Function at 0x140017590
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Create process suspended
Resume thread

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
lea r13, str.gpgme_w32spawn:_argv__2i____s_n
xor r12d, r12d
mov rsi, rcx
mov rbx, rdx
mov dword [rsp + 0x190], r8d
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov rdi, qword [rsi]
or eax, 0x4000000
mov r14, qword [fcn.14001de00]
mov dword [rsp + 0x5c], eax
test rdi, rdi
mov r15, rdi
je 0x140017639
nop dword [rax]
mov ecx, 2
call r14
mov r9, r15
mov r8d, r12d
mov rdx, r13
add r12, 1
mov rcx, rax
call fcn.140017530
mov r15, qword [rsi + r12*8]
test r15, r15
jne 0x140017610
mov rdi, qword [rsi]
mov qword [rsp + 0x60], 0
test rdi, rdi
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x60], 0x18
je 0x140017c1a
lea r13, [rsi + 8]
mov rdx, rdi
xor eax, eax
mov r8, r13
nop dword [rax]
lea ecx, [rax + 1]
movzx eax, byte [rdx]
test al, al
jne 0x140017697
jmp 0x1400176b1
movzx eax, byte [rdx + 1]
add rdx, 1
add ecx, 1
test al, al
je 0x1400176b1
cmp al, 0x5c
je 0x14001769f
cmp al, 0x22
jne 0x140017688
movzx eax, byte [rdx + 1]
add ecx, 1
add rdx, 1
add ecx, 1
test al, al
jne 0x140017697
mov rdx, qword [r8]
lea eax, [rcx + 2]
add r8, 8
test rdx, rdx
jne 0x140017678
add ecx, 3
movsxd rcx, ecx
call sub.msvcrt.dll_malloc
test rax, rax
mov r12, rax
je 0x140017cbb
nop word [rax + rax]
lea rcx, [rax + 1]
mov byte [rax], 0x22
movzx eax, byte [rdi]
test al, al
jne 0x140017704
jmp 0x140017720
movzx eax, byte [rdi]
lea rcx, [rdx + 1]
add rdi, 1
mov byte [rdx], al
movzx eax, byte [rdi]
test al, al
je 0x140017720
cmp al, 0x5c
je 0x14001770f
cmp al, 0x22
mov rdx, rcx
jne 0x1400176f0
lea rdx, [rcx + 1]
mov byte [rcx], 0x5c
jmp 0x1400176f0
mov rdi, qword [r13]
add r13, 8
mov edx, 0x2022
lea rax, [rcx + 2]
mov word [rcx], dx
test rdi, rdi
jne 0x1400176e0
lea r13, [rsp + 0xc0]
mov byte [rax], 0
mov ecx, 0xd
xor eax, eax
mov rdi, r13
rep stosq qword [rdi], rax
mov eax, dword [rsp + 0x190]
mov ecx, 0xfffffff6
mov dword [rsp + 0xc0], 0x68
mov rdi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [rsp + 0xfc], 0x101
and eax, 8
neg eax
sbb ax, ax
and eax, 5
mov word [rsp + 0x100], ax
call rdi
mov ecx, 0xfffffff5
mov qword [rsp + 0x110], rax
call rdi
mov ecx, 0xfffffff4
mov qword [rsp + 0x118], rax
call rdi
cmp dword [rbx], 0xffffffff
mov qword [rsp + 0x120], rax
je 0x140017c35
lea r15, [rbx + 0x10]
xor r14d, r14d
xor edi, edi
xor ebp, ebp
jmp 0x1400177ed
cmp eax, 1
je 0x140017960
cmp eax, 2
je 0x1400179a0
add r15, 0x10
cmp dword [r15 - 0x10], 0xffffffff
je 0x140017831
mov eax, dword [r15 - 0xc]
test eax, eax
jne 0x1400177d0
movsxd rax, dword [r15 - 8]
mov ecx, 2
add r15, 0x10
mov rbp, rax
mov qword [rsp + 0x110], rax
call qword [fcn.14001de00]
lea rdx, str.gpgme_w32spawn:_dup_0x_x_to_stdin_n
mov r8d, ebp
mov ebp, 1
mov rcx, rax
call fcn.140017530
cmp dword [r15 - 0x10], 0xffffffff
jne 0x1400177ed
mov eax, ebp
mov edx, edi
xor eax, 1
xor edx, 1
or eax, edx
jne 0x140017ad3
test r14d, r14d
je 0x1400179d7
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], r13
mov rdx, r12
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x5c]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x38], 0
mov r9, r8
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 1
or eax, 4
mov dword [rsp + 0x28], eax
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140017bd7
mov rcx, r12
call sub.msvcrt.dll_free
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
movsxd rcx, dword [rbx]
add rbx, 0x10
cmp ecx, 0xffffffff
je 0x1400178ce
nop word [rax + rax]
call rsi
movsxd rcx, dword [rbx]
add rbx, 0x10
cmp ecx, 0xffffffff
jne 0x1400178c0
test byte [rsp + 0x190], 2
je 0x140017924
