Function at 0x1400092d0
Capabilities:
Check for protected handle exception
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6d0]
sub rsp, 0x7d0
mov rax, qword [0x140067008]
xor rax, rsp
mov qword [rbp + 0x6c0], rax
mov rdi, qword [rbp + 0x730]
xorps xmm1, xmm1
mov rsi, qword [rbp + 0x738]
xor eax, eax
mov r14, qword [rbp + 0x740]
xorps xmm0, xmm0
mov r13, qword [rbp + 0x748]
mov r12, rdx
movups xmmword [rbp - 0x60], xmm1
mov dword [rbp - 0x60], 0x68
mov r15, rcx
movups xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x24], 0x101
movups xmmword [rbp - 0x20], xmm1
mov word [rbp - 0x20], ax
mov qword [rsp + 0x58], r8
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rax
movups xmmword [rbp - 0x50], xmm1
mov qword [rbp], rax
movups xmmword [rbp - 0x40], xmm1
movups xmmword [rbp - 0x10], xmm1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [rdi]
mov rbx, rax
call fcn.1400324c0
mov dword [rsp + 0x30], 2
lea r9, [rbp - 0x10]
mov rdx, rax
mov dword [rsp + 0x28], 1
mov r8, rbx
mov dword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [rsi + 4]
call fcn.1400324c0
mov dword [rsp + 0x30], 2
lea r9, [rbp - 8]
mov rdx, rax
mov dword [rsp + 0x28], 1
mov r8, rbx
mov dword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [r14 + 4]
call fcn.1400324c0
mov dword [rsp + 0x30], 2
lea r9, [rbp]
mov rdx, rax
mov dword [rsp + 0x28], 1
mov r8, rbx
mov dword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [rdi + 4]
call fcn.1400324c0
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov ecx, dword [rsi]
call fcn.1400324c0
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov ecx, dword [r14]
call fcn.1400324c0
xor r8d, r8d
mov rcx, rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [r15 + 0x490]
mov rbx, qword [rax + 0x28]
test rbx, rbx
jne 0x140009635
mov qword [rsp + 0x30], r12
lea rax, str._s__s
mov qword [rsp + 0x28], r13
lea r8, [rbp + 0x180]
mov r9d, 0x104
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov word [rbp + 0x40], bx
mov rcx, r15
call fcn.140007970
cmp dword [rsp + 0x50], ebx
jne 0x14000974b
xorps xmm0, xmm0
lea rdx, [rbp + 0x10]
xor eax, eax
lea rcx, [rbp + 0x180]
movups xmmword [rsp + 0x60], xmm0
mov qword [rbp - 0x80], rax
movups xmmword [rsp + 0x70], xmm0
call fcn.1400366a8
test eax, eax
jne 0x1400094d0
movsxd rax, dword [rbp + 0x24]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x60]
mov rcx, r15
lea rdx, [rbp + 0x180]
call fcn.140007720
test eax, eax
jne 0x140009541
lea r8, [rbp + 0x4b0]
lea rdx, [rbp + 0x180]
call fcn.140008d70
lea rax, [rbp + 0x150]
mov dword [rsp + 0x28], shutdown
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, [0x14005adbc]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x4b0]
call fcn.14003158c
mov rsi, rax
jmp 0x140009546
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
test rdi, rdi
jne 0x14000955a
test rsi, rsi
je 0x1400095d4
test rdi, rdi
je 0x1400095aa
mov r14, qword [rsp + 0x60]
mov edx, 0xa
add r14, rdi
mov rcx, rdi
mov r8, r14
sub r8, rdi
call fcn.14004f550
mov rbx, rax
test rax, rax
je 0x140009582
inc rbx
jmp 0x140009585
mov rbx, r14
sub rbx, rdi
lea rcx, [rbp + 0x40]
mov eax, 0x103
mov rdx, rdi
cmp rbx, rax
cmova rbx, rax
mov r8, rbx
call fcn.14002d2a0
mov byte [rbp + rbx + 0x40], 0
jmp 0x1400095c0
test rsi, rsi
je 0x1400095cd
mov r8, rsi
lea rcx, [rbp + 0x40]
mov edx, 0x104
call fcn.140035fc4
test rsi, rsi
je 0x1400095cd
mov rcx, rsi
call fcn.1400313a0
mov byte [rbp + 0x143], 0
cmp byte [rbp + 0x40], 0x23
jne 0x14000962d
cmp byte [rbp + 0x41], 0x21
jne 0x14000962d
lea rcx, [rbp + 0x42]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400095f0
lea rbx, [rbp + 0x41]
add rbx, rax
lea rax, [rbp + 0x42]
cmp rbx, rax
jbe 0x140009631
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.140031c60
test eax, eax
je 0x140009631
mov byte [rbx], 0
lea rax, [rbp + 0x42]
dec rbx
cmp rbx, rax
ja 0x140009610
jmp 0x140009631
mov byte [rbp + 0x42], 0
lea rbx, [rbp + 0x42]
cmp byte [rbx], 0
je 0x140009659
xor r9d, r9d
lea r8, [rbp + 0x3a0]
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea rbx, [rbp + 0x3a0]
xor r9d, r9d
lea r8, [rbp + 0x290]
mov edx, 0x104
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
cmp byte [rbx], 0
lea rax, [rbp + 0x290]
mov r9d, 0x104
lea r8, [rbp + 0x180]
lea rdx, [rsp + 0x50]
mov rcx, r15
je 0x1400096b4
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rax
lea rax, str.__s____s_s_
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.140007970
jmp 0x1400096cf
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rax
lea rax, str.__s_s_
mov qword [rsp + 0x20], rax
call fcn.140007970
cmp dword [rsp + 0x50], 0
jne 0x14000974b
lea rax, [rbp - 0x78]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x180]
lea rax, [rbp - 0x60]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140009753
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [rbp + 0x180]
mov rcx, r15
lea r8, str.spawn_process
mov dword [rsp + 0x20], eax
lea rdx, str._s:_CreateProcess__s_:__ld
call fcn.1400079a0
mov qword [rbp - 0x78], 0xffffffffffffffff
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140009780
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp - 0x78]
mov rcx, qword [rbp + 0x6c0]
xor rcx, rsp
call fcn.14002b5c0
mov rbx, qword [rsp + 0x828]
add rsp, 0x7d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret