Function at 0x14000b710
Capabilities:
Create process on windows

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov qword [rsp + 0x30], rsp
mov r15, rcx
xor eax, eax
mov rsi, rax
mov qword [rsp + 0x28], rax
mov edx, 1
mov dword [rsp + 0x120], edx
mov r12d, eax
mov rbx, rcx
cmp word [rcx], 0x20
jne 0x14000b774
mov r8d, 0x20
mov eax, r8d
nop dword [rax]
test ax, ax
je 0x14000b77a
add rbx, 2
mov ax, word [rbx]
cmp ax, r8w
je 0x14000b760
jmp 0x14000b77a
mov r8d, 0x20
cmp word [rbx], si
jne 0x14000b786
xor eax, eax
jmp 0x14000ba68
mov r14, rbx
xor eax, eax
or r9, 0xffffffffffffffff
mov rcx, r9
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r13, [rbx + rcx*2 - 4]
mov rax, r13
mov qword [rsp + 0x128], rax
nop dword [rax + rax]
test edx, edx
je 0x14000ba58
cmp word [rbx], 0x22
jne 0x14000b82a
mov edx, 0x22
lea rcx, [rbx + 2]
call fcn.14000efb0
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
jne 0x14000b7f3
lea rdx, [0x14000b7ec]
mov rcx, qword [rsp + 0x30]
call fcn.14000f8c0
nop
nop
xor eax, eax
jmp 0x14000ba68
xor r12d, r12d
mov word [rax], r12w
mov word [r15], r12w
add r15, 2
mov qword [rsp + 0x110], r15
add rbx, 2
mov qword [rsp + 0x20], rbx
mov edx, r12d
mov dword [rsp + 0x120], edx
mov dword [rsp + 0x48], edx
or r9, 0xffffffffffffffff
jmp 0x14000b8af
cmp r13, rax
je 0x14000b834
mov word [r13], r8w
lea rbx, [r13 - 2]
mov qword [rsp + 0x20], rbx
nop dword [rax]
cmp rbx, r14
jbe 0x14000b856
cmp word [rbx], 0x20
je 0x14000b856
sub rbx, 2
mov qword [rsp + 0x20], rbx
jmp 0x14000b840
cmp rbx, r14
jbe 0x14000b86c
cmp word [rbx], 0x20
jne 0x14000b86c
sub rbx, 2
mov qword [rsp + 0x20], rbx
jmp 0x14000b856
cmp rbx, r14
ja 0x14000b88b
lea rdx, [0x14000b884]
mov rcx, qword [rsp + 0x30]
call fcn.14000f8c0
nop
nop
xor eax, eax
jmp 0x14000ba68
add rbx, 2
mov qword [rsp + 0x20], rbx
xor r12d, r12d
mov word [rbx], r12w
mov r13, rbx
mov qword [rsp + 0xc0], rbx
add rbx, 2
mov qword [rsp + 0x20], rbx
mov rdi, rbx
sub rdi, r15
sar rdi, 1
cmp rdi, 2
jb 0x14000b95f
mov eax, 2
mul rdi
cmovo rax, r9
mov rcx, rax
call fcn.14000f89c
mov rsi, rax
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x14000b8fd
lea rdx, [0x14000b8f6]
mov rcx, qword [rsp + 0x30]
call fcn.14000f8c0
nop
nop
xor eax, eax
jmp 0x14000ba68
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
test rdi, rdi
je 0x14000b923
mov word [rax], r12w
add rax, 2
mov qword [rsp + 0x38], rax
dec rdi
mov qword [rsp + 0x40], rdi
jmp 0x14000b907
mov edx, 0x5c
mov rcx, r15
call fcn.14000efd0
test rax, rax
jne 0x14000b947
mov rcx, rsi
call fcn.14000f894
mov rsi, r12
mov qword [rsp + 0x28], r12
jmp 0x14000b967
sub rax, r15
sar rax, 1
lea r8, [rax + rax + 2]
mov rdx, r15
mov rcx, rsi
call fcn.14000f080
jmp 0x14000b967
mov rsi, r12
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x50], 0x70
mov edi, dword [rsp + 0x118]
mov eax, edi
neg eax
sbb ecx, ecx
and ecx, 0x40
or ecx, 0x1500
mov dword [rsp + 0x54], ecx
mov qword [rsp + 0xb0], r12
mov qword [rsp + 0x88], r12
mov qword [rsp + 0xa0], r12
mov dword [rsp + 0xa8], r12d
mov qword [rsp + 0xb8], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x80], 1
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov r12d, eax
mov dword [rsp + 0x4c], eax
test rsi, rsi
je 0x14000ba0e
mov rcx, rsi
call fcn.14000f894
xor eax, eax
mov rsi, rax
mov qword [rsp + 0x28], rax
test r12d, r12d
je 0x14000ba3a
test edi, edi
je 0x14000ba58
mov edx, 0xea60
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000ba58
mov edx, dword [rsp + 0x120]
mov r8d, 0x20
mov rax, qword [rsp + 0x128]
or r9, 0xffffffffffffffff
jmp 0x14000b7b0
test rsi, rsi
je 0x14000ba65
mov rcx, rsi
call fcn.14000f894
mov eax, r12d
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret