Function at 0x1400cff30
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xe0
xor ebp, ebp
xor sil, sil
test ecx, ecx
mov r14, r9
mov r15, rdx
mov edi, ecx
mov r12d, ebp
je 0x1400cff77
cmp ecx, 1
je 0x1400cff77
cmp ecx, 1
jle 0x1400d00b9
cmp ecx, 3
jle 0x1400cff77
cmp ecx, 4
jne 0x1400d00b9
mov sil, 1
cmp word [r8], bp
mov qword [rsp + 0x118], rbx
mov qword [rsp + 0x120], r13
mov r13, r8
je 0x1400cffb7
cmp word [r8], bp
je 0x1400cffa0
add r8, 2
cmp word [r8], bp
jne 0x1400cff96
cmp word [r8 + 2], bp
je 0x1400cffb1
mov word [r8], 0x20
add r8, 2
cmp word [r8], bp
jne 0x1400cff90
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.1400b57e0
mov ebx, dword [0x140139b48]
mov dword [rsp + 0x70], WSAGetLastError
test ebx, ebx
lea r9, [0x140139b60]
je 0x1400d0017
lea r8d, [rbx - 1]
nop
nop
nop
movsxd rax, r8d
mov cl, al
mov rdx, rax
sar rdx, 5
and ecx, 0x1f
mov rax, qword [r9 + rdx*8]
imul rcx, rcx, 0x58
cmp byte [rax + rcx + 8], bpl
jne 0x1400d0017
sub r8d, 1
sub ebx, 1
jne 0x1400cfff0
test ebx, ebx
js 0x1400d0248
cmp ebx, 0x1c71
jae 0x1400d0248
movzx eax, bx
mov edx, 1
shl ax, 3
lea ecx, [rax + rbx + 4]
mov word [rsp + 0xb2], cx
movzx ecx, cx
call fcn.1400b9e70
test rax, rax
mov qword [rsp + 0xb8], rax
je 0x1400d0248
test ebx, ebx
mov dword [rax], ebx
mov r8, qword [rsp + 0xb8]
movsxd r11, ebx
lea rcx, [r8 + 4]
lea rdx, [r11 + r8 + 4]
jle 0x1400d010f
mov r8, rbp
mov r10d, ebx
lea r11, [0x140139b60]
nop
nop
nop
mov r9b, r8b
mov rax, r8
and r9d, 0x1f
sar rax, 5
imul r9, r9, 0x58
add r9, qword [r11 + rax*8]
movzx eax, byte [r9 + 8]
test al, 0x10
jne 0x1400d00e8
mov byte [rcx], al
mov rax, qword [r9]
mov qword [rdx], rax
jmp 0x1400d00f2
call fcn.1400b3940
mov dword [rax], ebp
call fcn.1400b3910
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
mov qword [rsp + 0x20], rbp
call fcn.1400b1120
or rax, 0xffffffffffffffff
jmp 0x1400d0267
mov byte [rcx], bpl
mov qword [rdx], 0xffffffffffffffff
add r8, 1
add rcx, 1
add rdx, 8
sub r10, 1
jne 0x1400d0090
mov r8, qword [rsp + 0xb8]
movsxd r11, ebx
test sil, sil
je 0x1400d014e
mov edx, 3
lea rax, [r8 + 4]
lea rcx, [r11 + r8 + 4]
cmp ebx, edx
cmovl edx, ebx
test edx, edx
jle 0x1400d0148
nop
nop
mov byte [rax], bpl
mov qword [rcx], 0xffffffffffffffff
add rcx, 8
add rax, 1
sub rdx, 1
jne 0x1400d0130
mov r12d, 8
call fcn.1400b3940
bts r12d, 0xa
xor r9d, r9d
mov dword [rax], ebp
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rdx, r13
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r14
mov rcx, r15
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xb8]
mov esi, eax
call fcn.1400b40d0
test ebx, ebx
jne 0x1400d01be
mov ecx, esi
call fcn.1400b3970
jmp 0x1400d0253
cmp edi, 2
jne 0x1400d01cb
xor ecx, ecx
call fcn.1400b6470
int3
test edi, edi
jne 0x1400d0213
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x50]
movsxd rbp, dword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
jmp 0x1400d0257
cmp edi, 4
jne 0x1400d0233
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
jmp 0x1400d0257
mov rcx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
jmp 0x1400d0257
call fcn.1400b3910
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x118]
mov r13, qword [rsp + 0x120]
mov rbp, qword [rsp + 0x128]
add rsp, 0xe0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret