Function at 0x140005aa0
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x140051268]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r12, r9
mov rdi, r8
mov rbx, rdx
mov qword [r11 - 0x128], rdx
mov qword [r11 - 0x120], r8
mov qword [rsp + 0x78], r9
mov r13, qword [rsp + 0x1e0]
mov qword [r11 - 0x118], r13
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x70], rax
mov r14, qword [rsp + 0x1f0]
mov qword [r11 - 0x110], r14
mov byte [rsp + 0x61], 0
mov byte [rsp + 0x60], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r11 - 0x60], xmm0
mov qword [r11 - 0x50], rax
xorps xmm1, xmm1
movups xmmword [rsp + 0xb8], xmm1
movups xmmword [rsp + 0xc8], xmm1
movups xmmword [rsp + 0xd8], xmm1
movups xmmword [rsp + 0xe8], xmm1
movups xmmword [rsp + 0xf8], xmm1
movups xmmword [rsp + 0x108], xmm1
mov qword [r11 - 0xa0], rax
mov dword [rsp + 0xb0], 0x70
xor esi, esi
mov r15d, esi
cmp qword [rdx + 0x10], rax
je 0x140005b8e
mov qword [rsp + 0x68], rdx
cmp qword [rdx + 0x18], 8
jb 0x140005b93
mov rsi, qword [rdx]
mov qword [rsp + 0x68], rsi
xor esi, esi
jmp 0x140005b93
mov qword [rsp + 0x68], rsi
cmp qword [r13 + 0x10], rax
cmovne rdx, r13
lea rcx, [rsp + 0x138]
call fcn.140003150
nop
mov r8, qword [rsp + 0x148]
lea rax, [r8 + 1]
cmp rax, 0x7fff
jbe 0x140005c58
mov rdx, qword [rsp + 0x150]
cmp rdx, 8
jb 0x140005c09
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060b5
call fcn.14000e830
mov qword [rsp + 0x148], rsi
mov qword [rsp + 0x150], 7
mov word [rsp + 0x138], si
mov rcx, rbx
call fcn.140002a00
nop
mov rcx, rdi
call fcn.140002a00
nop
mov rcx, r12
call fcn.1400032f0
nop
mov rcx, r13
call fcn.140002a00
nop
mov rcx, r14
call fcn.140003440
xor al, al
jmp 0x140006081
xorps xmm0, xmm0
lea rcx, [rsp + 0x138]
cmp qword [rsp + 0x150], 8
cmovae rcx, qword [rsp + 0x138]
lea rcx, [rcx + r8*2]
lea r8, [rsp + 0x138]
cmovae r8, qword [rsp + 0x138]
mov qword [rsp + 0x80], r8
movdqu xmmword [rsp + 0x120], xmm0
mov rax, rsi
mov qword [rsp + 0x130], rax
sub rcx, r8
mov qword [rsp + 0x88], rcx
mov rsi, rcx
sar rsi, 1
cmp rcx, 2
jb 0x140005d6d
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x1400060a4
add rsi, rsi
cmp rsi, 0x1000
jb 0x140005d14
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x1400060aa
call fcn.14000e7f0
mov rcx, rax
test rax, rax
je 0x1400060af
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rcx, qword [rsp + 0x88]
jmp 0x140005d2d
test rsi, rsi
je 0x140005d2b
mov rcx, rsi
call fcn.14000e7f0
mov rcx, qword [rsp + 0x88]
jmp 0x140005d2d
xor eax, eax
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], rax
add rsi, rax
mov qword [rsp + 0x130], rsi
mov r8, rcx
mov rdx, qword [rsp + 0x80]
mov rcx, rax
call fcn.140017630
mov qword [rsp + 0x128], rsi
mov rax, qword [rsp + 0x130]
jmp 0x140005d75
mov rsi, qword [rsp + 0x128]
xor ecx, ecx
mov word [rsp + 0x62], cx
cmp rsi, rax
je 0x140005d8f
mov word [rsi], cx
add qword [rsp + 0x128], 2
jmp 0x140005da6
lea r8, [rsp + 0x62]
mov rdx, rsi
lea rcx, [rsp + 0x120]
call fcn.140002ea0
xor ecx, ecx
cmp qword [rdi + 0x10], 0
je 0x140005dbc
mov rsi, rdi
cmp qword [rdi + 0x18], 8
jb 0x140005dbf
mov rsi, qword [rdi]
jmp 0x140005dbf
mov rsi, rcx
mov rax, qword [r14 + 8]
sub rax, qword [r14]
sar rax, 3
test rax, rax
je 0x140005e93
mov qword [rsp + 0x80], rcx
lea r9, [rsp + 0x80]
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_InitializeProcThreadAttributeList]
cmp qword [rsp + 0x80], 0
jbe 0x140005f81
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rsp + 0x80]
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov r15, rax
test rax, rax
je 0x140005f81
lea r9, [rsp + 0x80]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x140005f81
mov byte [rsp + 0x60], 1
mov r9, qword [r14]
mov rax, qword [r14 + 8]
sub rax, r9
sar rax, 3
lea rax, [rax*8]
xor ecx, ecx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor edx, edx
mov r8d, 0x20002
mov rcx, r15
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x140005f81
mov qword [rsp + 0x118], r15
xor eax, eax
mov qword [rsp + 0x88], rax
xor r8d, r8d
mov rdx, qword [r12]
lea rcx, [rsp + 0x88]
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x140005f51
mov rax, qword [r14 + 8]
sub rax, qword [r14]
sar rax, 3
xor edx, edx
mov ecx, edx
test rax, rax
setne cl
lea rax, [rsp + 0x158]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x80430
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdx
xor r9d, r9d
mov r8, qword [rsp + 0x120]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r12]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessAsUserW]
test eax, eax
je 0x140005f3e
mov byte [rsp + 0x61], 1
mov eax, dword [rsp + 0x168]
mov rcx, qword [rsp + 0x70]
mov dword [rcx], eax
jmp 0x140005f44
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, qword [rsp + 0x88]
call sub.USERENV.dll_DestroyEnvironmentBlock
cmp byte [rsp + 0x60], 0
je 0x140005f61
mov rcx, r15
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_DeleteProcThreadAttributeList]
cmp qword [rsp + 0x118], 0
je 0x140005f81
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov rcx, rax
mov r8, r15
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop
mov rcx, qword [rsp + 0x120]
test rcx, rcx
je 0x140005fe0
mov rax, qword [rsp + 0x130]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005fc5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060af
call fcn.14000e830
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x120], xmm0
xor eax, eax
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x150]
cmp rdx, 8
jb 0x140006029
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006023
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060b5
call fcn.14000e830
nop
jmp 0x140006050
mov rcx, rbx
call fcn.140002a00
nop
mov rcx, rdi
call fcn.140002a00
nop
mov rcx, r12
call fcn.1400032f0
nop
mov rcx, r13
call fcn.140002a00
nop
mov rcx, r14
call fcn.140003440
movzx eax, byte [rsp + 0x61]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14000ee50
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.140002a90
nop
call fcn.1400029e0
call fcn.14001bd00
nop
call fcn.14001bd00
int3