Function at 0x14004b8f0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0xe0
xor eax, eax
mov rsi, rcx
xor ebx, ebx
lea rcx, [rsp + 0x70]
lea r8d, [rbx + 0x68]
xor edx, edx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.14007cd30
or rcx, 0xffffffffffffffff
xor eax, eax
lea r14, str.Ati2evxx.exe__CFPnP
xor r12d, r12d
mov dword [rsp + 0x70], 0x68
mov rdi, r14
repne scasb al, byte [rdi]
mov eax, dword [rsi + 4]
not rcx
add ecx, 9
test al, 0x10
je 0x14004b96b
movzx eax, byte [rsi + 0x11]
lea r12d, [rbx + 0x10]
movzx ebx, byte [rsi + 0x10]
add ebx, eax
jmp 0x14004b984
test al, 2
je 0x14004b977
mov r12d, 2
jmp 0x14004b981
test al, 1
je 0x14004b984
mov r12d, 1
mov ebx, dword [rsi + 0x10]
test ebx, ebx
je 0x14004b98e
lea eax, [rbx + rbx*2]
lea ecx, [rcx + rax*4]
mov edi, ecx
call fcn.14007de00
test rax, rax
mov rbp, rax
jne 0x14004b9ae
lea rcx, str.CeateRestartProcess:_failed_to_create_memory_n
call fcn.14000cbb0
jmp 0x14004bb51
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.14007cd30
mov rcx, rbp
mov r11, r14
sub rcx, r14
nop
nop
nop
movzx eax, byte [r11]
add r11, 1
test al, al
mov byte [rcx + r11 - 1], al
jne 0x14004b9d0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r14
repne scasb al, byte [rdi]
lea rdx, [0x1400be314]
mov r8d, r12d
not rcx
sub rcx, 1
mov ecx, ecx
add rcx, rbp
call fcn.14007dc1c
mov r8d, dword [rsi + 0x10]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
lea rdx, [0x1400be314]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov ecx, ecx
add rcx, rbp
call fcn.14007dc1c
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
repne scasb al, byte [rdi]
test ebx, ebx
not rcx
lea rdi, [rcx - 1]
je 0x14004bace
add rsi, 0x18
nop
movzx eax, byte [rsi]
movzx ecx, byte [rsi + 4]
xor edx, edx
shl ecx, 8
mov dword [rsp + 0x104], edx
and edx, 0xff000000
or ecx, eax
movzx eax, byte [rsi - 4]
shl ecx, 8
or ecx, eax
or ecx, edx
cmp dword [rsi + 0x10], 0
je 0x14004ba80
bts ecx, 0x18
mov r8d, dword [rsi + 0xc]
mov eax, dword [rsi + 8]
and ecx, 0xc1ffffff
and r8d, 1
and eax, 0xf
lea rdx, [0x1400be314]
shl r8d, 4
or r8d, eax
shl r8d, 0x19
or r8d, ecx
mov ecx, edi
add rcx, rbp
call fcn.14007dc1c
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
add rsi, 0x18
repne scasb al, byte [rdi]
sub rbx, 1
not rcx
lea edi, [rcx - 1]
jne 0x14004ba50
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rdx, rbp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
xor ecx, ecx
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14004bb3d
lea rcx, str.CreateRestartProcess:_create_restart_process_n
call fcn.14000cbb0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14004bb49
lea rcx, str.CeateRestartProcess:_failed_to_create_process_n
call fcn.14000cbb0
mov rcx, rbp
call fcn.14007ddf8
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret