Function at 0x140001bbc
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov rax, rdx
mov qword [rsp + 0x58], r8
mov r14, rdx
mov r13d, r9d
xor edx, edx
mov ebp, edx
lea r8d, [rdx + 1]
test rax, rax
je 0x140001c04
cmp word [rax], dx
je 0x140001c04
lea rax, [rax + 2]
add ebp, r8d
cmp word [rax], dx
jne 0x140001bf8
mov rbx, qword [rsp + 0x150]
test rbx, rbx
je 0x140001c2d
cmp word [rbx], dx
je 0x140001c2d
mov rax, rbx
mov ecx, edx
lea rax, [rax + 2]
add ecx, r8d
cmp word [rax], dx
jne 0x140001c1b
lea r15d, [rcx + 2]
jmp 0x140001c30
mov r15d, edx
mov rsi, qword [rsp + 0x158]
mov r12, rdx
mov dword [rsp + 0x138], edx
mov dword [rsp + 0x50], edx
test rsi, rsi
je 0x140001c58
mov dword [rsp + 0x140], r8d
cmp word [rsi], dx
jne 0x140001c5f
mov dword [rsp + 0x140], edx
mov eax, 0x7d00
mov dword [rsp + 0x150], edx
cmp ebp, eax
ja 0x140001fcc
cmp r9d, eax
ja 0x140001fcc
cmp r15d, eax
ja 0x140001fcc
lea eax, [rbp + 4]
add eax, r15d
add eax, r9d
mov dword [rsp + 0x158], eax
cmp eax, 0x3fffffff
jae 0x140001fcc
lea edx, [rax + 1]
xor ecx, ecx
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x140001fcc
xor edx, edx
lea rcx, [rsp + 0x80]
lea r8d, [rdx + 0x68]
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rsp + 0x158]
mov eax, 1
inc r8d
mov dword [rsp + 0x80], 0x68
mov rdx, r14
mov dword [rsp + 0xbc], eax
mov rcx, rdi
mov word [rsp + 0xc0], ax
call fcn.140002b94
lea rdx, str.__1_
mov rcx, rdi
call fcn.140002cd8
mov r14, rax
test rax, rax
jne 0x140001d4c
lea rdx, [0x14000983c]
mov rcx, rdi
call fcn.140002cd8
mov r14, rax
test rax, rax
jne 0x140001d4c
mov eax, ebp
lea r14, [rdi + rax*2]
mov eax, 0x20
cmp word [r14 - 2], ax
je 0x140001d63
mov word [r14], ax
add r14, 2
jmp 0x140001d63
cmp word [r14], 0x22
mov eax, 2
lea ecx, [rax + 2]
cmove eax, ecx
mov dword [rsp + 0x138], eax
test r15d, r15d
je 0x140001de7
lea edx, [r13 + 8]
mov rcx, rbx
call fcn.140002c10
mov r12, rax
test rax, rax
je 0x140001de7
cmp word [rbx], 0x22
jne 0x140001d9a
mov ecx, r15d
cmp word [rbx + rcx*2 - 6], 0x22
jne 0x140001d9a
mov dword [rsp + 0x150], 1
jmp 0x140001da2
and dword [rsp + 0x150], 0
test r13d, r13d
je 0x140001de2
lea ebx, [r13 + 4]
mov rcx, rax
add ebx, r15d
lea rdx, [0x140009844]
mov r8d, ebx
call fcn.140002b6c
mov rdx, qword [rsp + 0x58]
mov r8d, ebx
mov rcx, r12
call fcn.140002b6c
mov r8d, ebx
lea rdx, [0x14000984c]
mov rcx, r12
call fcn.140002b6c
mov qword [rsp + 0x58], r12
mov eax, dword [rsp + 0x150]
mov r9, r14
mov r14d, dword [rsp + 0x158]
mov edx, ebp
mov dword [rsp + 0x30], eax
mov r8d, r14d
mov rax, qword [rsp + 0x58]
mov rcx, rdi
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x138]
mov dword [rsp + 0x20], eax
call fcn.140001a64
xor r15d, r15d
test eax, eax
je 0x140001fb7
lea r13d, [r15 + 1]
mov rax, rdi
mov ecx, r15d
cmp word [rdi], r15w
je 0x140001e47
lea rax, [rax + 2]
add ecx, r13d
cmp word [rax], r15w
jne 0x140001e3a
mov eax, ecx
mov edx, 0x20
lea rcx, [rdi + rax*2]
cmp rcx, rdi
jbe 0x140001e66
add rcx, 0xfffffffffffffffe
cmp word [rcx], dx
jne 0x140001e66
mov word [rcx], r15w
jmp 0x140001e52
mov ecx, 0xffffffff
cmp dword [rsp + 0x140], r15d
je 0x140001f45
mov qword [rsp + 0x150], rsi
jmp 0x140001f3c
cmp word [rsi], r15w
je 0x140001f45
mov rbx, rsi
cmp word [rsi], dx
je 0x140001eae
movzx eax, word [rbx]
add rbx, 2
test ax, ax
je 0x140001eab
cmp word [rbx], dx
jne 0x140001e98
jmp 0x140001eae
mov rbx, r15
sub rbx, rsi
sar rbx, 1
test rbx, rbx
jle 0x140001f45
cmp rbx, rcx
jg 0x140001ff2
mov rax, rdi
mov ebp, r15d
cmp word [rdi], r15w
je 0x140001edf
lea rax, [rax + 2]
add ebp, r13d
cmp word [rax], r15w
jne 0x140001ed2
mov rdx, rsi
mov rcx, rdi
call fcn.140002cd8
mov dword [rsp + 0x30], r15d
mov r9, rax
mov qword [rsp + 0x28], r15
mov r8d, r14d
mov edx, ebp
mov dword [rsp + 0x20], ebx
mov rcx, rdi
call fcn.140001a64
test eax, eax
je 0x140001fb7
lea rdx, [rbx + 1]
cmp rdx, rbx
jl 0x140001feb
lea rcx, [rsp + 0x150]
call section..text
mov rsi, qword [rsp + 0x150]
mov ecx, 0xffffffff
mov edx, 0x20
test rsi, rsi
jne 0x140001e86
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov rax, qword [rsp + 0x130]
test rax, rax
je 0x140001fb7
lea rcx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x48], rcx
xor r8d, r8d
lea rcx, [rsp + 0x80]
mov rdx, rdi
mov qword [rsp + 0x40], rcx
mov rcx, rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140001fb7
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x50], r13d
mov rcx, rdi
call fcn.140003310
test r12, r12
je 0x140001fcc
mov rcx, r12
call fcn.140003310
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x148]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3