Function at 0x14003fb60
Capabilities:
Create process on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x318
mov qword [rsp + 0xd0], 0xfffffffffffffffe
mov rax, qword [0x140322b20]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov dword [rsp + 0x210], WSAStartup
lea rax, [rsp + 0x214]
mov rdi, rax
xor eax, eax
mov ecx, 0x6c
rep stosb byte [rdi], al
lea rax, str.runas
mov qword [rsp + 0x220], rax
mov rax, qword [rsp + 0x338]
mov qword [rsp + 0x228], rax
mov rax, qword [rsp + 0x340]
mov qword [rsp + 0x230], rax
cmp dword [rsp + 0x348], 0
je 0x14003fc00
mov dword [rsp + 0x214], 0x440
jmp 0x14003fc0b
mov dword [rsp + 0x214], 0x400
mov dword [rsp + 0x290], 0
lea rax, [rsp + 0x298]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
movzx eax, word [rsp + 0x2d0]
mov dword [rsp + 0x240], eax
lea rcx, [rsp + 0x210]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rsp + 0x40], eax
lea r9, [0x14024fa80]
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0xd8]
call fcn.140038d20
lea rcx, [rsp + 0xa0]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rsp + 0x44], eax
mov rdx, qword [rsp + 0x340]
lea rcx, [rsp + 0x110]
call fcn.14001f4b0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.14002f250
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x338]
lea rcx, [rsp + 0x190]
call fcn.14001f4b0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x68], rax
xor edx, edx
mov rcx, qword [rsp + 0x68]
call fcn.14002f250
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0xa0]
mov rdi, rcx
mov rsi, rdx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov ecx, dword [rsp + 0x44]
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x240]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x214]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x60]
mov r9, rcx
mov r8, rax
lea rdx, [0x14024fa20]
lea rcx, [rsp + 0x70]
call fcn.14003b980
nop
lea rcx, [rsp + 0x190]
call fcn.140020590
nop
lea rcx, [rsp + 0x110]
call fcn.140020590
cmp dword [rsp + 0x348], 0
je 0x14003fe2d
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x280], 0
lea rdx, [rsp + 0x280]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [0x14024fbf0]
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0xf8]
call fcn.140038d20
lea rcx, [rsp + 0xc0]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x90]
lea rcx, [rsp + 0xc0]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov r8d, dword [rsp + 0x280]
lea rdx, [0x14024fbc0]
lea rcx, [rsp + 0x90]
call fcn.14003b980
jmp 0x14003fe9f
cmp dword [rsp + 0x40], 0
jne 0x14003fe9f
lea r9, [0x14024fd20]
xor r8d, r8d
mov edx, 3
lea rcx, [rsp + 0xe8]
call fcn.140038d20
lea rcx, [rsp + 0xb0]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0xb0]
mov rdi, rcx
mov rsi, rdx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
rep movsb byte [rdi], byte [rsi]
mov r8d, eax
lea rdx, str._tasp::library_ShellExecuteEx_err_lu._n
lea rcx, [rsp + 0x80]
call fcn.14003b980
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.1401fe250
add rsp, 0x318
pop rdi
pop rsi
ret