Function at 0x41e5f0
Capabilities:
Create pipe
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rcx
mov r11, rsp
sub rsp, 0x138
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 - 8], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r12
mov qword [r11 - 0x20], r13
mov qword [r11 - 0x28], r14
mov rsi, rdx
mov rbp, rcx
lea rax, [0x0043aac0]
mov qword [rcx], rax
lea rdi, [rcx + 0x10]
mov qword [r11 + 0x10], rdi
xor r13d, r13d
mov qword [rdi + 8], r13
mov dword [rdi + 0x10], r13d
lea r14, [0x004395c8]
mov qword [rdi], r14
mov dword [rdi + 0x18], r13d
xor edx, edx
mov rcx, rdi
call qword [0x004395d0]
nop
lea rax, [0x00439608]
mov qword [rdi], rax
movsxd rbx, dword [rdi + 0x10]
mov edx, ebx
mov rcx, rdi
call qword [0x00439610]
cmp ebx, ebx
jge 0x41e698
mov rcx, rbx
add rcx, qword [rdi + 8]
mov eax, ebx
sub eax, ebx
movsxd r8, eax
mov rdx, rcx
call fcn.004230d0
nop
lea rax, [0x00439658]
mov qword [rdi], rax
xor edx, edx
mov rcx, rdi
call qword [rax + 8]
mov qword [rsp + 0x58], rsi
lea rax, [0x00439740]
mov qword [rsp + 0x50], rax
mov ebx, r13d
mov dword [rsp + 0x60], r13d
test rsi, rsi
je 0x41e6df
cmp byte [rsi], bl
je 0x41e6df
nop
inc ebx
movsxd rax, ebx
cmp byte [rax + rsi], 0
jne 0x41e6d0
mov dword [rsp + 0x60], ebx
movsxd r12, dword [rdi + 0x10]
mov eax, dword [rdi + 0x10]
lea edx, [rbx + rax]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
cmp r12d, r12d
jge 0x41e712
mov rdx, qword [rdi + 8]
add rdx, r12
movsxd rcx, ebx
add rcx, rdx
mov eax, r12d
sub eax, r12d
movsxd r8, eax
call fcn.004230d0
movsxd r8, ebx
mov rcx, r12
add rcx, qword [rdi + 8]
mov rdx, rsi
call fcn.004230d0
nop
mov qword [rbp + 0x30], r13
mov qword [rbp + 8], 0xffffffffffffffff
mov r8d, 1
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.0040f820
mov rbx, rax
mov r8d, r13d
lea rdi, [0x0043ab44]
inc r8d
movsxd rcx, r8d
cmp byte [rcx + rdi], 0
jne 0x41e751
mov r11d, dword [rax + 0x10]
mov ecx, r8d
cmp r11d, r8d
cmovl ecx, r11d
mov r9d, r13d
mov rdx, r13
movsxd r10, ecx
test ecx, ecx
jle 0x41e799
mov rcx, qword [rax + 8]
nop
movzx eax, byte [rdx + rdi]
cmp byte [rcx + rdx], al
jne 0x41e794
inc r9d
inc rdx
cmp rdx, r10
jl 0x41e780
test r9d, r9d
js 0x41e7ac
cmp r9d, r11d
jge 0x41e7ac
movsxd rcx, r9d
mov rax, qword [rbx + 8]
movzx r10d, byte [rcx + rax]
jmp 0x41e7af
xor r10b, r10b
test r9d, r9d
js 0x41e7c2
cmp r9d, r8d
jge 0x41e7c2
movsxd rax, r9d
movzx edx, byte [rax + rdi]
jmp 0x41e7c4
xor dl, dl
movsx ecx, r10b
movsx eax, dl
sub ecx, eax
sete bl
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x78], r13
mov dword [rsp + 0x80], r13d
mov dword [rsp + 0x88], r13d
test rcx, rcx
je 0x41e7f9
call fcn.004230a0
test bl, bl
je 0x41e94c
mov dword [rsp + 0x50], 0x18
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x60], 1
xor r9d, r9d
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x148]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x41e9bf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
lea r9, [rsp + 0x68]
mov r8, rbx
mov rdx, qword [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0xa0]
call fcn.00424890
mov dword [rsp + 0xa0], 0x68
mov dword [rsp + 0xdc], 0x100
mov qword [rsp + 0xf8], r13
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0x100], r13
mov word [rsp + 0xe0], 0
lea rdx, [rsi + 1]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x41e9bf
mov rax, qword [rsp + 0x68]
mov qword [rbp + 8], rax
movsxd rcx, eax
mov edx, 0x4009
call fcn.00427d50
mov ecx, eax
lea rdx, [0x0043ab40]
call fcn.00427600
mov qword [rbp + 0x30], rax
jmp 0x41e9bf
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 7]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 8], rax
cmp rax, 0xffffffffffffffff
je 0x41e9bf
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
movsxd rcx, dword [rbp + 8]
mov edx, 0x4009
call fcn.00427d50
mov ecx, eax
lea rdx, [0x0043ab40]
call fcn.00427600
mov qword [rbp + 0x30], rax
xor edx, edx
mov rcx, rax
call fcn.004275e0
nop
mov rax, rbp
mov rbx, qword [rsp + 0x150]
mov rbp, qword [rsp + 0x158]
mov rsi, qword [rsp + 0x130]
mov rdi, qword [rsp + 0x128]
mov r12, qword [rsp + 0x120]
mov r13, qword [rsp + 0x118]
mov r14, qword [rsp + 0x110]
add rsp, 0x138
ret