Function at 0x1800345c8
Capabilities:
Create process on windows

Disassembly:
push rax
pushf
mov eax, 0xbb1b8864
pushf
not eax
add eax, 0x839accde
xor eax, 0xe28dc1ac
rol eax, 0xc3
popf
pushf
not eax
add eax, 0xf4f7078f
xor eax, 0x9d62d8e5
rol eax, 0xe5
popf
cmp eax, 2
jne 0x180034605
popf
pop rax
jmp 0x1800347ca
cmp eax, 0
jne 0x180034614
popf
pop rax
jmp 0x180034632
cmp eax, 3
jne 0x180034623
popf
pop rax
jmp 0x180034839
cmp eax, 1
jne 0x180034632
popf
pop rax
jmp 0x18003478b
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xe0
mov rbx, rcx
mov edi, 0x6a84c540
pushf
not edi
add edi, 0xe77cafe7
xor edi, 0xe229ac7d
rol edi, 0x59
popf
pushf
not edi
add edi, 0xfd999ed9
xor edi, 0x86cd143f
rol edi, 0x28
popf
pushf
not edi
add edi, 0xa0aca866
xor edi, 0x9f61dd16
rol edi, 0xc
popf
pushf
not edi
add edi, 0xe488177c
xor edi, 0xc59cde0f
rol edi, 0x66
popf
mov r8d, edi
lea rcx, [rsp + 0x70]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], edi
mov qword [rsp + 0x48], rax
xor edi, edi
lea rax, [rsp + 0x70]
mov dword [rsp + 0xac], 1
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rdi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov rdx, rbx
mov dword [rsp + 0x28], edi
xor ecx, ecx
mov dword [rsp + 0x20], edi
mov word [rsp + 0xb0], di
jmp 0x1800346f5
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x180034732
push rax
pushf
mov eax, 0x31c34baa
pushf
not eax
add eax, 0xdf11d207
xor eax, 0x91597806
rol eax, 0x30
popf
pushf
not eax
add eax, 0xbd526fdb
xor eax, 0xbe7833c3
rol eax, 0x49
popf
jmp 0x1800345f6
push rax
pushf
mov eax, 0x21e9329
pushf
not eax
add eax, 0xcb07689c
xor eax, 0xd4ded67a
rol eax, 0x94
popf
pushf
not eax
add eax, 0xaef9e122
xor eax, 0xb68d19d6
rol eax, 0x56
popf
pushf
not eax
add eax, 0x9b234e53
xor eax, 0x9ede997b
rol eax, 0x68
popf
pushf
not eax
add eax, 0xdc324d72
xor eax, 0xeca9f366
rol eax, 0xd5
popf
jmp 0x1800345f6
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x1c6be7422]
pushf
sub rdx, 0x46bcb71a
popf
call fcn.18001064c
mov rcx, rax
lea rdx, [0x1c70de284]
pushf
sub rdx, 0x470cdab0
popf
jmp 0x1800347bf
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea eax, [rdi + 1]
jmp 0x180034839
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
jmp 0x1800347d3
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
jmp 0x1800347df
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
jmp 0x1800347eb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push rax
pushf
mov eax, 0x305ddd3c
pushf
not eax
add eax, 0x988b9911
xor eax, 0xfbcf2f7e
rol eax, 0x56
popf
pushf
not eax
add eax, 0x99b76781
xor eax, 0xa9d54564
rol eax, 0x4b
popf
pushf
not eax
add eax, 0xc51ce3bd
xor eax, 0x8bdee586
rol eax, 0xeb
popf
jmp 0x1800345f6
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rdi
ret