Function at 0x140053210
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x810
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x800], rax
mov rsi, rcx
lea rcx, [rsp + 0x402]
xor edx, edx
mov r8d, reloc.MFC80U.DLL_Ordinal_1022
mov word [rsp + 0x400], 0
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x202]
xor edx, edx
mov r8d, Ordinal_512
mov word [rsp + reloc.MFC80U.DLL_Ordinal_512], 0
call sub.ntdll.dll_memset
mov ebx, dword [rsi]
mov rdi, qword [rsi + 8]
call fcn.140049400
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_512]
mov r9d, ebx
mov r10, qword [rax]
mov r8d, 0x100
mov rcx, rax
mov rbp, rax
mov qword [rsp + 0x20], rdi
call qword [r10 + 0x58]
test eax, eax
jne 0x14005339a
call fcn.140049470
lea rbx, [0x140433950]
xor edx, edx
mov rcx, rbx
mov r8d, 0x80
mov rsi, rax
call sub.ntdll.dll_memset
lea rcx, str...cnvfat.cpp
mov edx, 0x5c
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
jne 0x1400532f0
xor ebx, ebx
jmp 0x140053380
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0xf0]
mov r8d, 0x20b
mov byte [rsp + 0xf0], 0
mov qword [rsp + 0xf1], rax
mov word [rsp + 0xf9], ax
mov byte [rsp + 0xfb], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x140053340
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0xf0]
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x140053370
mov rax, qword [rsi]
lea rdx, str._s:_Get_guid_failed_for_chkdsk.exe
mov r8, rbx
mov rcx, rsi
call qword [rax + 0x10]
xor eax, eax
jmp 0x14005358d
lea r8, [rsp + reloc.MFC80U.DLL_Ordinal_512]
lea rdx, str.convert.exe__Volume_s__V__FS:NTFS
lea rcx, [rsp + 0x400]
call qword [sym.imp.MSVCR80.dll__swprintf]
lea rcx, [rsp + 0x101]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x100], 0
call sub.ntdll.dll_memset
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_512]
lea rcx, [rsp + 0x100]
mov r8d, 0x100
call qword [sym.imp.ntdll.dll_wcstombs]
lea rcx, [rsi + 0x50]
lea r8, [rsp + 0x100]
lea rdx, [0x1402e12f8]
call qword [sym.imp.ntdll.dll_sprintf]
mov rax, qword [rbp]
mov r8, qword [rsi + 8]
mov edx, dword [rsi]
mov r9d, 0x80000000
mov rcx, rbp
call qword [rax + 0xc0]
mov rbx, rax
call fcn.1400494c0
lea rcx, [rsp + 0x78]
mov rdi, qword [rax]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x70]
mov rdx, rbx
mov rcx, rax
call qword [rdi]
test eax, eax
jne 0x140053480
call fcn.140049470
lea rcx, str...cnvfat.cpp
mov edx, 0x223
mov rbx, qword [rax]
mov rdi, rax
call fcn.140052f30
lea rdx, str._s:_Get_the_used_sector_of_volume_by_GetDiskFreeSpace2_failed.
mov rcx, rdi
mov r8, rax
call qword [rbx + 0x10]
mov edi, 0xc800000
jmp 0x140053492
mov rdi, qword [rsp + 0x50]
mov rcx, rbx
shr rdi, 9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea rcx, [rsp + 0x80]
xor edx, edx
lea r8d, [rax + 0x68]
mov qword [rsi + reloc.MFC80U.DLL_Ordinal_424], rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
call sub.ntdll.dll_memset
mov rax, qword [rsi + 0x170]
or dword [rsp + 0xbc], 0x101
xor ebx, ebx
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xd8], rax
mov rax, qword [rsi + 0x158]
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0x58]
lea rdx, [rsp + 0x400]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x80], 0x68
mov word [rsp + 0xc0], 0
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14005357c
call fcn.140049470
lea rcx, str...cnvfat.cpp
mov edx, Ordinal_588
mov rbx, qword [rax]
mov rdi, rax
call fcn.140052f30
lea rdx, str._s:_CreateProcess_failed
mov rcx, rdi
mov r8, rax
call qword [rbx + 0x10]
xor eax, eax
jmp 0x14005358d
mov rcx, qword [rsp + 0x58]
mov eax, 1
mov qword [0x140423218], rcx
mov rcx, qword [rsp + 0x800]
xor rcx, rsp
call fcn.140161080
lea r11, [rsp + 0x810]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret