Function at 0x110118e10
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
xor ebx, ebx
mov r12d, ecx
mov r15d, ebx
mov r13b, bl
lea eax, [rbx + 4]
lea esi, [rbx + 3]
cmp ecx, 1
jbe 0x110118e58
jle 0x110118e5e
cmp ecx, esi
jle 0x110118e58
cmp ecx, eax
jne 0x110118e5e
mov r13b, 1
mov qword [rbp - 0x51], r8
jmp 0x110118ea7
call sym.msvcrt.dll___doserrno
mov dword [rax], ebx
call sym.msvcrt.dll__errno
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
call sym.msvcrt.dll__invalid_parameter
jmp 0x110119155
add r8, 2
cmp word [r8], bx
jne 0x110118e89
cmp word [r8 + 2], bx
je 0x110118ea7
mov ecx, 0x20
mov word [r8], cx
add r8, 2
movzx eax, word [r8]
test ax, ax
jne 0x110118e89
mov edi, 0x68
lea rcx, [rbp - 0x49]
mov r8d, edi
xor edx, edx
call sym.msvcrt.dll_memset
mov dword [rbp - 0x49], edi
lea rdx, [sym.msvcrt.dll___pioinfo]
mov edi, dword [0x110195924]
test edi, edi
je 0x110118efc
movsxd rcx, edi
dec rcx
mov rax, rcx
and ecx, 0x1f
sar rax, 5
imul rcx, rcx, 0x38
mov rax, qword [rdx + rax*8]
cmp byte [rax + rcx + 8], bl
jne 0x110118efa
sub edi, 1
jne 0x110118ed7
test edi, edi
js 0x11011914a
movsxd r14, edi
cmp r14, 0x1c71
jae 0x11011914a
movzx eax, di
lea ecx, [rdi + 4]
shl ax, 3
mov edx, 1
add cx, ax
movzx ecx, cx
mov word [rbp - 7], cx
call fcn.110119e8c
mov qword [rbp - 1], rax
test rax, rax
je 0x11011914a
mov dword [rax], edi
or rbx, 0xffffffffffffffff
mov rax, qword [rbp - 1]
lea r9, [rax + 4]
add r9, r14
lea rdx, [rax + 4]
test edi, edi
jle 0x110118fa4
xor r8d, r8d
mov r10d, edi
lea r11, [sym.msvcrt.dll___pioinfo]
mov rax, r8
mov rcx, r8
and eax, 0x1f
sar rcx, 5
imul rax, rax, 0x38
add rax, qword [r11 + rcx*8]
mov cl, byte [rax + 8]
test cl, 0x10
jne 0x110118f87
mov byte [rdx], cl
mov rax, qword [rax]
jmp 0x110118f8d
mov byte [rdx], r15b
mov rax, rbx
mov qword [r9], rax
inc r8
add r9, 8
inc rdx
sub r10, 1
jne 0x110118f63
mov rax, qword [rbp - 1]
test r13b, r13b
je 0x110119060
lea r15, [rax + 4]
add r15, r14
lea r13, [rax + 4]
cmp edi, esi
cmovl esi, edi
xor r14d, r14d
test esi, esi
jle 0x11011905a
cmp esi, 2
jb 0x11011903b
lea eax, [rsi - 1]
movsxd rcx, eax
lea rax, [r15 + rcx*8]
lea rdx, [rcx + r13]
cmp r13, rax
ja 0x110118fe5
cmp rdx, r15
jae 0x11011903b
mov eax, esi
and eax, 0x80000001
jge 0x110118ff5
dec eax
or eax, 0xfffffffe
inc eax
mov ecx, esi
sub ecx, eax
add r14d, 2
cmp r14d, ecx
jl 0x110118ff9
lea eax, [rcx + 1]
cdq
sub eax, edx
xor edx, edx
sar eax, 1
movsxd rcx, eax
lea rdi, [rcx + rcx]
mov rcx, r13
mov r8, rdi
call sym.msvcrt.dll_memset
mov rdx, rdi
add r13, rdi
shl rdx, 3
mov rdi, r15
mov rcx, rdx
mov rax, rbx
shr rcx, 3
rep stosq qword [rdi], rax
add r15, rdx
cmp r14d, esi
jge 0x11011905a
sub esi, r14d
mov eax, esi
mov byte [r13], 0
inc r13
mov qword [r15], rbx
lea r15, [r15 + 8]
sub rax, 1
jne 0x110119045
mov r15d, 8
call sym.msvcrt.dll___doserrno
mov rdx, qword [rbp - 0x51]
bts r15d, 0xa
mov rcx, qword [rbp + 0x6f]
xor r9d, r9d
xor r8d, r8d
and dword [rax], 0
lea rax, [rbp - 0x69]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
mov rax, qword [rbp + 0x7f]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 1
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
mov edi, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, qword [rbp - 1]
mov esi, eax
call sym.msvcrt.dll_free
test edi, edi
jne 0x1101190d5
mov ecx, esi
call fcn.110107d08
mov rax, rbx
jmp 0x110119159
cmp r12d, 2
je 0x110119174
test r12d, r12d
jne 0x110119122
mov rcx, qword [rbp - 0x69]
or edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x69]
lea rdx, [rbp + 0x67]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
test eax, eax
je 0x110119109
movsxd rbx, dword [rbp + 0x67]
jmp 0x110119116
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.110107d08
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x11011913e
mov eax, 4
cmp r12d, eax
jne 0x11011913a
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor ebx, ebx
jmp 0x11011913e
mov rbx, qword [rbp - 0x69]
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x1101190cd
call sym.msvcrt.dll__errno
mov dword [rax], 0xc
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x130]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor ecx, ecx
call sym.msvcrt.dll__exit
int3