Function at 0x14003fb00
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x320
mov qword [rsp + 0x308], 0xfffffffffffffffe
mov rax, qword [0x140064270]
xor rax, rsp
mov qword [rsp + 0x318], rax
mov dword [rsp + 0x300], 0
call fcn.140039430
mov rcx, rax
call fcn.140039b50
movzx eax, al
test eax, eax
je 0x14003fb8c
lea rdx, [0x1400565a8]
mov rcx, qword [rsp + 0x338]
call fcn.14003acc0
nop
mov eax, dword [rsp + 0x300]
or eax, 1
mov dword [rsp + 0x300], eax
mov rax, qword [rsp + 0x338]
jmp 0x14003ff23
mov dword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x330]
call fcn.14003a130
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140033e80
nop
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x340]
mov rcx, qword [rsp + 0x330]
call fcn.14003e5d0
movzx eax, al
test eax, eax
jne 0x14003fc63
mov edx, dword [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.1400333d0
cmp dword [rsp + 0x60], 1
jne 0x14003fc27
lea rdx, [0x140056698]
mov rcx, qword [rsp + 0x338]
call fcn.14003acc0
mov eax, dword [rsp + 0x300]
or eax, 1
mov dword [rsp + 0x300], eax
lea rcx, [rsp + 0x68]
call fcn.140033e30
mov rax, qword [rsp + 0x338]
jmp 0x14003ff23
lea rdx, [0x140056aa0]
mov rcx, qword [rsp + 0x338]
call fcn.14003acc0
mov eax, dword [rsp + 0x300]
or eax, 1
mov dword [rsp + 0x300], eax
lea rcx, [rsp + 0x68]
call fcn.140033e30
mov rax, qword [rsp + 0x338]
jmp 0x14003ff23
lea rcx, [rsp + 0x80]
call fcn.14003a5d0
nop
mov rcx, qword [rsp + 0x330]
call fcn.14003a130
mov r8, qword [rsp + 0x348]
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.14003cf00
lea rcx, [rsp + 0x1c0]
call fcn.14003d9e0
nop
lea rdx, [rsp + 0x1c0]
mov rcx, qword [rsp + 0x330]
call fcn.14003dca0
lea r11, [rsp + 0x1c0]
mov qword [rsp + 0x58], r11
mov rcx, qword [rsp + 0x58]
call fcn.140039f00
movzx eax, al
test eax, eax
je 0x14003fce5
mov qword [rsp + 0x310], 0
jmp 0x14003fcf7
mov rcx, qword [rsp + 0x58]
call fcn.14003cdb0
mov qword [rsp + 0x310], rax
mov rax, qword [rsp + 0x310]
mov qword [rsp + 0x50], rax
call fcn.140039430
mov rcx, rax
call fcn.140038800
movzx eax, al
test eax, eax
je 0x14003fdc1
lea rcx, [rsp + 0x68]
call fcn.1400333b0
mov byte [rsp + 0x30], 0
mov dword [rsp + 0x28], 5
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x348]
xor r8d, r8d
mov rdx, qword [rsp + 0x340]
mov rcx, qword [rsp + 0x330]
call fcn.14003f1b0
movzx eax, al
test eax, eax
jne 0x14003fdbc
lea rdx, [0x140056aa8]
mov rcx, qword [rsp + 0x338]
call fcn.14003acc0
mov eax, dword [rsp + 0x300]
or eax, 1
mov dword [rsp + 0x300], eax
lea rcx, [rsp + 0x1c0]
call fcn.14003cdf0
nop
lea rcx, [rsp + 0x80]
call fcn.14003a260
nop
lea rcx, [rsp + 0x68]
call fcn.140033e30
mov rax, qword [rsp + 0x338]
jmp 0x14003ff23
jmp 0x14003fed0
lea rcx, [rsp + 0x80]
call fcn.140039ee0
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.14003a4e0
mov rbx, rax
mov rcx, qword [rsp + 0x330]
call fcn.14003a0f0
mov rcx, rax
mov rax, qword [rsp + 0x360]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x358]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x350]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14003feb7
mov edx, 2
lea rcx, [rsp + 0x68]
call fcn.1400333d0
lea rcx, [rsp + 0x80]
call fcn.14003a9a0
lea rdx, [0x140056ab0]
mov rcx, qword [rsp + 0x338]
call fcn.14003acc0
mov eax, dword [rsp + 0x300]
or eax, 1
mov dword [rsp + 0x300], eax
lea rcx, [rsp + 0x1c0]
call fcn.14003cdf0
nop
lea rcx, [rsp + 0x80]
call fcn.14003a260
nop
lea rcx, [rsp + 0x68]
call fcn.140033e30
mov rax, qword [rsp + 0x338]
jmp 0x14003ff23
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.1400333d0
lea rcx, [rsp + 0x80]
call fcn.14003a9a0
lea rdx, [0x140056ab8]
mov rcx, qword [rsp + 0x338]
call fcn.14003acc0
mov eax, dword [rsp + 0x300]
or eax, 1
mov dword [rsp + 0x300], eax
lea rcx, [rsp + 0x1c0]
call fcn.14003cdf0
nop
lea rcx, [rsp + 0x80]
call fcn.14003a260
nop
lea rcx, [rsp + 0x68]
call fcn.140033e30
mov rax, qword [rsp + 0x338]
mov rcx, qword [rsp + 0x318]
xor rcx, rsp
call fcn.14000fd20
add rsp, 0x320
pop rbx
ret