Function at 0x14000a780
Capabilities:
Create process on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x288
mov rax, qword [0x1400770b8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov dword [rsp + 0x54], 0x8000000
mov rdx, qword [rsp + 0x290]
lea rcx, [rsp + 0x230]
call fcn.140010a10
nop
xor r8d, r8d
lea rdx, [0x14005bea0]
lea rcx, [rsp + 0x230]
call fcn.14001d950
cmp rax, 0xffffffffffffffff
je 0x14000a82c
xor r8d, r8d
lea rdx, [0x14005beb0]
lea rcx, [rsp + 0x230]
call fcn.14001d950
cmp rax, 0xffffffffffffffff
jne 0x14000a822
xor r8d, r8d
lea rdx, [0x14005bec0]
lea rcx, [rsp + 0x230]
call fcn.14001d950
cmp rax, 0xffffffffffffffff
je 0x14000a82a
mov dword [rsp + 0x54], 0
jmp 0x14000a86e
xor r8d, r8d
lea rdx, [0x14005b92c]
lea rcx, [rsp + 0x230]
call fcn.14001d950
cmp rax, 0xffffffffffffffff
jne 0x14000a866
xor r8d, r8d
lea rdx, [0x14005bed0]
lea rcx, [rsp + 0x230]
call fcn.14001d950
cmp rax, 0xffffffffffffffff
je 0x14000a86e
mov dword [rsp + 0x54], 0
mov rcx, qword [rsp + 0x298]
call fcn.14001b210
mov r8, rax
mov rdx, qword [rsp + 0x290]
lea rcx, str.cmd___s___cwd___s__n
call fcn.140009920
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.140034c20
mov dword [rsp + 0xc0], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x88]
call fcn.140034c20
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0xa0]
call fcn.140034c20
mov dword [rsp + 0xa0], 0x18
mov eax, dword [rsp + 0x2a8]
mov dword [rsp + 0xb0], eax
lea rax, str.D:_A_OICI_GA___SY__A_OICI_GA___BA__A_OICI_GA___CO__A_OICI_GRGWGX___IU_
mov qword [rsp + 0x68], rax
xor r9d, r9d
lea r8, [rsp + 0xa8]
mov edx, 1
mov rcx, qword [rsp + 0x68]
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x14000a939
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x5c], eax
mov edx, dword [rsp + 0x5c]
lea rcx, str.Failed_to_ConvertStringSecurityDescriptorToSecurityDescriptor:_error___d_n
call fcn.140009920
mov rcx, qword [rsp + 0x298]
call fcn.14001b210
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0xa0]
mov rdx, qword [rsp + 0x290]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000aa21
movzx eax, byte [rsp + 0x2a0]
test eax, eax
je 0x14000a9c0
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x58], 0
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14000a9e9
mov eax, dword [rsp + 0x58]
mov dword [0x1400786a0], eax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x50], 1
lea rcx, [rsp + 0x230]
call fcn.140012c60
movzx eax, byte [rsp + 0x50]
jmp 0x14000ab0c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
mov edx, 1
lea rcx, [rsp + 0x130]
call fcn.140010ef0
nop
lea rax, [rsp + 0x140]
lea rdx, [0x14005bf08]
mov rcx, rax
call fcn.14000b720
mov rdx, qword [rsp + 0x290]
mov rcx, rax
call fcn.14000b720
lea rdx, str.__n_Last_error_return:
mov rcx, rax
call fcn.14000b720
mov qword [rsp + 0x70], rax
mov edx, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
call fcn.1400136a0
lea rdx, [0x14005b934]
mov rcx, rax
call fcn.14000b720
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x130]
call fcn.140020780
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x80]
call fcn.14001b210
mov rdx, rax
lea rcx, [0x14005baa4]
call fcn.140009920
nop
lea rcx, [rsp + 0x250]
call fcn.140012c60
mov byte [rsp + 0x51], 0
lea rcx, [rsp + 0x130]
call fcn.140014940
nop
lea rcx, [rsp + 0x230]
call fcn.140012c60
movzx eax, byte [rsp + 0x51]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140033040
add rsp, 0x288
ret