mov eax, dword [0x140023038]
test eax, eax
je 0x140017b86
mov rax, qword [0x140023030]
test rax, rax
je 0x140017924
mov ecx, dword [rsp + 0x90]
call rax
mov edi, dword [rsp + 0x90]
mov ecx, 2
mov ebx, eax
call qword [fcn.14001de00]
lea rdx, str.gpgme_w32spawn:_AllowSetForegroundWindow__d_:_rc_d_n
mov r9d, ebx
mov rcx, rax
mov r8d, edi
call fcn.140017530
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x88]
call rsi
mov rcx, qword [rsp + 0x80]
call rsi
xor eax, eax
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movsxd rax, dword [r15 - 8]
mov ecx, 2
mov rdi, rax
mov qword [rsp + 0x118], rax
call qword [fcn.14001de00]
lea rdx, str.gpgme_w32spawn:_dup_0x_x_to_stdout_n
mov r8d, edi
mov edi, 1
mov rcx, rax
call fcn.140017530
jmp 0x1400177e2
movsxd rax, dword [r15 - 8]
mov ecx, 2
mov r14, rax
mov qword [rsp + 0x120], rax
call qword [fcn.14001de00]
lea rdx, str.gpgme_w32spawn:dup_0x_x_to_stderr_n
mov r8d, r14d
mov r14d, 1
mov rcx, rax
call fcn.140017530
jmp 0x1400177e2
mov qword [rsp + 0x30], 0
mov r8d, 3
mov edx, 0xc0000000
mov dword [rsp + 0x28], pe_nt_image_headers64
lea r9, [rsp + 0xa0]
mov dword [rsp + 0x20], 3
lea rcx, [0x140020093]
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0xa0], 0x18
mov dword [rsp + 0xb0], 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov r15, rax
je 0x140017cc3
test edi, edi
je 0x140017b79
mov qword [rsp + 0x120], r15
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], r13
mov rdx, r12
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x5c]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x38], 0
mov r9, r8
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 1
or eax, 4
mov dword [rsp + 0x28], eax
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140017bd7
mov rcx, r12
call sub.msvcrt.dll_free
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call rsi
jmp 0x1400178ae
mov qword [rsp + 0x30], 0
mov r8d, 3
mov edx, 0xc0000000
mov dword [rsp + 0x28], pe_nt_image_headers64
lea r9, [rsp + 0xa0]
mov dword [rsp + 0x20], 3
lea rcx, [0x140020093]
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0xa0], 0x18
mov dword [rsp + 0xb0], 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov r15, rax
je 0x140017cc3
test ebp, ebp
jne 0x140017b5f
mov qword [rsp + 0x110], r15
test edi, edi
jne 0x140017b6b
mov qword [rsp + 0x118], r15
test r14d, r14d
jne 0x140017a67
jmp 0x140017a5f
mov qword [rsp + 0x118], rax
jmp 0x140017a5f
mov dword [0x140023038], 1
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov r12, rax
je 0x1400178e6
lea rdx, str.AllowSetForegroundWindow
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x140023030], rax
jne 0x1400178f2
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400178e6
mov rcx, r12
call sub.msvcrt.dll_free
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 2
mov ebx, eax
call qword [fcn.14001de00]
lea rdx, str.gpgme_w32spawn:_spawn_error:__d_n
mov r8d, ebx
mov rcx, rax
call fcn.140017530
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 5
mov eax, 0xffffffff
jmp 0x140017948
mov ecx, 1
call sub.msvcrt.dll_malloc
test rax, rax
je 0x140017cbb
mov r12, rax
jmp 0x140017739
mov qword [rsp + 0x30], 0
mov r8d, 3
mov edx, 0xc0000000
mov dword [rsp + 0x28], pe_nt_image_headers64
lea r9, [rsp + 0xa0]
mov dword [rsp + 0x20], 3
lea rcx, [0x140020093]
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0xa0], 0x18
mov dword [rsp + 0xb0], 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov r15, rax
je 0x140017cc3
xor edi, edi
xor r14d, r14d
jmp 0x140017b57
or eax, 0xffffffff
jmp 0x140017948
mov rcx, r12
call sub.msvcrt.dll_free
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 5
mov eax, 0xffffffff
jmp 0x140017948