Function at 0x1400289d0
Capabilities:
Create process on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov word [rsp + 0x18], r8w
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x6f8
mov qword [rsp + 0x110], 0xfffffffffffffffe
mov rax, qword [0x140322b20]
xor rax, rsp
mov qword [rsp + 0x6e0], rax
mov dword [rsp + 0x50], 0
mov eax, dword [rsp + 0x728]
and eax, 2
cmp eax, 2
jne 0x140028ceb
lea rax, [rsp + 0x360]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rsp + 0x240]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov dword [rsp + 0x360], VarBstrFromDisp
mov dword [rsp + 0x39c], 1
movzx eax, word [rsp + 0x720]
mov word [rsp + 0x3a0], ax
mov rcx, qword [rsp + 0x718]
call fcn.14001bd90
mov rcx, rax
call fcn.140048030
lea rcx, [rsp + 0x240]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x360]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov ecx, dword [rsp + 0x730]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140028c78
lea r9, [0x140252580]
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1a0]
call fcn.140038d20
lea rcx, [rsp + 0x128]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
xor edx, edx
mov rcx, qword [rsp + 0x718]
call fcn.14002f250
lea rcx, [rsp + 0x190]
lea rdx, [rsp + 0x128]
mov rdi, rcx
mov rsi, rdx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov ecx, dword [rsp + 0x254]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsp + 0x250]
mov r8, rax
lea rdx, str._tasp::library_CreateProcess__command:_s__pid_lu_tid_lu._n
lea rcx, [rsp + 0x190]
call fcn.14003b980
mov dword [rsp + 0x50], 1
cmp qword [rsp + 0x738], 0
je 0x140028b8d
mov rax, qword [rsp + 0x738]
mov ecx, dword [rsp + 0x250]
mov dword [rax], ecx
mov eax, dword [rsp + 0x728]
and eax, 4
cmp eax, 4
jne 0x140028c5a
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x2d4], 0
lea rdx, [rsp + 0x2d4]
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp qword [rsp + 0x740], 0
je 0x140028bf0
mov rax, qword [rsp + 0x740]
mov ecx, dword [rsp + 0x2d4]
mov dword [rax], ecx
lea r9, [0x140252700]
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1d0]
call fcn.140038d20
lea rcx, [rsp + 0xc8]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x180]
lea rcx, [rsp + 0xc8]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov r8d, dword [rsp + 0x2d4]
lea rdx, str._tasp::library_GetExitCodeProcess_ExitCode_lu._n
lea rcx, [rsp + 0x180]
call fcn.14003b980
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140028ce6
lea r9, [0x1402527d0]
mov r8d, 2
mov edx, 3
lea rcx, [rsp + 0x230]
call fcn.140038d20
lea rcx, [rsp + 0x160]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x140]
lea rdx, [rsp + 0x160]
mov rdi, rcx
mov rsi, rdx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov r8d, eax
lea rdx, str._tasp::library_CreateProcess_err:_lu
lea rcx, [rsp + 0x140]
call fcn.14003b980
jmp 0x140029294
mov eax, dword [rsp + 0x728]
and eax, 1
cmp eax, 1
jne 0x140029294
cmp qword [0x14032aee0], 0
je 0x140028d12
cmp qword [0x14032aef8], 0
jne 0x140028d30
mov dword [rsp + 0x68], 0
mov rcx, qword [rsp + 0x718]
call fcn.140020590
mov eax, dword [rsp + 0x68]
jmp 0x1400292ad
mov rdx, qword [rsp + 0x718]
lea rcx, [rsp + 0x2e0]
call fcn.14001f3a0
nop
lea rcx, [rsp + 0x450]
call fcn.14001f530
nop
lea rcx, [rsp + 0x3d0]
call fcn.14001f530
nop
lea rcx, [rsp + 0x2e0]
call fcn.14001bd90
xor r8d, r8d
lea rdx, [0x1402515dc]
mov rcx, rax
call fcn.14004ce20
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], 0xffffffffffffffff
cmp qword [rsp + 0x60], 0xffffffffffffffff
je 0x140028dcd
mov rax, qword [rsp + 0x60]
inc rax
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x2e0]
call fcn.14001bd90
mov rcx, qword [rsp + 0x78]
mov r8, rcx
lea rdx, [0x1402516ac]
mov rcx, rax
call fcn.14004ce20
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0xffffffffffffffff
je 0x140028f15
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
sub rcx, rax
mov rax, rcx
dec rax
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0x60]
inc rcx
mov qword [rsp + 0x98], rcx
lea rcx, [rsp + 0x2e0]
call fcn.14001bd90
mov rcx, qword [rsp + 0xa8]
mov r9, rcx
mov rcx, qword [rsp + 0x98]
mov r8, rcx
lea rdx, [rsp + 0x210]
mov rcx, rax
call fcn.140050980
