Function at 0x1400440f0
Capabilities:
Create process on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
mov rax, qword [0x1400e5010]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov r14, r9
mov rdi, r8
mov qword [rsp + 0xc8], rdx
mov qword [rsp + 0x178], rdx
mov rax, qword [rsp + 0x330]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x338]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x350]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x358]
mov qword [rsp + 0xb0], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x190], xmm0
call fcn.140077020
lea r9, [0x1400c186b]
lea r8, str.Windows::ProcessFactory::CreateInternal
mov rdx, qword [rax]
lea rcx, [rsp + 0x190]
call fcn.14002e800
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x138], xmm0
mov qword [rsp + 0x148], rax
mov r13, qword [rdi + 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r13
cmp rax, 1
jb 0x14004477b
mov r12, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400441f2
mov r12, qword [rdi]
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
lea rsi, [r13 + 1]
mov qword [rsp + 0x150], rsi
mov ebx, 7
lea r15, [rsp + 0x60]
cmp rsi, rbx
jbe 0x140044287
mov rbx, rsi
cmp rsi, 8
cmovb rbx, qword [0x1400c43e8]
or rbx, 7
cmp rbx, rcx
jbe 0x14004423b
mov rbx, rcx
jmp 0x140044247
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140044781
lfence
add rcx, rcx
call fcn.140010dd0
mov r15, rax
mov qword [rsp + 0x60], rax
mov rsi, qword [rsp + 0x150]
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rbx
movzx eax, word [0x1400c7b04]
mov word [r15], ax
lea rcx, [r15 + 2]
lea r8, [r13*2]
mov rdx, r12
call fcn.14007fbc0
xor r12d, r12d
mov word [r15 + rsi*2], r12w
mov r8, qword [rsp + 0x70]
mov r9, qword [rsp + 0x78]
mov rax, r9
sub rax, r8
lea rcx, [rsp + 0x60]
cmp rax, 2
jb 0x1400442fc
lea rdx, [r8 + 2]
mov qword [rsp + 0x70], rdx
cmp r9, 8
cmovae rcx, qword [rsp + 0x60]
mov eax, dword [0x1400c7afc]
mov dword [rcx + r8*2], eax
mov word [rcx + rdx*2], r12w
lea rax, [rsp + 0x60]
jmp 0x140044319
lfence
mov qword [rsp + 0x20], 2
lea r9, [0x1400c7afc]
mov edx, 2
call fcn.14000fd40
mov qword [rsp + 0x88], r12
mov qword [rsp + 0x98], r12
mov qword [rsp + 0xa0], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x98], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov r8, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 8
jb 0x140044366
mov r14, qword [r14]
mov rdx, r14
lea rcx, [rsp + 0x88]
call fcn.14000a370
mov qword [rsp + 0x158], r12
mov qword [rsp + 0x168], r12
mov qword [rsp + 0x170], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x158], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x168], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rsp + 0xa0]
cmp rdx, 8
jb 0x1400443fd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400443f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140044787
call fcn.140079480
mov qword [rsp + 0x98], r12
mov qword [rsp + 0xa0], 7
mov word [rsp + 0x88], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14004445c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044457
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004478d
call fcn.140079480
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
mov rax, qword [rsp + 0xa8]
mov ecx, dword [rax + 0x3c]
and ecx, 0x100
mov r10, qword [rsp + 0xb0]
cmp byte [r10 + 8], 0
je 0x1400444fd
lea r8, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
cmovae r8, qword [rsp + 0x158]
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400444b7
mov rdx, qword [rdi]
lea r9, [rsp + 0x138]
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r12
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x340]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov rcx, qword [r10]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x140044566
lea rdx, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
cmovae rdx, qword [rsp + 0x158]
mov r10, rdi
cmp qword [rdi + 0x18], 8
jb 0x140044524
mov r10, qword [rdi]
lea r8, [rsp + 0x138]
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x340]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140044793
mov rbx, qword [rsp + 0x140]
mov qword [rsp + 0x1a8], rbx
mov ecx, 8
call fcn.140079488
mov rsi, rax
mov rax, qword [rsp + 0x138]
mov qword [rsi], rax
mov qword [rsp + 0x178], rsi
mov r14, qword [rsp + 0xb8]
mov rcx, qword [r14 + 0x38]
test rcx, rcx
je 0x1400445eb
mov eax, dword [rsp + 0x14c]
mov qword [rsp + 0x180], rax
mov eax, dword [rsp + 0x148]
mov qword [rsp + 0x188], rax
mov rax, qword [rcx]
lea r8, [rsp + 0x180]
lea rdx, [rsp + 0x188]
mov rax, qword [rax + 0x10]
call qword [case.0x14001dc6b.0]
nop
mov r8, qword [rsp + 0xc0]
mov rdx, rbx
mov rcx, qword [rsi]
call fcn.140043d90
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x1b0]
call fcn.14007f9f0
call fcn.140077020
mov rcx, qword [rax]
mov qword [rsp + 0x1b0], rcx
mov dword [rsp + 0x1b8], r12d
lea rcx, [rsp + 0x1c0]
call fcn.140018e90
nop
mov rcx, qword [rsp + 0x1b0]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001dc6b.0]
cmp dword [rsp + 0x1b8], eax
setl byte [rsp + 0x2b8]
jl 0x14004469b
cmp qword [rdi + 0x18], 8
jb 0x140044669
mov rdi, qword [rdi]
mov eax, dword [rsp + 0x14c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x148]
mov r8, rdi
lea rdx, str.Created_process_of__S_with_PID:__lu_and_TID:__lu
lea rcx, [rsp + 0x1b0]
call fcn.14002e770
mov byte [rsp + 0x2b8], 1
lea rcx, [rsp + 0x1b0]
call fcn.140026c90
mov rdi, qword [rsp + 0xc8]
mov qword [rdi], rsi
test rbx, rbx
je 0x1400446c2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 8
jb 0x14004470a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044705
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400447e6
call fcn.140079480
mov qword [rsp + 0x168], r12
mov qword [rsp + 0x170], 7
mov word [rsp + 0x158], r12w
lea rcx, [rsp + 0x190]
call fcn.140026f60
nop
mov rcx, qword [r14 + 0x38]
test rcx, rcx
je 0x140044755
mov r8, qword [rcx]
cmp rcx, r14
setne dl
mov rax, qword [r8 + 0x20]
call qword [case.0x14001dc6b.0]
mov qword [r14 + 0x38], r12
mov rax, rdi
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.140079460
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.1400055b0
nop
call fcn.140005510
nop
call fcn.140086b94
nop
call fcn.140086b94
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0xf8]
call fcn.14002e230
nop
mov r8, rax
lea rdx, str.CreateProcessW_failed_with_error:
lea rcx, [rsp + 0x118]
call fcn.14000f9b0
nop
mov rdx, rax
lea rcx, [rsp + 0xe0]
call fcn.1400055d0
lea rdx, [0x1400e26d0]
lea rcx, [rsp + 0xe0]
call fcn.14007f918
nop
call fcn.140086b94
int3