Function at 0x14005cf90
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x158
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xd0], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [rcx + 0x80]
test byte [rcx], 1
je 0x14005cfee
mov r8, qword [rsi + 0x10]
mov rcx, 0xffffffffffffffff
mov rdx, 0xffffffffffffffff
test r8b, 1
je 0x14005cfdd
mov rdx, qword [rsi + 0x18]
or eax, 0x100
mov r8, qword [rsi + 8]
cmp byte [rsi + 0x20], 0
jne 0x14005d048
jmp 0x14005d04c
cmp dword [rsi + 0x10], 1
jne 0x14005d013
or eax, 0x100
mov rdx, qword [rsi + 0x18]
mov r8, 0xffffffffffffffff
mov rcx, 0xffffffffffffffff
cmp byte [rsi + 0x20], 0
jne 0x14005d048
jmp 0x14005d04c
cmp dword [rsi + 0x20], 1
jne 0x14005d03b
or eax, 0x100
mov r8, 0xffffffffffffffff
mov rcx, 0xffffffffffffffff
mov rdx, 0xffffffffffffffff
cmp byte [rsi + 0x20], 0
jne 0x14005d048
jmp 0x14005d04c
xor r8d, r8d
xor ecx, ecx
xor edx, edx
cmp byte [rsi + 0x20], 0
je 0x14005d04c
mov rcx, qword [rsi + 0x28]
mov dword [rbp - 0x30], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
mov qword [rbp + 4], 0
mov dword [rbp + 0xc], eax
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], rcx
movaps xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], 0
mov rdx, qword [rsi + 0x38]
mov r8, qword [rsi + 0x40]
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x80], 0
lea rcx, [rbp + 0x50]
xor r9d, r9d
call fcn.14005be50
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
mov rax, rcx
neg rax
jno 0x14005d0d6
mov edi, 1
mov rsi, rdx
jmp 0x14005d221
mov qword [rbp + 0xb0], rdx
mov qword [rbp + 0xc8], rcx
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0xb8], rax
mov rax, qword [rbp + 0x70]
mov qword [rbp + 0xa8], rax
lea rcx, [rsi + 0x60]
call fcn.14006edd0
add rdx, rax
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdx
mov word [rbp + 0x60], 0
mov dword [rbp + 0x68], 1
lea rcx, [rbp + 0x38]
lea rdx, [rbp + 0x50]
call fcn.14005ded0
mov rax, qword [rsi + 0x50]
mov r15, qword [rbp + 0x40]
lea rcx, [rbp + 0x90]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 1
mov r14, qword [rbp + 0xb0]
mov rcx, r14
mov rdx, qword [rbp + 0xa8]
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateProcessW
cmp eax, 1
jne 0x14005d237
mov rsi, qword [rbp + 0x90]
test rsi, rsi
je 0x14005d28e
mov qword [rbp + 0x90], 0
xor edi, edi
mov rbx, qword [rbp + 0xc8]
mov rdx, qword [rbp + 0x38]
test rdx, rdx
je 0x14005d1c2
add rdx, rdx
mov r8d, 2
mov rcx, r15
call fcn.140009320
mov rdx, qword [rbp + 0xb8]
test rdx, rdx
je 0x14005d1e3
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0xa8]
call fcn.140009320
test rbx, rbx
je 0x14005d1fc
add rbx, rbx
mov r8d, 2
mov rcx, r14
mov rdx, rbx
call fcn.140009320
mov rcx, qword [rbp + 0x90]
mov rbx, qword [rbp + 0x98]
test rcx, rcx
je 0x14005d214
call fcn.14007ef3e
test rbx, rbx
je 0x14005d221
mov rcx, rbx
call fcn.14007ef3e
mov rax, rdi
mov rdx, rsi
add rsp, 0x158
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov qword [rbp + 0xc0], r15
call fcn.14006d290
shl rax, 0x20
or rax, 2
lea rcx, [0x140088038]
mov edx, 0xe
mov r8, rax
call fcn.14005add0
mov rsi, rax
mov edi, 1
mov rbx, qword [rbp + 0xc8]
mov r14, qword [rbp + 0xb0]
mov r15, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0x38]
test rdx, rdx
jne 0x14005d1b1
jmp 0x14005d1c2
mov qword [rbp + 0xc0], r15
lea rcx, [0x140088020]
call fcn.140081560
ud2