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x80], rax
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x450]
call fcn.140021230
nop
lea rcx, [rsp + 0x210]
call fcn.14001f8f0
lea rcx, [rsp + 0x2e0]
call fcn.14001bd90
mov rcx, rax
call fcn.140031220
sub rax, qword [rsp + 0x58]
dec rax
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x58]
inc rcx
mov qword [rsp + 0xa0], rcx
lea rcx, [rsp + 0x2e0]
call fcn.14001bd90
mov rcx, qword [rsp + 0x90]
mov r9, rcx
mov rcx, qword [rsp + 0xa0]
mov r8, rcx
lea rdx, [rsp + 0x1f0]
mov rcx, rax
call fcn.140050980
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xc0], rax
mov rdx, qword [rsp + 0xc0]
lea rcx, [rsp + 0x3d0]
call fcn.140021230
nop
lea rcx, [rsp + 0x1f0]
call fcn.14001f8f0
mov dword [rsp + 0x260], 0
lea rax, [rsp + 0x264]
mov rdi, rax
xor eax, eax
mov ecx, 0x6c
rep stosb byte [rdi], al
mov dword [rsp + 0x260], WSAStartup
mov eax, dword [rsp + 0x728]
and eax, 4
test eax, eax
je 0x140028f57
mov dword [rsp + 0x54], 0x40
jmp 0x140028f5f
mov dword [rsp + 0x54], 0x400
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x264], eax
mov qword [rsp + 0x268], 0
lea rax, [0x140252aa8]
mov qword [rsp + 0x270], rax
lea rcx, [rsp + 0x450]
call fcn.14001bd90
mov rcx, rax
call fcn.140048030
mov qword [rsp + 0x278], rax
lea rcx, [rsp + 0x3d0]
call fcn.14001bd90
mov rcx, rax
call fcn.140048030
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x288], 0
movzx eax, word [rsp + 0x720]
mov dword [rsp + 0x290], eax
mov qword [rsp + 0x298], 0
lea rcx, [rsp + 0x260]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1400291fc
lea r9, [0x140252c90]
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1b0]
call fcn.140038d20
lea rcx, [rsp + 0x150]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rsp + 0x70], eax
xor edx, edx
lea rcx, [rsp + 0x3d0]
call fcn.14002f250
mov qword [rsp + 0x88], rax
xor edx, edx
lea rcx, [rsp + 0x450]
call fcn.14002f250
lea rcx, [rsp + 0x170]
lea rdx, [rsp + 0x150]
mov rdi, rcx
mov rsi, rdx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov ecx, dword [rsp + 0x70]
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x290]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x264]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x88]
mov r9, rcx
mov r8, rax
lea rdx, str._tasp::library_ShellExecuteEx__lpFile:_s___lpParameters:_s___fMask:_lu___nShow:_d__pid_lu._n
lea rcx, [rsp + 0x170]
call fcn.14003b980
mov eax, dword [rsp + 0x728]
and eax, 4
test eax, eax
je 0x1400291f2
lea r9, [rsp + 0x2d8]
mov r8d, 8
lea rdx, [rsp + 0x258]
mov rcx, qword [rsp + 0x2c8]
call qword [0x14032aee0]
test eax, eax
je 0x14002912a
cmp qword [0x14032aef8], 0
je 0x14002912a
mov r9d, 0x104
lea r8, [rsp + 0x4d0]
mov rdx, qword [rsp + 0x258]
mov rcx, qword [rsp + 0x2c8]
call qword [0x14032aef8]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x2d0], 0
lea rdx, [rsp + 0x2d0]
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp qword [rsp + 0x740], 0
je 0x14002917a
mov rax, qword [rsp + 0x740]
mov ecx, dword [rsp + 0x2d0]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [0x1402530a0]
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1c0]
call fcn.140038d20
lea rcx, [rsp + 0xf0]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x100]
lea rcx, [rsp + 0xf0]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov r8d, dword [rsp + 0x2d0]
lea rdx, str._tasp::library_ShellExecuteEx:GetExitCodeProcess_ExitCode_lu._n
lea rcx, [rsp + 0x100]
call fcn.14003b980
mov dword [rsp + 0x50], 1
jmp 0x14002926b
lea r9, [0x1402531a0]
mov r8d, 2
mov edx, 3
lea rcx, [rsp + 0x1e0]
call fcn.140038d20
lea rcx, [rsp + 0x118]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0x118]
mov rdi, rcx
mov rsi, rdx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov r8d, eax
lea rdx, str._tasp::library_ShellExecuteEx_err:_lu_n
lea rcx, [rsp + 0xe0]
call fcn.14003b980
nop
lea rcx, [rsp + 0x3d0]
call fcn.140020590
nop
lea rcx, [rsp + 0x450]
call fcn.140020590
nop
lea rcx, [rsp + 0x2e0]
call fcn.140020590
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x6c], eax
mov rcx, qword [rsp + 0x718]
call fcn.140020590
mov eax, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0x6e0]
xor rcx, rsp
call fcn.1401fe250
add rsp, 0x6f8
pop rdi
pop rsi
ret