Function at 0x14000ebc8
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Read file via mapping
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov dword [rax + 0x20], r9d
mov qword [rax + 0x10], rdx
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
xor r15d, r15d
mov r13, r8
mov ebx, ecx
test rdx, rdx
je 0x14000f0eb
test r8, r8
je 0x14000f0eb
call fcn.140001b5c
mov rcx, rax
test rax, rax
je 0x14000f117
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
lea rdx, [rsp + 0x58]
lea rcx, [0x140000000]
mov qword [rsp + 0x58], rax
call fcn.14001bfb4
test eax, eax
je 0x14000ec54
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
jmp 0x14000f0c6
test ebx, ebx
je 0x14000ecbc
mov rbx, qword [rsp + 0x58]
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
jne 0x14000ec75
or eax, 0xffffffff
jmp 0x14000ec7b
sub rax, rbx
sar rax, 1
lea ecx, [rax + 1]
test ecx, ecx
js 0x14000f10c
cmp ecx, dword [rbx - 0xc]
jg 0x14000f10c
cdqe
lea rdx, [0x14005bd90]
mov dword [rbx - 0x10], ecx
mov word [rbx + rax*2 + 2], r15w
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], r15w
jne 0x14000eca5
mov r8d, eax
lea rcx, [rsp + 0x58]
call fcn.140019f84
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.14002d080
test eax, eax
jne 0x14000ecd8
mov r14d, 0x80070241
jmp 0x14000f0cb
xor edx, edx
mov dword [rbp - 0x10], 0x68
lea rcx, [rbp - 8]
lea r8d, [rdx + 0x60]
call sub.msvcrt.dll_memset
xor eax, eax
mov word [rbp + 0x30], r15w
mov rdi, r15
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov dword [rbp + 0x2c], 0x101
cmp qword [rbp + 0xb8], r15
je 0x14000ed48
cmp qword [rbp + 0xb0], r15
je 0x14000ed48
xor r9d, r9d
mov dword [rbp - 0x78], 0x18
xor r8d, r8d
mov qword [rbp - 0x70], r15
lea edx, [rax + 1]
mov dword [rbp - 0x68], 1
lea rcx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov rsi, r15
mov r14, r15
mov r15, qword [rbp + 0xc8]
test r15, r15
je 0x14000edd7
and qword [rsp + 0x28], r14
lea rdx, [rbp - 0x60]
and qword [rbp - 0x58], r14
xor r9d, r9d
or rcx, 0xffffffffffffffff
mov dword [rbp - 0x60], 0x18
mov dword [rbp - 0x50], 1
mov dword [rsp + 0x20], 0x400000
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
test rax, rax
je 0x14000edd7
xor r9d, r9d
mov qword [rsp + 0x20], 0x400000
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
je 0x14000edd7
mov rdx, r15
mov rcx, rax
call fcn.1400154f8
xor r15d, r15d
test al, al
jne 0x14000edda
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x14000ede3
xor r15d, r15d
test r14, r14
jne 0x14000ee8a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9, qword [rbp + 0x98]
lea rdx, str.__s___ProxyCall__RunTarget___s____s___d__d__p
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x30], eax
mov r8, rbx
mov eax, dword [rbp + 0xa8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
call fcn.14001d438
mov r14, rax
mov rdx, qword [rax]
cmp dword [rdx - 8], 1
jle 0x14000ee36
mov edx, dword [rdx - 0x10]
mov rcx, rax
call fcn.140001fb0
mov rdx, qword [r14]
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp - 0x10]
mov rcx, rbx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000ee7b
mov eax, r15d
jmp 0x14000ee80
call fcn.14001b570
mov rdx, qword [rsp + 0x78]
jmp 0x14000ef2f
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9, qword [rbp + 0x98]
lea rdx, str.__s___ProxyCall__RunTarget___s____s___d__d__p__p
mov qword [rsp + 0x40], rsi
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x38], rdi
mov r8, rbx
mov dword [rsp + 0x30], eax
mov eax, dword [rbp + 0xa8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
call fcn.14001d438
mov r14, rax
mov rdx, qword [rax]
cmp dword [rdx - 8], 1
jle 0x14000eee1
mov edx, dword [rdx - 0x10]
mov rcx, rax
call fcn.140001fb0
mov rdx, qword [r14]
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp - 0x10]
mov rcx, rbx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000ef26
mov eax, r15d
jmp 0x14000ef2b
call fcn.14001b570
mov rdx, qword [rbp - 0x80]
or r13, 0xffffffffffffffff
mov dword [rsp + 0x50], eax
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14000ef53
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r14d, dword [rsp + 0x50]
test r14d, r14d
jne 0x14000f096
mov rcx, qword [rsp + 0x68]
call qword [fcn.140037368]
mov rbx, qword [rbp + 0xb8]
test rbx, rbx
je 0x14000f060
mov r14d, 1
test rdi, rdi
je 0x14000efac
cmp qword [rbp + 0xb0], r15
je 0x14000efac
mov rcx, qword [rbp + 0xb0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14000efac
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov r9d, 0x1f4
mov dword [rsp + 0x20], 8
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov ecx, r14d
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, 0x102
je 0x14000ef82
test eax, eax
je 0x14000f06e
cmp eax, r14d
jne 0x14000f04e
mov r9d, 0x985c
mov dword [rsp + 0x20], r14d
mov r8d, 0x8000
lea rcx, [rbp - 0x48]
mov rdx, r13
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14000ef82
test rdi, rdi
je 0x14000f022
cmp qword [rbp + 0xb0], r15
je 0x14000f022
mov rcx, qword [rbp + 0xb0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000f040
mov ecx, dword [rbp - 0x40]
cmp ecx, 0x8001
je 0x14000efdf
mov r9, qword [rbp + 0xc0]
mov r8, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x38]
call rbx
jmp 0x14000efdf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x14000ef82
mov rcx, qword [rsp + 0x60]
mov edx, 0x80004001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x14000f06e
mov rcx, qword [rsp + 0x60]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x80004005
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x60]
call qword [fcn.140037368]
mov r14d, dword [rsp + 0x50]
test rsi, rsi
je 0x14000f0ae
mov rcx, rsi
call qword [fcn.140037368]
test eax, eax
jne 0x14000f0ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rdi, rdi
je 0x14000f0c6
mov rcx, rdi
call qword [fcn.140037368]
test eax, eax
jne 0x14000f0c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x58]
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14000f0e6
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, r14d
jmp 0x14000f0f0
mov eax, 0x80070057
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
mov ecx, 0x80070057
call fcn.140002198
int3
mov ecx, 0x80004005
call fcn.140002198
int3