Function at 0x140043350
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x450
mov qword [rsp + 0x428], 0xfffffffffffffffe
mov rax, qword [0x140064270]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rcx, qword [rsp + 0x460]
call fcn.14003cdd0
mov rdx, rax
lea rcx, [rsp + 0x190]
call fcn.140033e80
nop
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x468]
mov rcx, qword [rsp + 0x460]
call fcn.14003e5d0
movzx eax, al
test eax, eax
jne 0x140043407
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0x190]
call fcn.1400333d0
mov rcx, qword [rsp + 0x468]
call fcn.140004608
mov byte [rsp + 0x1a4], al
lea rcx, [rsp + 0x190]
call fcn.140033e30
mov al, byte [rsp + 0x1a4]
jmp 0x1400436c2
lea rcx, [rsp + 0x50]
call fcn.14003a5d0
nop
lea rdx, str._t:0
lea rcx, [rsp + 0x50]
call fcn.14003a880
cmp qword [rsp + 0x470], 0
je 0x14004345d
lea rdx, [0x140052398]
lea rcx, [rsp + 0x50]
call fcn.14003a880
mov edx, dword [rsp + 0x470]
mov rcx, rax
call fcn.14003a900
lea rdx, [0x1400520f4]
mov rcx, rax
call fcn.14003a880
lea rdx, [0x140052418]
lea rcx, [rsp + 0x50]
call fcn.14003a880
mov edx, dword [rsp + 0x488]
mov rcx, rax
call fcn.14003a8c0
lea rdx, [0x140052194]
mov rcx, rax
call fcn.14003a880
mov rcx, qword [rsp + 0x460]
add rcx, 0x138
call fcn.14003cdb0
mov rbx, rax
lea rdx, [0x140052294]
lea rcx, [rsp + 0x50]
call fcn.14003a880
mov rdx, rbx
mov rcx, rax
call fcn.14003a880
lea rdx, [0x1400522f4]
mov rcx, rax
call fcn.14003a880
cmp qword [rsp + 0x478], 0
je 0x1400434eb
mov rdx, qword [rsp + 0x478]
lea rcx, [rsp + 0x50]
call fcn.14003a880
lea rcx, [rsp + 0x50]
call fcn.14003a130
mov rbx, rax
mov rcx, qword [rsp + 0x460]
call fcn.14003cdd0
mov r8, rax
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x480]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea rdx, [0x140052820]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x1a0], eax
cmp dword [rsp + 0x1a0], 0x20
jg 0x140043682
mov rcx, qword [rsp + 0x460]
add rcx, 0x138
call fcn.14003cdb0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x1a8]
call fcn.14003d780
nop
lea rdx, [0x140052830]
lea rcx, [rsp + 0x2e0]
call fcn.14003acc0
mov qword [rsp + 0x430], rax
mov rax, qword [rsp + 0x430]
mov qword [rsp + 0x438], rax
mov edx, dword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x438]
call fcn.14003a8c0
lea rdx, [0x140052414]
mov rcx, rax
call fcn.14003a880
mov rcx, rax
call fcn.14003a130
mov qword [rsp + 0x420], rax
mov rcx, qword [rsp + 0x468]
call fcn.14003b980
lea r8, [rsp + 0x1a8]
mov rdx, qword [rsp + 0x420]
mov rcx, rax
call fcn.14003bed0
nop
lea rcx, [rsp + 0x2e0]
call fcn.14003a260
nop
lea rcx, [rsp + 0x1a8]
call fcn.14003cdf0
mov edx, dword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x468]
call fcn.140042cb0
lea rcx, [rsp + 0x190]
call fcn.140033470
mov rcx, qword [rsp + 0x468]
call fcn.140004608
mov byte [rsp + 0x418], al
lea rcx, [rsp + 0x50]
call fcn.14003a260
nop
lea rcx, [rsp + 0x190]
call fcn.140033e30
mov al, byte [rsp + 0x418]
jmp 0x1400436c2
lea rcx, [rsp + 0x190]
call fcn.140033450
mov rcx, qword [rsp + 0x468]
call fcn.1400010b0
mov byte [rsp + 0x419], al
lea rcx, [rsp + 0x50]
call fcn.14003a260
nop
lea rcx, [rsp + 0x190]
call fcn.140033e30
mov al, byte [rsp + 0x419]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14000fd20
add rsp, 0x450
pop rbx
ret