Function at 0x14003f1b0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x818
mov qword [rsp + 0x7f0], 0xfffffffffffffffe
mov rax, qword [0x140064270]
xor rax, rsp
mov qword [rsp + 0x808], rax
movzx eax, byte [rsp + 0x850]
test eax, eax
jne 0x14003f21b
call fcn.140039430
mov rcx, rax
call fcn.140039b50
movzx eax, al
test eax, eax
je 0x14003f21b
mov rcx, qword [rsp + 0x828]
call fcn.1400010b0
jmp 0x14003f778
cmp qword [rsp + 0x840], 0
je 0x14003f2bd
lea rdx, [0x1400546e4]
mov rcx, qword [rsp + 0x840]
sub rcx, rdx
movzx eax, word [rdx]
cmp ax, word [rdx + rcx]
jne 0x14003f252
add rdx, 2
test ax, ax
jne 0x14003f23c
xor eax, eax
jmp 0x14003f257
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x14003f2bd
lea rcx, [rsp + 0x70]
call fcn.14003d9e0
nop
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x820]
call fcn.14003dca0
lea r11, [rsp + 0x70]
mov qword [rsp + 0x60], r11
mov rcx, qword [rsp + 0x60]
call fcn.140039f00
movzx eax, al
test eax, eax
je 0x14003f2a1
mov qword [rsp + 0x840], 0
jmp 0x14003f2b3
mov rcx, qword [rsp + 0x60]
call fcn.14003cdb0
mov qword [rsp + 0x840], rax
lea rcx, [rsp + 0x70]
call fcn.14003cdf0
mov rcx, qword [rsp + 0x820]
call fcn.14003a130
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140033e80
nop
mov rcx, qword [rsp + 0x820]
call fcn.14003d350
movzx eax, al
test eax, eax
je 0x14003f2fb
lea rcx, [rsp + 0x48]
call fcn.1400333b0
jmp 0x14003f5c6
call fcn.140039430
mov rcx, rax
call fcn.140038800
movzx eax, al
test eax, eax
je 0x14003f4c9
mov rcx, qword [rsp + 0x820]
call fcn.14003d350
movzx eax, al
test eax, eax
jne 0x14003f3f5
mov rcx, qword [rsp + 0x820]
call fcn.14003cc70
movzx eax, al
test eax, eax
jne 0x14003f3f5
mov edx, 1
lea rcx, [rsp + 0x48]
call fcn.1400333d0
mov rcx, qword [rsp + 0x820]
call fcn.14003a0f0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x428]
call fcn.14003d780
nop
mov rcx, qword [rsp + 0x828]
call fcn.14003b980
lea r8, [rsp + 0x428]
lea rdx, [0x140055d10]
mov rcx, rax
call fcn.14003bed0
mov qword [rsp + 0x7e0], rax
mov rcx, qword [rsp + 0x7e0]
call fcn.140004608
mov byte [rsp + 0x424], al
lea rcx, [rsp + 0x428]
call fcn.14003cdf0
nop
lea rcx, [rsp + 0x48]
call fcn.140033e30
mov al, byte [rsp + 0x424]
jmp 0x14003f778
mov rcx, qword [rsp + 0x820]
call fcn.14003a0f0
mov rdx, rax
lea rcx, [rsp + 0x1b0]
call fcn.140042e40
nop
mov eax, dword [rsp + 0x848]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x840]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x838]
mov r8, qword [rsp + 0x830]
mov rdx, qword [rsp + 0x828]
lea rcx, [rsp + 0x1b0]
call fcn.140043350
movzx eax, al
test eax, eax
jne 0x14003f475
mov edx, 0xa
lea rcx, [rsp + 0x48]
call fcn.1400333d0
mov rcx, qword [rsp + 0x828]
call fcn.14003b8d0
jmp 0x14003f47f
lea rcx, [rsp + 0x48]
call fcn.1400333b0
mov rcx, qword [rsp + 0x828]
call fcn.1400010b0
