Function at 0x110118530
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
xor ebx, ebx
mov r14d, ecx
mov r13d, ebx
mov r12b, bl
lea eax, [rbx + 4]
lea esi, [rbx + 3]
cmp ecx, 1
jbe 0x110118578
jle 0x11011857e
cmp ecx, esi
jle 0x110118578
cmp ecx, eax
jne 0x11011857e
mov r12b, 1
mov qword [rbp - 0x51], r8
jmp 0x1101185be
call sym.msvcrt.dll___doserrno
mov dword [rax], ebx
call sym.msvcrt.dll__errno
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
call sym.msvcrt.dll__invalid_parameter
jmp 0x11011886a
inc r8
cmp byte [r8], bl
jne 0x1101185a9
cmp byte [r8 + 1], bl
je 0x1101185be
mov byte [r8], 0x20
inc r8
mov al, byte [r8]
test al, al
jne 0x1101185a9
mov edi, 0x68
lea rcx, [rbp - 0x49]
mov r8d, edi
xor edx, edx
call sym.msvcrt.dll_memset
mov dword [rbp - 0x49], edi
lea rdx, [sym.msvcrt.dll___pioinfo]
mov edi, dword [0x110195924]
test edi, edi
je 0x110118611
movsxd rcx, edi
dec rcx
mov rax, rcx
and ecx, 0x1f
sar rax, 5
imul rcx, rcx, 0x38
mov rax, qword [rdx + rax*8]
cmp byte [rax + rcx + 8], bl
jne 0x11011860f
sub edi, 1
jne 0x1101185ec
test edi, edi
js 0x11011885f
movsxd r15, edi
cmp r15, 0x1c71
jae 0x11011885f
movzx eax, di
lea ecx, [rdi + 4]
shl ax, 3
mov edx, 1
add cx, ax
movzx ecx, cx
mov word [rbp - 7], cx
call fcn.110119e8c
mov qword [rbp - 1], rax
test rax, rax
je 0x11011885f
mov dword [rax], edi
or rbx, 0xffffffffffffffff
mov rax, qword [rbp - 1]
lea r9, [rax + 4]
add r9, r15
lea rdx, [rax + 4]
test edi, edi
jle 0x1101186bc
xor r8d, r8d
mov r11d, edi
lea r15, [sym.msvcrt.dll___pioinfo]
mov rax, r8
mov rcx, r8
and eax, 0x1f
sar rcx, 5
imul r10, rax, 0x38
add r10, qword [r15 + rcx*8]
mov al, byte [r10 + 8]
test al, 0x10
jne 0x11011869c
mov byte [rdx], al
mov rax, qword [r10]
jmp 0x1101186a2
mov byte [rdx], r13b
mov rax, rbx
mov qword [r9], rax
inc r8
add r9, 8
inc rdx
sub r11, 1
jne 0x110118678
mov rax, qword [rbp - 1]
movsxd r15, edi
test r12b, r12b
je 0x11011877a
lea r12, [rax + 4]
add r12, r15
lea r13, [rax + 4]
cmp edi, esi
cmovl esi, edi
xor r15d, r15d
test esi, esi
jle 0x110118774
cmp esi, 2
jb 0x110118753
lea eax, [rsi - 1]
movsxd rcx, eax
lea rax, [r12 + rcx*8]
lea rdx, [rcx + r13]
cmp r13, rax
ja 0x1101186fd
cmp rdx, r12
jae 0x110118753
mov eax, esi
and eax, 0x80000001
jge 0x11011870d
dec eax
or eax, 0xfffffffe
inc eax
mov ecx, esi
sub ecx, eax
add r15d, 2
cmp r15d, ecx
jl 0x110118711
lea eax, [rcx + 1]
cdq
sub eax, edx
xor edx, edx
sar eax, 1
movsxd rcx, eax
lea rdi, [rcx + rcx]
mov rcx, r13
mov r8, rdi
call sym.msvcrt.dll_memset
mov rdx, rdi
add r13, rdi
shl rdx, 3
mov rdi, r12
mov rcx, rdx
mov rax, rbx
shr rcx, 3
rep stosq qword [rdi], rax
add r12, rdx
cmp r15d, esi
jge 0x110118774
sub esi, r15d
mov eax, esi
mov byte [r13], 0
inc r13
mov qword [r12], rbx
lea r12, [r12 + 8]
sub rax, 1
jne 0x11011875d
mov r13d, 8
call sym.msvcrt.dll___doserrno
mov rdx, qword [rbp - 0x51]
xor r9d, r9d
mov rcx, qword [rbp + 0x6f]
xor r8d, r8d
and dword [rax], 0
lea rax, [rbp - 0x69]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
mov rax, qword [rbp + 0x7f]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 1
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessA]
mov edi, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, qword [rbp - 1]
mov esi, eax
call sym.msvcrt.dll_free
test edi, edi
jne 0x1101187ea
mov ecx, esi
call fcn.110107d08
mov rax, rbx
jmp 0x11011886e
cmp r14d, 2
je 0x110118889
test r14d, r14d
jne 0x110118837
mov rcx, qword [rbp - 0x69]
or edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x69]
lea rdx, [rbp + 0x67]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
test eax, eax
je 0x11011881e
movsxd rbx, dword [rbp + 0x67]
jmp 0x11011882b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.110107d08
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x110118853
mov eax, 4
cmp r14d, eax
jne 0x11011884f
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor ebx, ebx
jmp 0x110118853
mov rbx, qword [rbp - 0x69]
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x1101187e2
call sym.msvcrt.dll__errno
mov dword [rax], 0xc
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x130]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor ecx, ecx
call sym.msvcrt.dll__exit
int3