Function at 0x4209e0
Capabilities:
Create pipe
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 8], rcx
mov r11, rsp
sub rsp, 0x138
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 - 8], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r12
mov qword [r11 - 0x20], r13
mov qword [r11 - 0x28], r14
mov rsi, rdx
mov rbp, rcx
lea rax, [0x0043ecf0]
mov qword [rcx], rax
lea rdi, [rcx + 0x10]
mov qword [r11 + 0x10], rdi
xor r13d, r13d
mov qword [rdi + 8], r13
mov dword [rdi + 0x10], r13d
lea r14, [0x0043d608]
mov qword [rdi], r14
mov dword [rdi + 0x18], r13d
xor edx, edx
mov rcx, rdi
call qword [0x0043d610]
nop
lea rax, [0x0043d648]
mov qword [rdi], rax
movsxd rbx, dword [rdi + 0x10]
mov edx, ebx
mov rcx, rdi
call qword [0x0043d650]
cmp ebx, ebx
jge 0x420a88
mov rcx, rbx
add rcx, qword [rdi + 8]
mov eax, ebx
sub eax, ebx
movsxd r8, eax
mov rdx, rcx
call fcn.004254c0
nop
lea rax, [0x0043d698]
mov qword [rdi], rax
xor edx, edx
mov rcx, rdi
call qword [rax + 8]
mov qword [rsp + 0x58], rsi
lea rax, [0x0043d780]
mov qword [rsp + 0x50], rax
mov ebx, r13d
mov dword [rsp + 0x60], r13d
test rsi, rsi
je 0x420acf
cmp byte [rsi], bl
je 0x420acf
nop
inc ebx
movsxd rax, ebx
cmp byte [rax + rsi], 0
jne 0x420ac0
mov dword [rsp + 0x60], ebx
movsxd r12, dword [rdi + 0x10]
mov eax, dword [rdi + 0x10]
lea edx, [rbx + rax]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
cmp r12d, r12d
jge 0x420b02
mov rdx, qword [rdi + 8]
add rdx, r12
movsxd rcx, ebx
add rcx, rdx
mov eax, r12d
sub eax, r12d
movsxd r8, eax
call fcn.004254c0
movsxd r8, ebx
mov rcx, r12
add rcx, qword [rdi + 8]
mov rdx, rsi
call fcn.004254c0
nop
mov qword [rbp + 0x30], r13
mov qword [rbp + 8], 0xffffffffffffffff
mov r8d, 1
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.00411de0
mov rbx, rax
mov r8d, r13d
lea rdi, [0x0043ed74]
inc r8d
movsxd rcx, r8d
cmp byte [rcx + rdi], 0
jne 0x420b41
mov r11d, dword [rax + 0x10]
mov ecx, r8d
cmp r11d, r8d
cmovl ecx, r11d
mov r9d, r13d
mov rdx, r13
movsxd r10, ecx
test ecx, ecx
jle 0x420b89
mov rcx, qword [rax + 8]
nop
movzx eax, byte [rdx + rdi]
cmp byte [rcx + rdx], al
jne 0x420b84
inc r9d
inc rdx
cmp rdx, r10
jl 0x420b70
test r9d, r9d
js 0x420b9c
cmp r9d, r11d
jge 0x420b9c
movsxd rcx, r9d
mov rax, qword [rbx + 8]
movzx r10d, byte [rcx + rax]
jmp 0x420b9f
xor r10b, r10b
test r9d, r9d
js 0x420bb2
cmp r9d, r8d
jge 0x420bb2
movsxd rax, r9d
movzx edx, byte [rax + rdi]
jmp 0x420bb4
xor dl, dl
movsx ecx, r10b
movsx eax, dl
sub ecx, eax
sete bl
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x78], r13
mov dword [rsp + 0x80], r13d
mov dword [rsp + 0x88], r13d
test rcx, rcx
je 0x420be9
call fcn.00425490
test bl, bl
je 0x420d3c
mov dword [rsp + 0x50], 0x18
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x60], 1
xor r9d, r9d
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x148]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x420daf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
lea r9, [rsp + 0x68]
mov r8, rbx
mov rdx, qword [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0xa0]
call fcn.00426c80
mov dword [rsp + 0xa0], 0x68
mov dword [rsp + 0xdc], 0x100
mov qword [rsp + 0xf8], r13
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0x100], r13
mov word [rsp + 0xe0], 0
lea rdx, [rsi + 1]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x420daf
mov rax, qword [rsp + 0x68]
mov qword [rbp + 8], rax
movsxd rcx, eax
mov edx, 0x4009
call fcn.0042a780
mov ecx, eax
lea rdx, [0x0043ed70]
call fcn.0042a030
mov qword [rbp + 0x30], rax
jmp 0x420daf
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 7]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 8], rax
cmp rax, 0xffffffffffffffff
je 0x420daf
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
movsxd rcx, dword [rbp + 8]
mov edx, 0x4009
call fcn.0042a780
mov ecx, eax
lea rdx, [0x0043ed70]
call fcn.0042a030
mov qword [rbp + 0x30], rax
xor edx, edx
mov rcx, rax
call fcn.0042a010
nop
mov rax, rbp
mov rbx, qword [rsp + 0x150]
mov rbp, qword [rsp + 0x158]
mov rsi, qword [rsp + 0x130]
mov rdi, qword [rsp + 0x128]
mov r12, qword [rsp + 0x120]
mov r13, qword [rsp + 0x118]
mov r14, qword [rsp + 0x110]
add rsp, 0x138
ret