x30c
mov qword [rsp + 0x20], rax
mov rcx, r13
call fcn.1400e46d0
jmp 0x1400eda3f
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x660]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x40]
lea rax, str.__s____s_s_
mov qword [rsp + 0x28], rbx
mov r9d, 0x30c
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, r13
call fcn.1400e46d0
jmp 0x1400eda3f
lea rax, [rbp + 0x660]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x40]
lea rax, str.__s_s_
mov r9d, 0x30c
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, r13
call fcn.1400e46d0
cmp dword [rsp + 0x50], 0
jne 0x1400edad1
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x40]
lea rax, [rbp - 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400edada
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
lea r8, str.spawn_process
lea rax, [rbp + 0x40]
xor edx, edx
mov qword [rsp + 0x30], rax
mov r9d, 0x15f1
lea rax, str._s:_CreateProcess__s_:__ld
mov qword [rsp + 0x28], r8
mov rcx, r13
mov qword [rsp + 0x20], rax
call fcn.1400e1360
mov qword [rsp + 0x60], 0xffffffffffffffff
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400edb08
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rbp + 0xd90]
xor rcx, rsp
call fcn.1401702b0
mov rbx, qword [rsp + 0xef8]
add rsp, 0xea0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret