Function at 0x140019fe4
Capabilities:
Create process on windows

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0x15e0]
mov eax, 0x16e0
call fcn.14005dd10
sub rsp, rax
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x1700], rbx
mov qword [rsp + 0x1708], rsi
mov qword [rsp + 0x1710], rdi
mov qword [rsp + 0x1718], r12
mov rax, qword [0x14009b3d0]
xor rax, rsp
mov qword [rbp + 0x15d0], rax
xor edx, edx
mov r8d, 0xe4c
lea rcx, [rbp + 0x780]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x40], LoadRegTypeLib
mov dword [rbp + 0x44], 0x6224
xor r12d, r12d
mov qword [rsp + 0x68], r12
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x40]
call sub.MurocApi.dll_Ordinal_273
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14001a2e5
mov esi, r12d
cmp dword [rcx], r12d
jle 0x14001a2e0
lea ebx, [r12 + 4]
mov dword [rbp + 0x50], LoadRegTypeLib
mov dword [rbp + 0x54], 0xe4c
lea r8, [rbp + 0x780]
lea rdx, [rbp + 0x50]
mov ecx, dword [rbx + rcx]
call sub.MurocApi.dll_Ordinal_280
test byte [rbp + 0x11d0], 0x80
je 0x14001a2ca
mov edi, r12d
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140.dll_Ordinal_316]
nop
lea rdx, [rbp + 0x14bc]
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140.dll_Ordinal_1674]
lea rcx, [rsp + 0x60]
call fcn.14003ffa8
lea rcx, [rsp + 0x60]
call fcn.14003ffac
xor edx, edx
test eax, 0xfffffffd
je 0x14001a14f
mov dword [rbp + 0x60], LoadRegTypeLib
mov dword [rbp + 0x64], Ordinal_1487
mov r8d, Ordinal_1487
lea rcx, [rbp + 0x1b0]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x1b0]
lea rdx, [rbp + 0x60]
mov rax, qword [rsp + 0x68]
mov ecx, dword [rbx + rax]
call sub.MurocApi.dll_Ordinal_318
mov r14d, eax
mov r15d, dword [rbp + 0x1b0]
lea rcx, [rbp + 0x1c0]
call fcn.140019f74
test eax, eax
jne 0x14001a1a8
jmp 0x14001a1ad
mov dword [rbp + 0x70], LoadRegTypeLib
mov dword [rbp + 0x74], pe_nt_image_headers64
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x80]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x70]
mov rax, qword [rsp + 0x68]
mov ecx, dword [rbx + rax]
call sub.MurocApi.dll_Ordinal_298
mov r14d, eax
mov r15d, dword [rbp + 0x80]
lea rcx, [rbp + 0x8c]
call fcn.140019f18
mov ecx, 0x80045202
test eax, eax
cmove r14d, ecx
test r14d, r14d
je 0x14001a1d4
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140.dll_Ordinal_1032]
inc edi
cmp edi, 5
jl 0x14001a0c0
jmp 0x14001a2ca
test r15d, r15d
je 0x14001a2bf
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140.dll_Ordinal_316]
nop
lea rdx, [rbp + 0x14bc]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140.dll_Ordinal_1674]
mov edi, 0x68
mov r8d, edi
xor edx, edx
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x60], edi
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x18], r12
mov word [rbp - 0x1e], r12w
mov qword [rbp - 0x50], r12
mov dword [rbp - 0x24], r12d
lea rcx, [rbp + 0x10]
call fcn.140028078
nop
lea rcx, [rbp + 0x10]
call fcn.14002812c
test rax, rax
je 0x14001a2a9
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], Ordinal_39
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, qword [rsp + 0x70]
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x14001a2a9
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x10]
call fcn.1400280a8
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140.dll_Ordinal_1032]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140.dll_Ordinal_1032]
inc esi
add rbx, 0x4e8
mov rcx, qword [rsp + 0x68]
cmp esi, dword [rcx]
jl 0x14001a08f
call sub.MurocApi.dll_Ordinal_19
mov rcx, qword [rbp + 0x15d0]
xor rcx, rsp
call fcn.14005d930
lea r11, [rsp + 0x16e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret