Function at 0x14003fa2c
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x430]
sub rsp, 0x530
mov rax, qword [0x14005b3e8]
xor rax, rsp
mov qword [rbp + 0x420], rax
mov r14, rdx
mov rsi, rcx
mov dl, r8b
lea rcx, [rbp]
call fcn.14003f948
xor r15d, r15d
mov ebx, eax
test eax, eax
js 0x14003fd03
mov ecx, 0x105
lea rax, [rbp]
mov edx, ecx
cmp word [rax], r15w
je 0x14003fa92
add rax, 2
sub rdx, 1
jne 0x14003fa82
mov rax, rdx
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80070057
test rdx, rdx
je 0x14003faaf
mov rax, rcx
sub rax, rdx
jmp 0x14003fab2
mov rax, r15
test rdx, rdx
je 0x14003fb15
lea rdx, [rbp]
lea rdx, [rdx + rax*2]
sub rcx, rax
je 0x14003faf9
lea r8, [rax + 0x7ffffef9]
add r8, rcx
lea rax, str.Microsoft_SharedInkTabTip32.exe
sub rax, rdx
test r8, r8
je 0x14003faf9
movzx r9d, word [rax + rdx]
test r9w, r9w
je 0x14003faf9
mov word [rdx], r9w
dec r8
add rdx, 2
sub rcx, 1
jne 0x14003fad8
test rcx, rcx
lea rax, [rdx - 2]
cmovne rax, rdx
neg rcx
sbb ebx, ebx
not ebx
and ebx, 0x8007007a
mov word [rax], r15w
test ebx, ebx
js 0x14003fd03
xor eax, eax
lea rcx, [rbp - 0x70]
xorps xmm0, xmm0
mov qword [rbp - 0x80], rax
xor edx, edx
movups xmmword [rsp + 0x70], xmm0
lea ebx, [rax + 0x68]
mov r8d, ebx
call sub.msvcrt.dll_memset
mov dword [rbp - 0x70], ebx
mov dword [rbp - 0x34], 0x80
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
nop dword [rax + rax]
lea r9, str.loadhooks
mov edx, 0x104
lea r8, str.__s__Parent:_.16x
mov dword [rsp + 0x20], eax
lea rcx, [rbp + 0x210]
call fcn.140002ad8
mov ebx, eax
call fcn.14000617c
mov rcx, r15
mov rdi, rax
mov qword [rsp + 0x60], rcx
test rax, rax
je 0x14003fbc4
mov r9d, 2
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x20], 1
lea edx, [r9 + 9]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DuplicateTokenEx]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x14003fbc9
mov ebx, 0x80004005
test ebx, ebx
js 0x14003fcd9
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea r8, [rbp + 0x210]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rdx, [rbp]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessAsUserW]
nop dword [rax + rax]
test eax, eax
je 0x14003fcd4
mov rcx, qword [rsp + 0x70]
mov edx, 0x64
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x70]
cmp eax, 0x102
jne 0x14003fcb2
mov edx, 0x64
call qword [sym.imp.USER32.dll_WaitForInputIdle]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14003fc84
test r14, r14
je 0x14003fc62
mov eax, dword [rbp - 0x7c]
mov dword [r14], eax
test rsi, rsi
je 0x14003fc71
mov rax, qword [rsp + 0x70]
mov qword [rsi], rax
jmp 0x14003fcc3
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x14003fcc3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x68]
mov dword [rsp + 0x68], r15d
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
nop dword [rax + rax]
mov ebx, 0x80004005
jmp 0x14003fcc3
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov ebx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
test rdi, rdi
je 0x14003fcf2
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14003fd03
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x420]
xor rcx, rsp
call fcn.14000aea0
mov rbx, qword [rsp + 0x578]
add rsp, 0x530
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret