Function at 0x140003b64
Capabilities:
Check if file exists
Create process on windows
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rbp + 0xd0], rax
xor r15d, r15d
mov dword [rdx + 0x10], ecx
lea r8, [rsp + 0x70]
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x68], r15
mov rdi, rdx
mov qword [rsp + 0x78], r15
mov esi, ecx
mov qword [rsp + 0x60], r15
call fcn.1400024ec
mov ebx, eax
test eax, eax
jns 0x140003c2d
cmp dword [section..data], 2
jbe 0x14000438f
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x14000438f
mov rax, qword [0x14000b018]
and rax, r8
cmp rax, qword [0x14000b018]
jne 0x14000438f
lea rax, str.onecorexboxgameinput2published_svc_session.cpp
mov dword [rbp - 0x38], ebx
mov qword [rbp - 0x28], rax
lea rdx, [0x140008c31]
lea rax, [rbp - 0x38]
mov dword [rbp - 0x34], 0x89
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
jmp 0x140003e44
lea rdx, [rsp + 0x68]
mov ecx, esi
call fcn.140003a38
mov ebx, eax
test eax, eax
jns 0x140003cad
cmp dword [section..data], 2
jbe 0x14000438f
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x14000438f
mov rax, qword [0x14000b018]
and rax, r8
cmp rax, qword [0x14000b018]
jne 0x14000438f
lea rax, str.onecorexboxgameinput2published_svc_session.cpp
mov dword [rbp - 0x30], ebx
mov qword [rbp - 0x20], rax
lea rdx, [0x140008c31]
lea rax, [rbp - 0x30]
mov dword [rbp - 0x2c], 0x8c
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
jmp 0x140003e44
mov r8, qword [rsp + 0x68]
lea rcx, [rdi + 0x14]
mov edx, 0x28
call qword [sym.imp.ntdll.dll_wcscpy_s]
nop dword [rax + rax]
mov esi, 1
cmp qword [rdi + 0x68], r15
jne 0x140003d73
mov r9, qword [rsp + 0x68]
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
nop dword [rax + rax]
mov qword [rdi + 0x68], rax
test rax, rax
jne 0x140003d73
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x140004371
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140004371
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140004371
mov dword [rbp - 0x80], eax
lea rdx, [0x140008cbe]
lea rax, str.onecorexboxgameinput2published_svc_session.cpp
mov dword [rbp - 0x7c], 0x92
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
jmp 0x140004367
mov rcx, qword [rsp + 0x68]
or r8, 0xffffffffffffffff
mov rax, r8
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140003d7f
mov rdx, qword [rsp + 0x70]
mov rcx, r8
inc rcx
cmp word [rdx + rcx*2], r15w
jne 0x140003d91
lea rbx, [rcx + 4]
mov rcx, qword gs:[0x60]
add rbx, rax
mov eax, 2
mul rbx
mov rcx, qword [rcx + 0x30]
cmovo rax, r8
xor edx, edx
mov r8, rax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x140003e53
cmp dword [section..data], 2
mov ebx, 0x8007000e
jbe 0x14000438f
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x14000438f
mov rax, qword [0x14000b018]
and rax, r8
cmp rax, qword [0x14000b018]
jne 0x14000438f
lea rax, str.onecorexboxgameinput2published_svc_session.cpp
mov dword [rbp - 0x78], ebx
mov qword [rbp - 0x10], rax
lea rdx, [0x140008c6e]
lea rax, [rbp - 0x78]
mov dword [rbp - 0x74], 0x98
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
call fcn.140001008
jmp 0x14000438f
mov rax, qword [rsp + 0x68]
lea r8, str.__ls___ls
mov r9, qword [rsp + 0x70]
mov rdx, rbx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_swprintf_s]
nop dword [rax + rax]
test eax, eax
jns 0x140003ef6
cmp dword [section..data], 2
jbe 0x140003eec
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140003eec
mov rax, qword [0x14000b018]
and rax, r8
cmp rax, qword [0x14000b018]
jne 0x140003eec
lea rax, str.onecorexboxgameinput2published_svc_session.cpp
mov dword [rbp - 0x70], 0x7a
mov qword [rbp - 8], rax
lea rdx, [0x140008cbe]
lea rax, [rbp - 0x70]
mov dword [rbp - 0x6c], 0x9d
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
call fcn.140001008
mov ebx, 0x8007007a
jmp 0x14000438f
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
nop dword [rax + rax]
lea r8, [rsp + 0x60]
mov edx, 0x201eb
mov rcx, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenProcessToken]
nop dword [rax + rax]
test eax, eax
jne 0x140003f9b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x140004371
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140004371
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140004371
mov dword [rbp - 0x68], eax
lea rdx, [0x140008cbe]
lea rax, str.onecorexboxgameinput2published_svc_session.cpp
mov dword [rbp - 0x64], 0xa8
mov qword [rbp], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rbp]
jmp 0x140004367
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x20], esi
xor edx, edx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_DuplicateTokenEx]
nop dword [rax + rax]
test eax, eax
jne 0x140004044
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x140004371
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140004371
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140004371
mov dword [rbp - 0x60], eax
lea rdx, [0x140008cbe]
lea rax, str.onecorexboxgameinput2published_svc_session.cpp
mov dword [rbp - 0x5c], 0xac
mov qword [rbp + 8], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 8]
jmp 0x140004367
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x10]
lea r8, [rbp + 0xc0]
mov qword [rsp + 0x28], r15
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x60], rcx
mov dword [rbp + 0xc0], esi
mov dword [rbp + 0xcc], 2
mov qword [rbp + 0xc4], 7
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AdjustTokenPrivileges]
nop dword [rax + rax]
test eax, eax
jne 0x14000411e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x140004371
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140004371
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140004371
mov dword [rbp - 0x58], eax
lea rdx, [0x140008cbe]
lea rax, str.onecorexboxgameinput2published_svc_session.cpp
mov dword [rbp - 0x54], 0xba
mov qword [rbp + 0x18], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x18]
jmp 0x140004367
mov rcx, qword [rsp + 0x60]
lea r8, [rdi + 0x10]
mov r9d, 4
lea edx, [r9 + 8]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetTokenInformation]
nop dword [rax + rax]
test eax, eax
jne 0x1400041bd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x140004371
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140004371
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140004371
mov dword [rbp - 0x50], eax
lea rdx, [0x140008cbe]
lea rax, str.onecorexboxgameinput2published_svc_session.cpp
mov dword [rbp - 0x4c], 0xbe
mov qword [rbp + 0x20], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
jmp 0x140004367
mov ebx, 0x68
lea rcx, [rbp + 0x50]
mov r8d, ebx
xor edx, edx
call sub.ntdll.dll_memset
mov r8, qword [rsp + 0x78]
xor eax, eax
mov rdx, qword [rsp + 0x70]
xorps xmm0, xmm0
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
mov qword [rbp + 0x48], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 0x1000000
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
movups xmmword [rbp + 0x38], xmm0
mov dword [rbp + 0x50], ebx
mov qword [rbp + 0x60], r15
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessAsUserW]
nop dword [rax + rax]
test eax, eax
jne 0x1400042b0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x140004371
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140004371
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140004371
mov dword [rbp - 0x48], eax
lea rdx, [0x140008cbe]
lea rax, str.onecorexboxgameinput2published_svc_session.cpp
mov dword [rbp - 0x44], 0xd1
mov qword [rbp + 0x28], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x28]
jmp 0x140004367
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x40]
mov qword [rdi + 0x78], rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov r9, rdi
mov qword [rsp + 0x28], r15
lea r8, [0x140004410]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
nop dword [rax + rax]
mov qword [rdi + 0x80], rax
test rax, rax
jne 0x14000438c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x140004371
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140004371
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140004371
mov dword [rbp - 0x40], eax
lea rdx, [0x140008cbe]
lea rax, str.onecorexboxgameinput2published_svc_session.cpp
mov dword [rbp - 0x3c], 0xdb
mov qword [rbp + 0x30], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140001008
test edi, edi
jne 0x14000437c
mov ebx, 0x8000ffff
jmp 0x14000438f
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x14000438f
mov ebx, r15d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000439e
call fcn.1400062b4
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400043ad
call fcn.1400062b4
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x1400043bf
mov rcx, rax
call fcn.1400062b4
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400043d5
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.140006f60
mov rbx, qword [rsp + 0x220]
add rsp, 0x1e0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret