Function at 0x140009e70
Capabilities:
Create process on windows

Disassembly:
push rdi
sub rsp, 0x2b0
mov rax, qword [0x1403a3ab8]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov dword [rsp + 0x50], 3
mov qword [rsp + 0x58], 0
call fcn.14000bd20
mov qword [rsp + 0x58], rax
mov eax, 8
imul rax, rax, 0
lea rcx, [0x140054848]
mov qword [rsp + rax + 0x78], rcx
call fcn.14000b1b0
test eax, eax
jne 0x140009f05
mov dword [rsp + 0x28], 1
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14000c840
test eax, eax
je 0x140009f05
mov rcx, qword [rsp + 0x58]
call fcn.14000bd80
mov eax, 0xb
jmp 0x14000a280
mov r9d, 0x104
lea r8, [0x1403a4aa0]
lea rdx, [0x1403a4990]
xor ecx, ecx
call fcn.14000b780
mov dword [rsp + 0x50], eax
call fcn.14000b1b0
test eax, eax
je 0x14000a1b7
lea rax, [rsp + 0x190]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x190]
call fcn.14000b2f0
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140009f73
cmp dword [rsp + 0x50], 0xb
je 0x140009f73
mov dword [rsp + 0x60], 1
jmp 0x140009f7b
mov dword [rsp + 0x60], 0
cmp dword [rsp + 0x60], 0
jne 0x14000a19d
lea rax, [rsp + 0xb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov dword [rsp + 0xb0], 0x68
lea r8, [0x140054858]
mov edx, 0x104
lea rcx, [rsp + 0x190]
call fcn.1400412dc
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x190]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14000a059
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000a077
call fcn.14000b580
call fcn.14000b510
mov rcx, qword [rsp + 0x58]
call fcn.14000bd80
mov eax, 3
jmp 0x14000a280
mov edx, 0x104
lea rcx, [rsp + 0x190]
call fcn.14000b220
test eax, eax
je 0x14000a19b
lea rax, [rsp + 0x120]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rsp + 0x98]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov dword [rsp + 0x120], 0x68
lea r8, [0x14005485c]
mov edx, 0x104
lea rcx, [rsp + 0x190]
call fcn.1400412dc
lea r8, [0x1403a4aa0]
mov edx, 0x104
lea rcx, [rsp + 0x190]
call fcn.1400412dc
lea rax, [rsp + 0x98]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x190]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14000a17d
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000a19b
call fcn.14000b580
call fcn.14000b510
mov rcx, qword [rsp + 0x58]
call fcn.14000bd80
mov eax, 3
jmp 0x14000a280
jmp 0x14000a1b5
call fcn.14000b580
mov rcx, qword [rsp + 0x58]
call fcn.14000bd80
mov eax, dword [rsp + 0x50]
jmp 0x14000a280
jmp 0x14000a1c9
lea rdx, [0x1403a4990]
xor ecx, ecx
call fcn.14000bcd0
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x14000a1e1
cmp dword [rsp + 0x50], 0xb
je 0x14000a1e1
mov dword [rsp + 0x64], 1
jmp 0x14000a1e9
mov dword [rsp + 0x64], 0
cmp dword [rsp + 0x64], 0
jne 0x14000a268
lea r8, [rsp + 0x74]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x6c]
call fcn.14000a420
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x14000a220
cmp dword [rsp + 0x50], 0xb
je 0x14000a220
mov dword [rsp + 0x68], 1
jmp 0x14000a228
mov dword [rsp + 0x68], 0
cmp dword [rsp + 0x68], 0
jne 0x14000a268
cmp dword [rsp + 0x6c], 2
jne 0x14000a23d
cmp dword [rsp + 0x70], 5
je 0x14000a24f
mov dword [0x1403a4988], 3
mov dword [rsp + 0x50], 7
cmp dword [rsp + 0x74], 0
je 0x14000a268
mov dword [0x1403a4988], 4
mov dword [rsp + 0x50], 4
call fcn.14000b510
call fcn.14000b580
mov rcx, qword [rsp + 0x58]
call fcn.14000bd80
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140039770
add rsp, 0x2b0
pop rdi
ret