Function at 0x1800022f0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x60
mov rax, qword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea r8, [rsp + 0x78]
mov dword [rsp + 0x58], 0x16c
lea rdx, [rsp + 0x70]
add rax, 0x16c
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
xor ebx, ebx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x70], ebx
call fcn.18000dbb0
cmp dword [0x18010c3d4], 0x3bcabd8
mov qword [rsp + 0x80], rax
jne 0x1800024f6
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRecoveryCallback]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawIcon]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetClassLongPtrW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRgn]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumPropsW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuContextHelpId]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_keybd_event]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenPrivateNamespaceW]
mov qword [rsp + 0x48], rbx
xor r9d, r9d
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov qword [rsp + 0x38], rbx
xor edx, edx
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetUpdatedClipboardFormats]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
call qword [sym.imp.USER32.dll_InSendMessage]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowPlacement]
lock add dword [rbx], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClassLongPtrW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawFocusRect]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolStackInformation]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SendNotifyMessageW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsZoomed]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkTransactedW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_mouse_event]
xor r8d, r8d
lea rcx, [0x1801245d8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenFile]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsImmersiveProcess]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetApplicationRestartSettings]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_keybd_event]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov rax, qword [sym.imp.KERNEL32.dll_GlobalLock]
lea rdx, [rsp + 0x80]
mov dword [rsp + 0x58], 0x155
lea rcx, [rsp + 0x50]
add rax, 0x155
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18000ddf0
add rsp, 0x60
pop rbx
ret