Function at 0x140019ef0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x20], r9d
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf0
mov r15, rcx
xor eax, eax
xor ecx, ecx
mov r13, r8
mov rbx, rdx
mov r14d, eax
call fcn.140022dc0
mov rcx, r15
call fcn.14006ad04
mov rdi, rax
test rax, rax
je 0x14001a179
xor edx, edx
lea rcx, [rbp - 0x51]
mov qword [rsp + 0x120], rsi
lea r8d, [rdx + 0x68]
mov qword [rsp + 0x128], r12
call fcn.14004e2c0
mov rsi, qword [rbp + 0x77]
mov dword [rbp - 0x51], 0x68
test rsi, rsi
je 0x140019fdb
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140018c20
mov ecx, 0xfffffff6
mov r12d, 1
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp qword [rsp + 0x50], 0xffffffffffffffff
mov rcx, rax
cmovne rcx, qword [rsp + 0x50]
mov qword [rbp - 1], rcx
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp qword [rbp - 0x79], 0xffffffffffffffff
mov rcx, rax
cmovne rcx, qword [rbp - 0x79]
mov qword [rbp + 7], rcx
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp qword [rbp - 0x71], 0xffffffffffffffff
mov rcx, rax
cmovne rcx, qword [rbp - 0x71]
or dword [rbp - 0x15], 0x100
mov qword [rbp + 0xf], rcx
jmp 0x14001a05c
mov rcx, rdi
call fcn.14003cec0
test rax, rax
je 0x14001a058
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14003cf30
mov r14d, eax
test eax, eax
je 0x14001a058
mov ecx, 0xfffffff6
mov r12d, 1
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp qword [rsp + 0x50], 0xffffffffffffffff
mov ecx, 0xfffffff5
cmovne rax, qword [rsp + 0x50]
mov qword [rbp - 1], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp qword [rbp - 0x79], 0xffffffffffffffff
cmovne rax, qword [rbp - 0x79]
mov ecx, 0xfffffff4
mov qword [rbp + 7], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp qword [rbp - 0x71], 0xffffffffffffffff
cmovne rax, qword [rbp - 0x71]
or dword [rbp - 0x15], 0x100
mov qword [rbp + 0xf], rax
jmp 0x14001a05c
mov r12d, dword [rbp + 0x6f]
test rbx, rbx
je 0x14001a06f
cmp byte [rbx], 0
mov ecx, 0
cmove rbx, rcx
jmp 0x14001a071
xor ecx, ecx
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov qword [rbp - 0x69], rax
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x59], rax
lea rax, [rbp - 0x69]
mov rdx, rdi
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x51]
mov qword [rsp + 0x40], rax
mov eax, dword [rbp + 0x67]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
xor ecx, ecx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov r12, qword [rsp + 0x128]
test eax, eax
jne 0x14001a0f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_execute_command__s__err_d__n
mov r8, r15
mov r9d, eax
mov ecx, 1
call fcn.140020620
mov rcx, rdi
call fcn.14004dea4
xor eax, eax
jmp 0x14001a171
test rsi, rsi
je 0x14001a11c
mov rcx, rsi
call fcn.140018e30
cmp eax, 1
je 0x14001a11c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_re_instate_standard_descriptors:__s_n
mov ecx, 1
mov r8d, eax
call fcn.140020620
cmp dword [rbp + 0x7f], 0
mov rcx, qword [rbp - 0x69]
mov qword [r13], rcx
je 0x14001a133
movsxd rdx, dword [rbp - 0x59]
call fcn.140019910
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.14004dea4
test r14d, r14d
je 0x14001a16c
lea rbx, [rsp + 0x50]
mov edi, 3
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x14001a163
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 8
dec rdi
jne 0x14001a154
mov eax, 1
mov rsi, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret