Function at 0x140003e20
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x1400a96f0]
xor rax, rsp
mov qword [rbp + 0xf0], rax
movzx r12d, dl
mov rdi, rcx
xor r13d, r13d
mov ebx, r13d
mov dword [rbp - 8], ebx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], rax
mov dword [rbp + 0x80], WSAGetLastError
mov dword [rbp + 0xbc], 1
movzx eax, dl
xor al, 1
movzx eax, al
mov word [rbp + 0xc0], ax
xor eax, eax
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], rax
mov rax, qword [rcx + 0x10]
cmp rax, 3
jb 0x140003f45
lea rcx, [rax - 3]
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
cmp rax, rcx
jb 0x140004547
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140003ef7
mov rax, qword [rdi]
lea rdx, [rax + rcx]
mov r8d, 3
lea rcx, [rbp + 0x20]
call fcn.14000b880
mov ebx, 0x41
mov dword [rbp - 8], ebx
lea rcx, [rbp + 0x20]
mov rsi, qword [rbp + 0x20]
mov r14, qword [rbp + 0x38]
cmp r14, 0x10
cmovae rcx, rsi
mov r8, qword [rbp + 0x30]
cmp r8, 3
jne 0x140003f4d
lea rdx, [0x140097a30]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140003f4d
mov r15b, 1
jmp 0x140003f50
mov r14, qword [rbp + 0x38]
mov rsi, qword [rbp + 0x20]
xor r15b, r15b
test bl, 1
je 0x140003f92
and ebx, 0xfffffffe
mov dword [rbp - 8], ebx
cmp r14, 0x10
jb 0x140003f92
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140003f8a
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000450b
mov rcx, rsi
call fcn.140083fe4
test r15b, r15b
je 0x140003fae
lea rax, str.pythonw
lea rdx, str.python
test r12b, r12b
cmovne rdx, rax
jmp 0x140003fb5
lea rdx, [0x14009733b]
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x20], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140003fd0
lea rcx, [rbp + 0x20]
call fcn.14000b880
nop
movabs rax, 0x7fffffffffffffff
test r15b, r15b
je 0x1400040db
mov rcx, qword [rbp + 0x30]
sub rax, rcx
cmp rax, 2
jb 0x14000454d
lea r9, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae r9, qword [rbp + 0x20]
mov qword [rsp + 0x30], 2
lea rax, [0x140097a4c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x68]
call fcn.140010080
bts ebx, 7
or ebx, 2
mov dword [rbp - 8], ebx
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0x10
jb 0x140004051
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rbp - 0x68]
call fcn.140009cd0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
bts ebx, 8
or ebx, 4
mov dword [rbp - 8], ebx
mov r8d, 1
lea rdx, [0x140097a48]
lea rcx, [rsp + 0x58]
call fcn.140009cd0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
bts ebx, 9
lea rax, [rbp - 0x28]
or ebx, 8
jmp 0x140004163
mov rcx, qword [rdi + 0x10]
sub rax, rcx
cmp rax, 1
jb 0x140004541
cmp qword [rdi + 0x18], 0x10
jb 0x1400040f6
mov rdi, qword [rdi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 1
lea r9, [0x140097a48]
lea rcx, [rsp + 0x78]
call fcn.140010080
bts ebx, 0xa
or ebx, 0x10
mov dword [rbp - 8], ebx
mov r8d, 1
lea rdx, [0x140097a48]
lea rcx, [rsp + 0x78]
call fcn.140009cd0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rax, [rbp - 0x48]
or ebx, 0x820
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x68], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
test bl, 0x20
je 0x1400041c8
and ebx, 0xffffffdf
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x1400041c8
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400041c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140083fe4
nop
test bl, 0x10
je 0x140004220
and ebx, 0xffffffef
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x14000420f
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000420a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000420a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140083fe4
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x78], 0
test bl, 8
je 0x140004267
and ebx, 0xfffffff7
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140004267
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004261
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004261
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140083fe4
nop
test bl, 4
je 0x1400042c2
and ebx, 0xfffffffb
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400042af
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400042aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400042aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140083fe4
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x58], 0
test bl, 2
je 0x140004315
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140004305
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004300
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004300
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140083fe4
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x68], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rax
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x68]
cmp qword [rbp + 0x70], 0x10
jb 0x14000433a
mov rcx, qword [rbp + 0x58]
add rdx, rcx
jmp 0x140004341
add rdx, rcx
lea rcx, [rbp + 0x58]
movdqu xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r13
mov qword [rbp], rcx
mov qword [rbp - 8], rdx
sub rdx, rcx
lea r9, [rbp - 8]
lea r8, [rbp]
lea rcx, [rbp + 0x40]
call fcn.140014320
nop
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, qword [rbp + 0x50]
je 0x14000437f
mov byte [rdx], 0
inc qword [rbp + 0x48]
jmp 0x14000438d
lea r8, [rsp + 0x50]
lea rcx, [rbp + 0x40]
call fcn.140014ab0
test r15b, r15b
je 0x140004397
mov eax, r13d
jmp 0x1400043a7
mov eax, reloc.WS2_32.dll_recv
mov ecx, 0x8000000
test r12b, r12b
cmovne eax, ecx
lea rcx, [rbp + 8]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14000442d
lea rdx, str.CreateProcess_failed__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000d0a0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140097a50]
call fcn.14000d0a0
lea rdx, [0x14000d270]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140004442
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14000448b
mov rdx, qword [rbp + 0x50]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000447a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000447a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140083fe4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r13
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x1400044c9
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400044c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400044c4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140083fe4
mov qword [rbp + 0x68], r13
mov qword [rbp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x58], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140004517
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004512
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004512
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140083fe4
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.140083eb0
mov rbx, qword [rsp + 0x250]
add rsp, 0x200
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140001220
nop
call fcn.14000cce0
nop
call fcn.140001220
int3