Function at 0x14000eea0
Capabilities:
Create process on windows

Disassembly:
push rsi
push rdi
push r12
mov eax, 0x1b10
call fcn.14007a110
sub rsp, rax
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x1b30], rbx
mov qword [rsp + 0x1b48], rbp
mov rax, qword [0x1400a5de0]
xor rax, rsp
mov qword [rsp + 0x1b00], rax
mov rbp, r8
mov rsi, rdx
mov word [rsp + 0xf0], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xf2]
call fcn.140057420
xor r12d, r12d
mov dword [rsp + 0x50], r12d
mov r8, rsi
mov edx, 0x104
lea rcx, [rsp + 0xf0]
call fcn.140052920
lea rbx, [rsp + 0xf0]
cmp word [rsi], 0x22
jne 0x14000ef5c
lea rbx, [rsp + 0xf2]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xf0]
repne scasw ax, word [rdi]
not rcx
cmp word [rsp + rcx*2 + 0xec], 0x22
jne 0x14000ef5c
mov word [rsp + rcx*2 + 0xec], ax
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x80]
call fcn.140057420
mov dword [rsp + 0x80], WSASetLastError
mov word [rsp + 0xb00], r12w
xor edx, edx
mov r8d, 0xffe
lea rcx, [rsp + 0xb02]
call fcn.140057420
mov qword [rsp + 0x20], rbp
mov r9, rbx
lea r8, str._s__s
mov edx, 0x800
lea rcx, [rsp + 0xb00]
call fcn.140052ea0
mov word [rsp + 0x300], r12w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x302]
call fcn.140057420
mov r9, rsi
lea r8, str.__s_
mov edx, 0x400
lea rcx, [rsp + 0x300]
call fcn.140052ea0
mov rbx, qword [0x1400ae080]
test rbx, rbx
jne 0x14000f0b8
mov ecx, 0x310
call fcn.1400278b8
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14000f0ae
call fcn.14002790c
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000f03e
mov ecx, 0x80004005
call fcn.140007e00
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov word [rbx + 0x64], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x14008a5b0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x14008a5b0]
mov rcx, rbx
call fcn.140008260
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rbx + 0x26c]
mov word [rcx], 0
lea r8, [0x14008a5b8]
mov edx, 0x50
call fcn.140052920
nop
jmp 0x14000f0b1
mov rbx, r12
mov qword [0x1400ae080], rbx
lea r8, [rsp + 0xb00]
lea rdx, str.CreateProcess__s
mov rcx, rbx
call fcn.14000d860
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x48], rdx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xb00]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000f1b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.14000d730
mov rcx, rax
lea r8, str.CreateProcess_failed
mov edx, edi
call fcn.14000daa0
call fcn.14000d730
mov rcx, rax
lea rdx, str.Attempt_spawn_before_giving_up...
call fcn.14000d860
call fcn.14000d730
mov rcx, rax
mov r9, rbp
lea r8, [rsp + 0x300]
lea rdx, str._tspawnl__s__s
call fcn.14000d860
mov qword [rsp + 0x20], r12
mov r9, rbp
lea r8, [rsp + 0x300]
mov rdx, rsi
xor ecx, ecx
call fcn.140054d90
mov dword [rsp + 0x50], eax
cmp eax, 0xffffffff
jne 0x14000f1ff
call fcn.140054ec0
mov rdi, rax
call fcn.14000d730
mov rcx, rax
lea r8, str.tspawn_failed
mov edx, dword [rdi]
call fcn.14000daa0
mov eax, dword [rsp + 0x50]
jmp 0x14000f1ff
call fcn.14000d730
mov rcx, rax
lea rdx, str.Waiting_for_CreateProcess_to_complete
call fcn.14000d860
or edx, 0xffffffff
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x1b00]
xor rcx, rsp
call fcn.1400524a0
lea r11, [rsp + 0x1b10]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret