Function at 0x439220
Capabilities:
Create process on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x120
mov rcx, qword [0x00826970]
xor r8d, r8d
lea rbx, [rsp + 0x50]
mov rdi, rdx
mov edx, 0x40
mov qword [rsp + 0x58], 0
lea rax, [rbx + 0x10]
mov word [rsp + 0x60], r8w
mov qword [rsp + 0x50], rax
call fcn.00440690
lea rsi, [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r8d, 0x10
lea r9, [0x008007da]
mov rcx, rsi
lea rdx, [0x00438ad0]
call fcn.00438cf0
lea rcx, [0x008007e0]
call sub.msvcrt.dll_wcslen
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
lea r9, [0x008007e0]
call fcn.0079dae0
lea r12, [rsp + 0x90]
lea rdx, [r12 + 0x10]
mov qword [rsp + 0x90], rdx
mov rcx, qword [rax]
lea rdx, [rax + 0x10]
cmp rcx, rdx
je 0x439550
mov qword [rsp + 0x90], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xa0], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x98], rcx
xor ecx, ecx
mov qword [rax], rdx
mov word [rax + 0x10], cx
lea rcx, [0x008007f4]
mov qword [rax + 8], 0
call sub.msvcrt.dll_wcslen
movabs rdx, 0x3fffffffffffffff
sub rdx, qword [rsp + 0x98]
mov r8, rax
cmp rax, rdx
ja 0x4395a8
lea rdx, [0x008007f4]
mov rcx, r12
call fcn.0079f760
lea rbp, [rsp + 0xb0]
lea rdx, [rbp + 0x10]
mov qword [rsp + 0xb0], rdx
mov rcx, qword [rax]
lea rdx, [rax + 0x10]
cmp rcx, rdx
je 0x439570
mov qword [rsp + 0xb0], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xc0], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0xb8], rcx
mov qword [rax], rdx
xor edx, edx
mov rcx, qword [rsp + 0x50]
mov word [rax + 0x10], dx
lea rdx, [rbp + 0x10]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0xb0]
cmp rax, rdx
je 0x439590
lea rdx, [rbx + 0x10]
cmp rcx, rdx
je 0x439530
test rcx, rcx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x50], rax
movdqu xmm0, xmmword [rsp + 0xb8]
movups xmmword [rsp + 0x58], xmm0
je 0x439402
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xc0], rdx
mov qword [rsp + 0xb8], 0
xor eax, eax
mov word [rcx], ax
lea rax, [rbp + 0x10]
cmp rcx, rax
je 0x439402
call fcn.007da050
mov rcx, qword [rsp + 0x90]
lea rax, [r12 + 0x10]
cmp rcx, rax
je 0x439419
call fcn.007da050
mov rcx, qword [rsp + 0x70]
add rsi, 0x10
cmp rcx, rsi
je 0x43942c
call fcn.007da050
mov rdx, qword [rsp + 0x50]
mov rcx, qword [0x00826970]
call fcn.0043e770
test al, al
je 0x439510
mov r8, qword [rdi + 8]
mov rcx, rbx
mov rdx, qword [rdi]
call fcn.0079f760
mov r8, qword [rsp + 0x50]
lea rdx, str.Cmd:__S_n
mov rcx, qword [0x00826910]
call fcn.0041e020
mov ecx, 0xd
xor eax, eax
mov rdi, rbp
mov rdx, qword [rsp + 0x50]
rep stosq qword [rdi], rax
xor r9d, r9d
mov dword [rsp + 0xb0], 0x68
xor r8d, r8d
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x210
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x50]
add rbx, 0x10
cmp rcx, rbx
je 0x4394f9
call fcn.007da050
nop
add rsp, 0x120
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8, qword [rsp + 0x50]
lea rdx, str.File_not_found:__S_n
mov rcx, qword [0x00826910]
call fcn.0041db00
jmp 0x4394e5
movdqu xmm0, xmmword [rsp + 0xb8]
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x58], xmm0
jmp 0x439402
mov r9, qword [rax + 0x10]
mov r10, qword [rax + 0x18]
mov qword [rsp + 0xa0], r9
mov qword [rsp + 0xa8], r10
jmp 0x4392e4
mov r9, qword [rax + 0x10]
mov r10, qword [rax + 0x18]
mov qword [rsp + 0xc0], r9
mov qword [rsp + 0xc8], r10
jmp 0x439372
mov rcx, rbx
mov rdx, rbp
call fcn.0079f7f0
mov rcx, qword [rsp + 0xb0]
jmp 0x4393e3
lea rcx, [0x008007fe]
call fcn.007cd940
mov rcx, qword [rsp + 0x90]
add r12, 0x10
mov rdi, rax
cmp rcx, r12
je 0x4395cd
call fcn.007da050
mov rcx, qword [rsp + 0x70]
add rsi, 0x10
cmp rcx, rsi
je 0x4395e0
call fcn.007da050
mov rcx, qword [rsp + 0x50]
add rbx, 0x10
cmp rcx, rbx
je 0x4395f3
call fcn.007da050
mov rcx, rdi
call fcn.0067d310
mov rdi, rax
jmp 0x4395cd