Function at 0x41c3d0
Capabilities:
Create pipe
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rcx
mov r11, rsp
sub rsp, 0x138
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 - 8], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r12
mov qword [r11 - 0x20], r13
mov qword [r11 - 0x28], r14
mov rsi, rdx
mov rbp, rcx
lea rax, [0x00437b00]
mov qword [rcx], rax
lea rdi, [rcx + 0x10]
mov qword [r11 + 0x10], rdi
xor r13d, r13d
mov qword [rdi + 8], r13
mov dword [rdi + 0x10], r13d
lea r14, [0x004366a8]
mov qword [rdi], r14
mov dword [rdi + 0x18], r13d
xor edx, edx
mov rcx, rdi
call qword [0x004366b0]
nop
lea rax, [0x004366e8]
mov qword [rdi], rax
movsxd rbx, dword [rdi + 0x10]
mov edx, ebx
mov rcx, rdi
call qword [0x004366f0]
cmp ebx, ebx
jge 0x41c478
mov rcx, rbx
add rcx, qword [rdi + 8]
mov eax, ebx
sub eax, ebx
movsxd r8, eax
mov rdx, rcx
call fcn.00421230
nop
lea rax, [0x00436768]
mov qword [rdi], rax
xor edx, edx
mov rcx, rdi
call qword [rax + 8]
mov qword [rsp + 0x58], rsi
lea rax, [0x004366a0]
mov qword [rsp + 0x50], rax
mov ebx, r13d
mov dword [rsp + 0x60], r13d
test rsi, rsi
je 0x41c4bf
cmp byte [rsi], bl
je 0x41c4bf
nop
inc ebx
movsxd rax, ebx
cmp byte [rax + rsi], 0
jne 0x41c4b0
mov dword [rsp + 0x60], ebx
movsxd r12, dword [rdi + 0x10]
mov eax, dword [rdi + 0x10]
lea edx, [rbx + rax]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
cmp r12d, r12d
jge 0x41c4f2
mov rdx, qword [rdi + 8]
add rdx, r12
movsxd rcx, ebx
add rcx, rdx
mov eax, r12d
sub eax, r12d
movsxd r8, eax
call fcn.00421230
movsxd r8, ebx
mov rcx, r12
add rcx, qword [rdi + 8]
mov rdx, rsi
call fcn.00421230
nop
mov qword [rbp + 0x30], r13
mov qword [rbp + 8], 0xffffffffffffffff
mov r8d, 1
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.0040f0b0
mov rbx, rax
mov r8d, r13d
lea rdi, [0x00437b84]
inc r8d
movsxd rcx, r8d
cmp byte [rcx + rdi], 0
jne 0x41c531
mov r11d, dword [rax + 0x10]
mov ecx, r8d
cmp r11d, r8d
cmovl ecx, r11d
mov r9d, r13d
mov rdx, r13
movsxd r10, ecx
test ecx, ecx
jle 0x41c579
mov rcx, qword [rax + 8]
nop
movzx eax, byte [rdx + rdi]
cmp byte [rcx + rdx], al
jne 0x41c574
inc r9d
inc rdx
cmp rdx, r10
jl 0x41c560
test r9d, r9d
js 0x41c58c
cmp r9d, r11d
jge 0x41c58c
movsxd rcx, r9d
mov rax, qword [rbx + 8]
movzx r10d, byte [rcx + rax]
jmp 0x41c58f
xor r10b, r10b
test r9d, r9d
js 0x41c5a2
cmp r9d, r8d
jge 0x41c5a2
movsxd rax, r9d
movzx edx, byte [rax + rdi]
jmp 0x41c5a4
xor dl, dl
movsx ecx, r10b
movsx eax, dl
sub ecx, eax
sete bl
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x78], r13
mov dword [rsp + 0x80], r13d
mov dword [rsp + 0x88], r13d
test rcx, rcx
je 0x41c5d9
call fcn.00421200
test bl, bl
je 0x41c72c
mov dword [rsp + 0x50], 0x18
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x60], 1
xor r9d, r9d
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x148]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x41c79f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
lea r9, [rsp + 0x68]
mov r8, rbx
mov rdx, qword [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0xa0]
call fcn.00422940
mov dword [rsp + 0xa0], 0x68
mov dword [rsp + 0xdc], 0x100
mov qword [rsp + 0xf8], r13
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0x100], r13
mov word [rsp + 0xe0], 0
lea rdx, [rsi + 1]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x41c79f
mov rax, qword [rsp + 0x68]
mov qword [rbp + 8], rax
movsxd rcx, eax
mov edx, 0x4009
call fcn.00425d60
mov ecx, eax
lea rdx, [0x00437b80]
call fcn.00425610
mov qword [rbp + 0x30], rax
jmp 0x41c79f
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 7]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 8], rax
cmp rax, 0xffffffffffffffff
je 0x41c79f
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
movsxd rcx, dword [rbp + 8]
mov edx, 0x4009
call fcn.00425d60
mov ecx, eax
lea rdx, [0x00437b80]
call fcn.00425610
mov qword [rbp + 0x30], rax
xor edx, edx
mov rcx, rax
call fcn.004255f0
nop
mov rax, rbp
mov rbx, qword [rsp + 0x150]
mov rbp, qword [rsp + 0x158]
mov rsi, qword [rsp + 0x130]
mov rdi, qword [rsp + 0x128]
mov r12, qword [rsp + 0x120]
mov r13, qword [rsp + 0x118]
mov r14, qword [rsp + 0x110]
add rsp, 0x138
ret