Function at 0x1400faba4
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov rbx, r9
mov edi, r8d
mov rsi, rdx
mov r13, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
movsxd r10, dword [rbx]
lea r8, [0x1401af8e0]
mov rcx, r10
mov dword [rsp + 0x30], 2
sar rcx, 6
lea r9, [rbp + 0x7f]
and r10d, 0x3f
mov dword [rsp + 0x28], 1
or r15, 0xffffffffffffffff
xor r14d, r14d
mov qword [rbp + 0x7f], r15
mov rcx, qword [r8 + rcx*8]
mov r8, rax
lea rdx, [r10 + r10*8]
mov dword [rsp + 0x20], r14d
mov rdx, qword [rcx + rdx*8 + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x1400fac3b
mov rcx, qword [rbp + 0x7f]
cmp rcx, r15
jmp 0x1400fae4e
mov ecx, dword [rbx]
call fcn.1400026a3
mov ecx, dword [rbx + 4]
mov rdx, rsi
mov dword [rbx], r15d
call fcn.140001b8b
mov rsi, rax
test rax, rax
je 0x1400fac2f
xor ecx, ecx
call fcn.1400fbbf8
mov rbx, rax
test rax, rax
jne 0x1400fac71
mov rcx, rsi
call fcn.140003008
jmp 0x1400fac2f
lea r8, [0x140170a00]
mov qword [rbp - 0x59], r14
xor edx, edx
lea rcx, [rbp - 0x59]
call fcn.140004e26
test eax, eax
je 0x1400fac99
cmp eax, 0x16
je 0x1400faebb
mov r15, r14
jmp 0x1400faca5
mov r15, qword [rbp - 0x59]
mov r12, r15
test r15, r15
jne 0x1400facac
lea r12, str.cmd.exe
mov r14d, 0x68
lea rcx, [rbp - 0x39]
mov r8d, r14d
xor edx, edx
call fcn.140004e1c
mov rcx, qword [0x1401af8e0]
xor edx, edx
mov dword [rbp - 0x39], r14d
mov dword [rbp + 3], 0x100
test edi, edi
jne 0x1400face2
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x17], rax
jmp 0x1400facf3
mov rax, qword [rcx + 0x28]
mov qword [rbp + 0x17], rax
mov rax, qword [rbp + 0x7f]
cmp edi, 1
je 0x1400facf7
mov rax, qword [rcx + 0x70]
mov qword [rbp + 0x1f], rax
or r8, 0xffffffffffffffff
mov rax, qword [rcx + 0xb8]
mov qword [rbp + 0x27], rax
mov rax, r8
inc rax
cmp word [r12 + rax*2], dx
jne 0x1400fad0d
mov rcx, r8
inc rcx
cmp word [r13 + rcx*2], dx
jne 0x1400fad1a
add rax, rcx
lea r9, str.__c
mov rcx, r8
inc rcx
cmp word [r9 + rcx*2], dx
jne 0x1400fad32
lea r14, [rcx + 1]
mov edx, 2
add r14, rax
mov rcx, r14
call fcn.140005ac4
mov rdi, rax
test rax, rax
jne 0x1400fad73
xor ecx, ecx
call fcn.140001271
mov rcx, r15
call fcn.140001271
and qword [rbx + 8], rdi
and qword [rbx], rdi
jmp 0x1400fae3e
mov r8, r12
mov rdx, r14
mov rcx, rdi
call fcn.140003643
test eax, eax
jne 0x1400faed0
lea r8, str.__c
mov rdx, r14
mov rcx, rdi
call fcn.140003242
test eax, eax
jne 0x1400faed0
mov r8, r13
mov rdx, r14
mov rcx, rdi
call fcn.140003242
xor r13d, r13d
test eax, eax
jne 0x1400faed3
mov rcx, r12
call fcn.1400fb4b4
test rax, rax
je 0x1400fae27
cmp rax, r12
xorps xmm0, xmm0
mov r14d, r13d
mov rdx, rdi
cmovne r14, rax
xor ecx, ecx
mov qword [rbp - 0x41], rcx
xor r9d, r9d
lea rcx, [rbp - 0x51]
xor r8d, r8d
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x39]
mov qword [rsp + 0x40], rcx
mov rcx, rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 1
movups xmmword [rbp - 0x51], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400fae79
mov rcx, r14
call fcn.140001271
mov rcx, rdi
call fcn.140001271
mov rcx, r15
call fcn.140001271
mov qword [rbx], r13
mov qword [rbx + 8], r13
mov rcx, rsi
call fcn.140003008
mov rcx, qword [rbp + 0x7f]
cmp rcx, 0xffffffffffffffff
je 0x1400fae56
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp - 0x51]
mov rcx, r14
mov qword [rbx + 8], rax
mov qword [rbx], rsi
call fcn.140001271
mov rcx, rdi
call fcn.140001271
mov rcx, r15
call fcn.140001271
mov rcx, qword [rbp + 0x7f]
cmp rcx, 0xffffffffffffffff
je 0x1400faeb6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
jmp 0x1400fae58
xor r9d, r9d
mov qword [rsp + 0x20], r14
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14000510a
int3
xor r13d, r13d
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14000510a
int3