Function at 0x14002bce0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
xor ebx, ebx
or rbp, 0xffffffffffffffff
mov r15, r9
mov r12, r8
mov rax, rdx
mov r13, rcx
mov esi, ebx
test rdx, rdx
je 0x14002bd37
mov rdx, rbp
nop dword [rax + rax]
inc rdx
cmp word [rax + rdx*2], bx
jne 0x14002bd20
add rdx, rdx
mov rcx, rax
call sym.ProcessHacker.exe_PhCreateStringEx
mov rsi, rax
mov r14d, dword [rsp + 0x148]
mov edi, ebx
movzx eax, r14b
mov ecx, 0x400
and al, 2
cmovne edi, ecx
test r14b, 4
je 0x14002bd58
or edi, 4
test r14b, 8
je 0x14002bd62
bts edi, 0x18
test r14b, 0x10
je 0x14002bd6b
or edi, 0x10
mov rax, qword [rsp + 0x140]
test rax, rax
je 0x14002bdcf
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x80], xmm0
movups xmm0, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x90], xmm1
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rsp + 0xa0], xmm0
movups xmm0, xmmword [rax + 0x40]
movaps xmmword [rsp + 0xb0], xmm1
movups xmm1, xmmword [rax + 0x50]
movaps xmmword [rsp + 0xc0], xmm0
movsd xmm0, qword [rax + 0x60]
movsd qword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm1
jmp 0x14002bded
xor edx, edx
lea rcx, [rsp + 0x80]
lea r8d, [rdx + 0x68]
call fcn.1400e2690
mov dword [rsp + 0x80], 0x68
mov rcx, qword [rsp + 0x150]
test rcx, rcx
jne 0x14002be47
test rsi, rsi
je 0x14002be05
mov rdx, qword [rsi + 8]
jmp 0x14002be08
mov rdx, rbx
lea rax, [rsp + 0x60]
and r14d, 1
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rcx, r13
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x14002be94
test rsi, rsi
je 0x14002be52
mov r8, qword [rsi + 8]
jmp 0x14002be55
mov r8, rbx
lea rax, [rsp + 0x60]
and r14d, 1
mov qword [rsp + 0x50], rax
xor r9d, r9d
lea rax, [rsp + 0x80]
mov rdx, r13
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x14002beaf
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x14002bea6
mov ebx, eax
jmp 0x14002beaf
movzx ebx, ax
or ebx, 0xc0070000
test rsi, rsi
je 0x14002bec7
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], ebp
cmp ebp, 1
jne 0x14002bec7
call fcn.1400258b0
test ebx, ebx
js 0x14002bf26
mov rcx, qword [rsp + 0x158]
test rcx, rcx
je 0x14002bee7
mov eax, dword [rsp + 0x70]
mov qword [rcx], rax
mov eax, dword [rsp + 0x74]
mov qword [rcx + 8], rax
mov rcx, qword [rsp + 0x160]
test rcx, rcx
je 0x14002befe
mov rax, qword [rsp + 0x60]
mov qword [rcx], rax
jmp 0x14002bf09
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x68]
test rax, rax
je 0x14002bf20
mov qword [rax], rcx
jmp 0x14002bf26
call qword [sym.imp.ntdll.dll_NtClose]
lea r11, [rsp + 0xf0]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret