Function at 0x1400011a0
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x100
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov dword [rsp + 0x70], 0x68
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [r11 - 0x80], xmm0
movups xmmword [r11 - 0x70], xmm0
movups xmmword [r11 - 0x60], xmm0
movups xmmword [r11 - 0x50], xmm0
movups xmmword [r11 - 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
xor ebp, ebp
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], 0xf
lea ecx, [rbp + 0x30]
call fcn.140001550
mov r8, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], 0x29
mov qword [rsp + 0x68], 0x2f
movups xmm0, xmmword [str.cmd.exe__C_hl2.exe__steam__game_garrysmod]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140003360]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x140003370]
movsd qword [rax + 0x20], xmm0
movzx eax, byte [0x140003378]
mov byte [r8 + 0x28], al
mov byte [r8 + 0x29], bpl
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rbp - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rsi, eax
test eax, eax
je 0x140001359
mov rdi, rsi
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x140001495
add rdi, rdi
cmp rdi, 0x1000
jb 0x1400012ca
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x14000148f
call fcn.140001550
test rax, rax
je 0x140001455
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400012df
test rdi, rdi
je 0x1400012dc
mov rcx, rdi
call fcn.140001550
mov rbx, rax
jmp 0x1400012df
mov rbx, rbp
mov r8, rdi
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r8, qword [rsp + 0x50]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1400013a0
test rbx, rbx
je 0x140001359
sar rdi, 1
lea rdx, [rdi + rdi]
cmp rdx, 0x1000
jb 0x140001350
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x140001455
mov rbx, rcx
mov rcx, rbx
call fcn.14000158c
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140001461
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000145c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000145c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test rbx, rbx
je 0x140001414
sar rdi, 1
lea rdx, [rdi + rdi]
cmp rdx, 0x1000
jb 0x14000140b
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x140001455
mov rbx, rcx
mov rcx, rbx
call fcn.14000158c
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140001451
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000144c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001399
call fcn.14000158c
xor eax, eax
jmp 0x140001466
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14000158c
mov eax, 1
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.140001530
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140001100
nop
call fcn.140001500
int3