mov byte [rsp + 0x560], al
lea rcx, [rsp + 0x2e8]
call fcn.14003cdf0
lea rcx, [rsp + 0x1b0]
call fcn.14003cdf0
nop
lea rcx, [rsp + 0x48]
call fcn.140033e30
mov al, byte [rsp + 0x560]
jmp 0x14003f778
call fcn.140039430
mov rcx, rax
call fcn.1400387b0
movzx eax, al
test eax, eax
je 0x14003f55c
cmp qword [0x140068b88], 0
je 0x14003f55c
mov rcx, qword [rsp + 0x820]
call fcn.14003a0f0
mov rdx, rax
mov r10, qword [0x140068b88]
mov r10, qword [r10]
mov eax, dword [rsp + 0x848]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x840]
mov r8, qword [rsp + 0x838]
mov rcx, qword [0x140068b88]
call qword [r10]
lea rcx, [rsp + 0x48]
call fcn.1400333b0
mov rcx, qword [rsp + 0x828]
call fcn.1400010b0
mov byte [rsp + 0x561], al
lea rcx, [rsp + 0x48]
call fcn.140033e30
mov al, byte [rsp + 0x561]
jmp 0x14003f778
mov dword [rsp + 0x420], 0
lea r8, [rsp + 0x420]
mov rdx, qword [rsp + 0x828]
mov rcx, qword [rsp + 0x820]
call fcn.14003e5d0
movzx eax, al
test eax, eax
jne 0x14003f5c6
mov edx, dword [rsp + 0x420]
lea rcx, [rsp + 0x48]
call fcn.1400333d0
mov rcx, qword [rsp + 0x828]
call fcn.140004608
mov byte [rsp + 0x562], al
lea rcx, [rsp + 0x48]
call fcn.140033e30
mov al, byte [rsp + 0x562]
jmp 0x14003f778
mov dword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x820]
call fcn.14003a0f0
mov r8, rax
mov eax, dword [rsp + 0x848]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x840]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x838]
lea rdx, [0x140055d28]
mov rcx, qword [rsp + 0x830]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0x20
jg 0x14003f747
mov edx, 2
lea rcx, [rsp + 0x48]
call fcn.1400333d0
mov rcx, qword [rsp + 0x820]
call fcn.14003a0f0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x568]
call fcn.14003d780
nop
lea rdx, [0x140055d38]
lea rcx, [rsp + 0x6a0]
call fcn.14003acc0
mov qword [rsp + 0x7f8], rax
mov rax, qword [rsp + 0x7f8]
mov qword [rsp + 0x800], rax
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x800]
call fcn.14003a8c0
lea rdx, [0x140054b8c]
mov rcx, rax
call fcn.14003a880
mov rcx, rax
call fcn.14003a130
mov qword [rsp + 0x7e8], rax
mov rcx, qword [rsp + 0x828]
call fcn.14003b980
lea r8, [rsp + 0x568]
mov rdx, qword [rsp + 0x7e8]
mov rcx, rax
call fcn.14003bed0
nop
lea rcx, [rsp + 0x6a0]
call fcn.14003a260
nop
lea rcx, [rsp + 0x568]
call fcn.14003cdf0
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x828]
call fcn.14003da10
mov rcx, qword [rsp + 0x828]
call fcn.140004608
mov byte [rsp + 0x7d8], al
lea rcx, [rsp + 0x48]
call fcn.140033e30
mov al, byte [rsp + 0x7d8]
jmp 0x14003f778
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.1400333d0
mov rcx, qword [rsp + 0x828]
call fcn.1400010b0
mov byte [rsp + 0x7d9], al
lea rcx, [rsp + 0x48]
call fcn.140033e30
mov al, byte [rsp + 0x7d9]
mov rcx, qword [rsp + 0x808]
xor rcx, rsp
call fcn.14000fd20
add rsp, 0x818
ret