Function at 0x4809f7
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x128
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov rax, qword [rsp + 0x1c8]
mov rdx, qword [rsp + 0x1b8]
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0xa0], 0x68
test rdx, rdx
je 0x480a66
mov rdx, qword [rsp + 0x1c0]
mov rcx, qword [rsp + 0x1d8]
mov qword [rsp + 0xf0], rdx
test rax, rax
je 0x480a83
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0xf8], rax
test rcx, rcx
je 0x480a98
mov rcx, qword [rsp + 0x1e0]
movabs r12, 0x8000000000000000
mov qword [rsp + 0x100], rcx
mov dword [rsp + 0xdc], 0x100
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
mov rax, qword [rsp + 0x190]
add rax, r9
lea rdx, [rsp + 0x108]
mov qword [rdx], r9
mov qword [rdx + 8], rax
mov word [rdx + 0x10], 0
mov dword [rdx + 0x18], 1
lea rcx, [rsp + 0x58]
call sym._ZN111__LT_alloc..vec..Vec_LT_T_GT__u20_as_u20_alloc..vec..spec_from_iter_nested..SpecFromIterNested_LT_T_C_I_GT__GT_9from_ite
test rbx, rbx
je 0x480b3a
add rsi, rbx
lea rdx, [rsp + 0x108]
mov qword [rdx], rbx
mov qword [rdx + 8], rsi
mov word [rdx + 0x10], 0
mov dword [rdx + 0x18], 1
lea rcx, [rsp + 0x88]
call sym._ZN111__LT_alloc..vec..Vec_LT_T_GT__u20_as_u20_alloc..vec..spec_from_iter_nested..SpecFromIterNested_LT_T_C_I_GT__GT_9from_ite
mov r15, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
jmp 0x480b3d
mov r15, r12
mov rax, qword [rsp + 0x1a8]
xor ebp, ebp
cmp qword [rsp + 0x198], r12
cmovne rbp, qword [rsp + 0x1a0]
test rax, rax
je 0x480bb9
mov rcx, qword [rsp + 0x1b0]
add rcx, rax
lea rdx, [rsp + 0x108]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov word [rdx + 0x10], 0
mov dword [rdx + 0x18], 1
lea rcx, [rsp + 0x88]
call sym._ZN111__LT_alloc..vec..Vec_LT_T_GT__u20_as_u20_alloc..vec..spec_from_iter_nested..SpecFromIterNested_LT_T_C_I_GT__GT_9from_ite
mov r13, qword [rsp + 0x88]
xor ecx, ecx
cmp r15, r12
cmovne rcx, rsi
mov r14, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x60]
mov rax, r14
cmp r13, r12
je 0x480bc7
jmp 0x480bcc
xor ecx, ecx
cmp r15, r12
cmovne rcx, rsi
mov rbx, qword [rsp + 0x60]
xor eax, eax
mov r13, r12
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x48], rdx
lea rdx, [rsp + 0xa0]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 1
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateProcessW
test eax, eax
je 0x480c36
mov rcx, qword [rsp + 0x78]
call sub.KERNEL32.dll_CloseHandle
mov rax, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x80]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rcx
mov qword [rdi], 0
jmp 0x480c4e
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rdi + 8], rax
mov qword [rdi], 1
shl r13, 1
test r13, r13
je 0x480c67
mov rcx, qword [0x004a0128]
xor edx, edx
mov r8, r14
call fcn.0048256c
shl r15, 1
test r15, r15
je 0x480c80
mov rcx, qword [0x004a0128]
xor edx, edx
mov r8, rsi
call fcn.0048256c
cmp qword [rsp + 0x58], 0
je 0x480c99
mov rcx, qword [0x004a0128]
xor edx, edx
mov r8, rbx
call fcn.0048256c
nop
add rsp, 0x128
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret