Function at 0x1101484c0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov r14, rcx
xor r13d, r13d
mov qword [rsp + 0x68], r13
mov r12d, r13d
mov qword [rsp + 0x58], r13
mov word [rax + 8], r13w
mov byte [rax + 0xa], r13b
mov dword [rax + 0x18], r13d
test rcx, rcx
jne 0x110148520
call sym.msvcrt.dll__errno
mov dword [rax], 0x16
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sym.msvcrt.dll__invalid_parameter
xor eax, eax
jmp 0x110148b5e
test rdx, rdx
je 0x1101484fa
mov cl, 0x20
mov esi, 1
mov al, byte [rdx]
cmp al, cl
jne 0x110148537
add rdx, rsi
jmp 0x11014852c
cmp al, 0x77
je 0x11014853f
cmp al, 0x72
jne 0x1101484fa
mov byte [rsp + 0x170], al
add rdx, rsi
mov al, byte [rdx]
cmp al, cl
je 0x110148546
test al, al
je 0x11014855b
cmp al, 0x74
je 0x11014855b
cmp al, 0x62
jne 0x1101484fa
mov byte [rsp + 0x171], al
cmp al, 0x74
jne 0x11014856e
mov r8d, 0x4000
jmp 0x11014857c
mov r8d, r13d
mov ecx, 0x8000
cmp al, 0x62
cmove r8d, ecx
bts r8d, 7
mov edx, 0x400
lea rcx, [rsp + 0x188]
call sym.msvcrt.dll__pipe
cmp eax, 0xffffffff
je 0x110148b5b
cmp byte [rsp + 0x170], 0x77
jne 0x1101485e0
mov ebx, r13d
lea rdi, [rsp + 0x18c]
lea r13, [rsp + 0x54]
mov qword [rsp + 0x80], r13
lea r15, [rsp + 0x18c]
mov qword [rsp + 0x90], r15
lea r15, [rsp + 0x54]
mov qword [rsp + 0x88], r15
xor r13d, r13d
jmp 0x110148614
mov ebx, esi
lea rdi, [rsp + 0x188]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x188]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
mov r15d, 9
mov ecx, r15d
call fcn.11013b20c
test eax, eax
jne 0x110148643
mov ecx, dword [rsp + 0x188]
call sym.msvcrt.dll__close
mov ecx, dword [rsp + 0x18c]
call sym.msvcrt.dll__close
jmp 0x110148519
mov ecx, r15d
call sym.msvcrt.dll__lock
nop
mov dword [rsp + 0x54], esi
mov dword [rsp + 0x50], esi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov r15d, ebx
mov qword [rsp + 0x70], r15
movsxd rdx, dword [rsp + r15*4 + 0x188]
mov rcx, rdx
sar rcx, 5
lea r8, [sym.msvcrt.dll___pioinfo]
and edx, 0x1f
imul r10, rdx, 0x38
mov rdx, qword [r8 + rcx*8]
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r13d
lea r9, [rsp + 0x68]
mov r8, rax
mov rdx, qword [rdx + r10]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_DuplicateHandle]
test eax, eax
je 0x110148b20
mov ecx, dword [rsp + r15*4 + 0x188]
call sym.msvcrt.dll__close
mov dword [rsp + r15*4 + 0x50], r13d
lea rdx, [rsp + 0x170]
mov ecx, dword [rdi]
call sym.msvcrt.dll__fdopen
mov r12, rax
mov qword [rsp + 0xb8], rax
test rax, rax
je 0x110148b20
xor ecx, ecx
call fcn.110148b78
mov qword [rsp + 0x78], rax
test rax, rax
je 0x110148b02
lea r8, str.COMSPEC
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.11012f560
mov edi, eax
cmp eax, 0x16
jne 0x110148729
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bc8c
test edi, edi
jne 0x110148737
mov r15, qword [rsp + 0x58]
test r15, r15
jne 0x11014873e
lea r15, str.cmd.exe
mov edi, 0x68
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0xc0]
call sym.msvcrt.dll_memset
mov dword [rsp + 0xc0], edi
mov dword [rsp + 0xfc], 0x100
mov rax, qword [rsp + 0x68]
mov rcx, qword [sym.msvcrt.dll___pioinfo]
test ebx, ebx
mov rdx, rax
je 0x11014877d
mov rdx, qword [rcx]
mov qword [rsp + 0x110], rdx
cmp ebx, esi
je 0x11014878d
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x118], rax
mov rax, qword [rcx + 0x70]
mov qword [rsp + 0x120], rax
or rax, 0xffffffffffffffff
mov rcx, rax
inc rcx
cmp byte [r15 + rcx], r13b
jne 0x1101487a8
inc rax
cmp byte [r14 + rax], r13b
jne 0x1101487b1
lea rbx, [rax + 5]
add rbx, rcx
mov rdx, rsi
mov rcx, rbx
call fcn.110119eec
mov rdi, rax
test rax, rax
je 0x110148afd
mov r8, r15
mov rdx, rbx
mov rcx, rax
call sym.msvcrt.dll_strcpy_s
test eax, eax
je 0x1101487fe
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bc8c
lea r8, [0x11017c5e0]
mov rdx, rbx
mov rcx, rdi
call sym.msvcrt.dll_strcat_s
test eax, eax
je 0x110148828
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bc8c
mov r8, r14
mov rdx, rbx
mov rcx, rdi
call sym.msvcrt.dll_strcat_s
test eax, eax
je 0x11014884e
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bc8c
xor eax, eax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
call sym.msvcrt.dll__errno
mov r13d, dword [rax]
xor edx, edx
mov rcx, r15
call sym.msvcrt.dll__access_s
xor r14d, r14d
test eax, eax
jne 0x1101488c7
lea rax, [rsp + 0x98]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessA]
mov esi, eax
jmp 0x110148aa6
mov qword [rsp + 0x60], r14
mov rdx, rsi
mov ecx, 0x104
call fcn.110119eec
mov rbx, rax
test rax, rax
jne 0x11014890a
xor ecx, ecx
call sym.msvcrt.dll_free
mov rcx, rdi
call sym.msvcrt.dll_free
mov rcx, qword [rsp + 0x58]
call sym.msvcrt.dll_free
call sym.msvcrt.dll__errno
mov dword [rax], r13d
xor r13d, r13d
jmp 0x110148afd
lea r8, [0x110179d3c]
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.11012f560
mov r14d, eax
cmp eax, 0x16
jne 0x11014893a
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bc8c
mov rcx, qword [rsp + 0x60]
test r14d, r14d
je 0x11014894e
call sym.msvcrt.dll_free
mov rcx, rbx
jmp 0x1101488e3
xor r14d, r14d
mov r8d, 0x103
mov rdx, rbx
call fcn.110130b88
mov qword [rsp + 0xb0], rax
test rax, rax
je 0x110148a8d
cmp byte [rbx], r14b
je 0x110148a8d
or rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], r14b
jne 0x11014897d
lea r14, [rbx - 1]
add r14, rax
cmp byte [r14], 0x5c
jne 0x1101489d6
mov edx, 0x5c
mov rcx, rbx
call sym.msvcrt.dll__mbsrchr
cmp r14, rax
je 0x1101489dc
lea r8, [0x110179d44]
mov edx, 0x104
mov rcx, rbx
call sym.msvcrt.dll_strcat_s
xor r14d, r14d
test eax, eax
je 0x1101489df
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bc8c
jmp 0x1101489df
cmp byte [r14], 0x2f
jmp 0x1101489a3
xor r14d, r14d
or rax, 0xffffffffffffffff
inc rax
cmp byte [r15 + rax], r14b
jne 0x1101489e3
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], r14b
jne 0x1101489f0
add rax, rcx
mov ecx, 0x104
cmp rax, rcx
jae 0x110148a8d
mov r8, r15
mov edx, ecx
mov rcx, rbx
call sym.msvcrt.dll_strcat_s
test eax, eax
je 0x110148a2f
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.11012bc8c
xor edx, edx
mov rcx, rbx
call sym.msvcrt.dll__access_s
test eax, eax
jne 0x110148a80
lea rax, [rsp + 0x98]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessA]
mov esi, eax
jmp 0x110148a94
mov rcx, qword [rsp + 0xb0]
jmp 0x110148951
mov esi, dword [rsp + 0x180]
mov rcx, qword [rsp + 0x60]
call sym.msvcrt.dll_free
mov rcx, rbx
call sym.msvcrt.dll_free
mov rcx, rdi
call sym.msvcrt.dll_free
mov rcx, qword [rsp + 0x58]
call sym.msvcrt.dll_free
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test esi, esi
je 0x110148ad5
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
call sym.msvcrt.dll__errno
mov dword [rax], r13d
xor r13d, r13d
mov rcx, qword [rsp + 0x78]
test esi, esi
je 0x110148afa
mov rax, qword [rsp + 0x98]
mov qword [rcx + 8], rax
mov qword [rcx], r12
jmp 0x110148b51
mov qword [rcx], r13
mov r15, qword [rsp + 0x70]
mov rcx, r12
call sym.msvcrt.dll_fclose
mov rax, qword [rsp + 0x80]
mov dword [rax], r13d
mov r12, r13
mov qword [rsp + 0xb8], r13
cmp dword [rsp + r15*4 + 0x50], r13d
je 0x110148b34
mov ecx, dword [rsp + r15*4 + 0x188]
call sym.msvcrt.dll__close
mov rax, qword [rsp + 0x88]
cmp dword [rax], r13d
je 0x110148b51
mov rax, qword [rsp + 0x90]
mov ecx, dword [rax]
call sym.msvcrt.dll__close
nop
mov ecx, 9
call sym.msvcrt.dll__unlock
mov rax, r12
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret