Function at 0x14002b394
Capabilities:
Create process on windows
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov rdi, qword [rsp + 0x150]
mov rbx, r9
mov al, r9b
mov r14b, dil
and rdi, 0xfffffffffffffffe
and rbx, 0xfffffffffffffffe
and r14b, 1
and al, 1
mov rbp, r8
mov r12, rcx
je 0x14002b3e9
cmp qword [rcx + 0x1b8], 0
mov byte [rsp + 0x150], 1
jne 0x14002b3f1
mov byte [rsp + 0x150], 0
mov rsi, r8
mov rcx, rdx
and rbp, 0xfffffffffffffffe
shl rsi, 7
and esi, 0x80
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov rcx, rbp
mov dword [rsp + 0x148], eax
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov dword [rsp + 0x50], eax
test rbx, rbx
je 0x14002b432
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov r15d, eax
jmp 0x14002b435
xor r15d, r15d
test rdi, rdi
je 0x14002b448
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
mov r13d, eax
jmp 0x14002b44b
xor r13d, r13d
lea eax, [r15 + r13*2 + 0x416]
lea rcx, [rsp + 0x58]
add eax, dword [rsp + 0x50]
add eax, dword [rsp + 0x148]
movsxd rdx, eax
call fcn.1400619b4
mov rcx, qword [rsp + 0x58]
lea rdx, [0x140118bd8]
mov r8d, 0xc
call fcn.14001d310
movsxd r10, dword [rsp + 0x148]
mov rdx, qword [rsp + 0x138]
add r10, r10
add rcx, 0xc
mov r8, r10
call fcn.14001d310
mov eax, 0x20
add rcx, r10
lea edx, [rax + 2]
lea r11d, [rax - 0x1e]
test rbx, rbx
je 0x14002b4f8
mov word [rcx], ax
lea eax, [rdx + 0xb]
add rcx, r11
mov word [rcx], ax
lea eax, [rdx + 0x4d]
add rcx, r11
mov word [rcx], ax
add rcx, r11
movsxd r10, r15d
mov word [rcx], dx
add r10, r10
add rcx, r11
mov rdx, rbx
mov r8, r10
call fcn.14001d310
add rcx, r10
lea r15d, [r11 + 0x20]
mov word [rcx], r15w
add rcx, r11
lea eax, [r11 + 0x1e]
jmp 0x14002b4fe
mov r15d, 0x22
movsxd r10, dword [rsp + 0x50]
mov word [rcx], ax
add rcx, r11
mov word [rcx], r15w
add r10, r10
add rcx, r11
mov r8, r10
mov rdx, rbp
call fcn.14001d310
add rcx, r10
xor ebx, ebx
mov word [rcx], r15w
add rcx, r11
cmp r13d, ebx
je 0x14002b55a
lea eax, [rbx + 0x20]
movsxd r10, r13d
mov rdx, rdi
mov word [rcx], ax
add rcx, r11
add r10, r10
mov word [rcx], r15w
add rcx, r11
mov r8, r10
call fcn.14001d310
add rcx, r10
mov word [rcx], r15w
add rcx, r11
mov word [rcx], bx
xor eax, eax
lea rcx, [rsp + 0x90]
lea r8d, [rax + 0x58]
xor edx, edx
mov dword [rsp + 0x140], 1
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x80], 0x68
mov qword [rsp + 0x88], rbx
call fcn.1400fa350
mov rdx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
or esi, 0x1000004
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
add rdx, 0xc
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], esi
mov word [rsp + 0xc0], bx
mov dword [rsp + 0xbc], 0x81
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.DLL_CreateProcessW]
cmp byte [rsp + 0x150], bl
je 0x14002b619
mov rdx, qword [rsp + 0x60]
cmp rdx, rbx
je 0x14002b620
mov rcx, qword [r12 + 0x1b8]
call qword [sym.imp.KERNEL32.DLL_AssignProcessToJobObject]
cmp qword [rsp + 0x60], rbx
jne 0x14002b634
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rsp + 0x140], eax
cmp qword [rsp + 0x60], rbx
je 0x14002b67d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.DLL_ResumeThread]
mov rcx, qword [rsp + 0x60]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [rsp + 0x140]
cmp r14b, bl
jne 0x14002b6af
mov rdx, qword [rsp + 0x58]
lea rcx, [r12 + 8]
mov r8d, eax
mov r9d, 0x1100
add rdx, 0x12
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call fcn.140025f90
mov eax, dword [rsp + 0x140]
lea rcx, [rsp + 0x58]
mov ebx, eax
call fcn.140059370
mov rax, rbx
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret