Function at 0x140070520
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xe0
xor ebp, ebp
xor sil, sil
test ecx, ecx
mov r14, r9
mov r15, rdx
mov edi, ecx
mov r12d, ebp
je 0x140070567
cmp ecx, 1
je 0x140070567
cmp ecx, 1
jle 0x1400706a9
cmp ecx, 3
jle 0x140070567
cmp ecx, 4
jne 0x1400706a9
mov sil, 1
cmp word [r8], bp
mov qword [rsp + 0x118], rbx
mov qword [rsp + 0x120], r13
mov r13, r8
je 0x1400705a7
cmp word [r8], bp
je 0x140070590
add r8, 2
cmp word [r8], bp
jne 0x140070586
cmp word [r8 + 2], bp
je 0x1400705a1
mov word [r8], 0x20
add r8, 2
cmp word [r8], bp
jne 0x140070580
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.140057420
mov ebx, dword [0x1400b0268]
mov dword [rsp + 0x70], WSAGetLastError
test ebx, ebx
lea r9, [0x1400b0280]
je 0x140070607
lea r8d, [rbx - 1]
nop
nop
nop
movsxd rax, r8d
mov cl, al
mov rdx, rax
sar rdx, 5
and ecx, 0x1f
mov rax, qword [r9 + rdx*8]
imul rcx, rcx, 0x58
cmp byte [rax + rcx + 8], bpl
jne 0x140070607
sub r8d, 1
sub ebx, 1
jne 0x1400705e0
test ebx, ebx
js 0x140070838
cmp ebx, 0x1c71
jae 0x140070838
movzx eax, bx
mov edx, 1
shl ax, 3
lea ecx, [rax + rbx + 4]
mov word [rsp + 0xb2], cx
movzx ecx, cx
call fcn.140060cd0
test rax, rax
mov qword [rsp + 0xb8], rax
je 0x140070838
test ebx, ebx
mov dword [rax], ebx
mov r8, qword [rsp + 0xb8]
movsxd r11, ebx
lea rcx, [r8 + 4]
lea rdx, [r11 + r8 + 4]
jle 0x1400706ff
mov r8, rbp
mov r10d, ebx
lea r11, [0x1400b0280]
nop
nop
nop
mov r9b, r8b
mov rax, r8
and r9d, 0x1f
sar rax, 5
imul r9, r9, 0x58
add r9, qword [r11 + rax*8]
movzx eax, byte [r9 + 8]
test al, 0x10
jne 0x1400706d8
mov byte [rcx], al
mov rax, qword [r9]
mov qword [rdx], rax
jmp 0x1400706e2
call fcn.140054ef0
mov dword [rax], ebp
call fcn.140054ec0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], 0x16
mov qword [rsp + 0x20], rbp
call fcn.140052a80
or rax, 0xffffffffffffffff
jmp 0x140070857
mov byte [rcx], bpl
mov qword [rdx], 0xffffffffffffffff
add r8, 1
add rcx, 1
add rdx, 8
sub r10, 1
jne 0x140070680
mov r8, qword [rsp + 0xb8]
movsxd r11, ebx
test sil, sil
je 0x14007073e
mov edx, 3
lea rax, [r8 + 4]
lea rcx, [r11 + r8 + 4]
cmp ebx, edx
cmovl edx, ebx
test edx, edx
jle 0x140070738
nop
nop
mov byte [rax], bpl
mov qword [rcx], 0xffffffffffffffff
add rcx, 8
add rax, 1
sub rdx, 1
jne 0x140070720
mov r12d, 8
call fcn.140054ef0
bts r12d, 0xa
xor r9d, r9d
mov dword [rax], ebp
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rdx, r13
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r14
mov rcx, r15
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xb8]
mov esi, eax
call fcn.140054d40
test ebx, ebx
jne 0x1400707ae
mov ecx, esi
call fcn.140054f20
jmp 0x140070843
cmp edi, 2
jne 0x1400707bb
xor ecx, ecx
call fcn.140057b90
int3
test edi, edi
jne 0x140070803
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x50]
movsxd rbp, dword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
jmp 0x140070847
cmp edi, 4
jne 0x140070823
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
jmp 0x140070847
mov rcx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
jmp 0x140070847
call fcn.140054ec0
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x118]
mov r13, qword [rsp + 0x120]
mov rbp, qword [rsp + 0x128]
add rsp, 0xe0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret