Function at 0x180029842
Capabilities:
Create process on windows

Disassembly:
push rax
pushf
mov eax, 0xd85edcc0
pushf
not eax
add eax, 0xf775b4ff
xor eax, 0xd479651c
rol eax, 0x43
popf
pushf
not eax
add eax, 0xed195034
xor eax, 0x919b671d
rol eax, 0x5c
popf
cmp eax, 2
jne 0x18002987f
popf
pop rax
jmp 0x180029a44
cmp eax, 0
jne 0x18002988e
popf
pop rax
jmp 0x1800298ac
cmp eax, 3
jne 0x18002989d
popf
pop rax
jmp 0x180029ab3
cmp eax, 1
jne 0x1800298ac
popf
pop rax
jmp 0x180029a05
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xe0
mov rbx, rcx
mov edi, 0xbab7ec43
pushf
not edi
add edi, 0xb07d9efb
xor edi, 0x940d543c
rol edi, 4
popf
pushf
not edi
add edi, 0x9b2cee71
xor edi, 0xbee25e7f
rol edi, 0x84
popf
pushf
not edi
add edi, 0xae6ab341
xor edi, 0xef373582
rol edi, 0x96
popf
pushf
not edi
add edi, 0xc497a8c0
xor edi, 0xeb053dd5
rol edi, 0x42
popf
mov r8d, edi
lea rcx, [rsp + 0x70]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], edi
mov qword [rsp + 0x48], rax
xor edi, edi
lea rax, [rsp + 0x70]
mov dword [rsp + 0xac], 1
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rdi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov rdx, rbx
mov dword [rsp + 0x28], edi
xor ecx, ecx
mov dword [rsp + 0x20], edi
mov word [rsp + 0xb0], di
jmp 0x18002996f
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1800299d2
push rax
pushf
mov eax, 0x6f97889a
pushf
not eax
add eax, 0xc0e4ce31
xor eax, 0x9098e8bb
rol eax, 0x9d
popf
pushf
not eax
add eax, 0xaa206cbf
xor eax, 0xf469946f
rol eax, 0xb4
popf
pushf
not eax
add eax, 0xc385808e
xor eax, 0xeab58bc6
rol eax, 0xde
popf
pushf
not eax
add eax, 0xeacc006c
xor eax, 0x9127d56a
rol eax, 0xbf
popf
jmp 0x180029870
push rax
pushf
mov eax, 0x178993e0
pushf
not eax
add eax, 0xcf72f2bc
xor eax, 0x8b5f0f96
rol eax, 0x10
popf
pushf
not eax
add eax, 0xffca7f4e
xor eax, 0xae7d4397
rol eax, 0x59
popf
jmp 0x180029870
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x1ceadf2d6]
pushf
sub rdx, 0x4eac6686
popf
call fcn.18003a7c8
mov rcx, rax
lea rdx, [0x1de65b3dc]
pushf
sub rdx, 0x5e64c7b4
popf
jmp 0x180029a39
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea eax, [rdi + 1]
jmp 0x180029ab3
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
jmp 0x180029a4d
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
jmp 0x180029a59
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
jmp 0x180029a65
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push rax
pushf
mov eax, 0x3d2a78ba
pushf
not eax
add eax, 0xc9de35eb
xor eax, 0xff76ac30
rol eax, 0x53
popf
pushf
not eax
add eax, 0xda384b6f
xor eax, 0xb5eee39f
rol eax, 0x72
popf
pushf
not eax
add eax, 0xf72bc4da
xor eax, 0xbbc42576
rol eax, 0xbf
popf
jmp 0x180029870
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rdi
ret