Function at 0x110118e80
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
xor ebx, ebx
mov r12d, ecx
mov r15d, ebx
mov r13b, bl
lea eax, [rbx + 4]
lea esi, [rbx + 3]
cmp ecx, 1
jbe 0x110118ec8
jle 0x110118ece
cmp ecx, esi
jle 0x110118ec8
cmp ecx, eax
jne 0x110118ece
mov r13b, 1
mov qword [rbp - 0x51], r8
jmp 0x110118f18
call sym.msvcrt.dll___doserrno
mov dword [rax], ebx
call sym.msvcrt.dll__errno
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
call sym.msvcrt.dll__invalid_parameter
jmp 0x1101191c6
add r8, 2
cmp word [r8], bx
jne 0x110118ef9
lea rax, [r8 + 2]
cmp word [rax], bx
je 0x110118f18
mov ecx, 0x20
mov word [r8], cx
mov r8, rax
movzx eax, word [r8]
test ax, ax
jne 0x110118ef9
xor edx, edx
lea rcx, [rbp - 0x45]
lea r8d, [rdx + 0x64]
call sym.msvcrt.dll_memset
mov edi, dword [0x110195924]
lea rdx, [sym.msvcrt.dll___pioinfo]
mov dword [rbp - 0x49], 0x68
test edi, edi
je 0x110118f6d
movsxd rcx, edi
dec rcx
mov rax, rcx
and ecx, 0x1f
sar rax, 5
imul rcx, rcx, 0x38
mov rax, qword [rdx + rax*8]
cmp byte [rax + rcx + 8], bl
jne 0x110118f6b
sub edi, 1
jne 0x110118f48
test edi, edi
js 0x1101191bb
movsxd r14, edi
cmp r14, 0x1c71
jae 0x1101191bb
movzx eax, di
lea ecx, [rdi + 4]
shl ax, 3
mov edx, 1
add cx, ax
movzx ecx, cx
mov word [rbp - 7], cx
call fcn.110119eec
mov qword [rbp - 1], rax
test rax, rax
je 0x1101191bb
mov dword [rax], edi
or rbx, 0xffffffffffffffff
mov rax, qword [rbp - 1]
lea r9, [rax + 4]
add r9, r14
lea rdx, [rax + 4]
test edi, edi
jle 0x110119015
xor r8d, r8d
mov r10d, edi
lea r11, [sym.msvcrt.dll___pioinfo]
mov rax, r8
mov rcx, r8
and eax, 0x1f
sar rcx, 5
imul rax, rax, 0x38
add rax, qword [r11 + rcx*8]
mov cl, byte [rax + 8]
test cl, 0x10
jne 0x110118ff8
mov byte [rdx], cl
mov rax, qword [rax]
jmp 0x110118ffe
mov byte [rdx], r15b
mov rax, rbx
mov qword [r9], rax
inc r8
add r9, 8
inc rdx
sub r10, 1
jne 0x110118fd4
mov rax, qword [rbp - 1]
test r13b, r13b
je 0x1101190d1
lea r15, [rax + 4]
add r15, r14
lea r13, [rax + 4]
cmp edi, esi
cmovl esi, edi
xor r14d, r14d
test esi, esi
jle 0x1101190cb
cmp esi, 2
jb 0x1101190ac
lea eax, [rsi - 1]
movsxd rcx, eax
lea rax, [r15 + rcx*8]
lea rdx, [rcx + r13]
cmp r13, rax
ja 0x110119056
cmp rdx, r15
jae 0x1101190ac
mov eax, esi
and eax, 0x80000001
jge 0x110119066
dec eax
or eax, 0xfffffffe
inc eax
mov ecx, esi
sub ecx, eax
add r14d, 2
cmp r14d, ecx
jl 0x11011906a
lea eax, [rcx + 1]
cdq
sub eax, edx
xor edx, edx
sar eax, 1
movsxd rcx, eax
lea rdi, [rcx + rcx]
mov rcx, r13
mov r8, rdi
call sym.msvcrt.dll_memset
mov rdx, rdi
add r13, rdi
shl rdx, 3
mov rdi, r15
mov rcx, rdx
mov rax, rbx
shr rcx, 3
rep stosq qword [rdi], rax
add r15, rdx
cmp r14d, esi
jge 0x1101190cb
sub esi, r14d
mov eax, esi
mov byte [r13], 0
inc r13
mov qword [r15], rbx
lea r15, [r15 + 8]
sub rax, 1
jne 0x1101190b6
mov r15d, 8
call sym.msvcrt.dll___doserrno
mov rdx, qword [rbp - 0x51]
bts r15d, 0xa
mov rcx, qword [rbp + 0x6f]
xor r9d, r9d
xor r8d, r8d
and dword [rax], 0
lea rax, [rbp - 0x69]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
mov rax, qword [rbp + 0x7f]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 1
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
mov edi, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, qword [rbp - 1]
mov esi, eax
call sym.msvcrt.dll_free
test edi, edi
jne 0x110119146
mov ecx, esi
call fcn.110107d48
mov rax, rbx
jmp 0x1101191ca
cmp r12d, 2
je 0x1101191e5
test r12d, r12d
jne 0x110119193
mov rcx, qword [rbp - 0x69]
or edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x69]
lea rdx, [rbp + 0x67]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
test eax, eax
je 0x11011917a
movsxd rbx, dword [rbp + 0x67]
jmp 0x110119187
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.110107d48
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x1101191af
mov eax, 4
cmp r12d, eax
jne 0x1101191ab
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor ebx, ebx
jmp 0x1101191af
mov rbx, qword [rbp - 0x69]
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x11011913e
call sym.msvcrt.dll__errno
mov dword [rax], 0xc
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x130]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor ecx, ecx
call sym.msvcrt.dll__exit
int3