Function at 0x14003ec40
Capabilities:
Create process on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x820
mov qword [rsp + 0x800], 0xfffffffffffffffe
mov rax, qword [0x140064270]
xor rax, rsp
mov qword [rsp + 0x810], rax
call fcn.140039430
mov rcx, rax
call fcn.140039b50
movzx eax, al
test eax, eax
je 0x14003eca0
mov rcx, qword [rsp + 0x838]
call fcn.1400010b0
jmp 0x14003f182
mov rcx, qword [rsp + 0x830]
call fcn.14003a130
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140033e80
nop
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0x838]
mov rcx, qword [rsp + 0x830]
call fcn.14003e5d0
movzx eax, al
test eax, eax
jne 0x14003ed14
mov edx, dword [rsp + 0x50]
lea rcx, [rsp + 0x68]
call fcn.1400333d0
mov rcx, qword [rsp + 0x838]
call fcn.140004608
mov byte [rsp + 0x570], al
lea rcx, [rsp + 0x68]
call fcn.140033e30
mov al, byte [rsp + 0x570]
jmp 0x14003f182
lea rcx, [rsp + 0x80]
call fcn.14003a5d0
nop
mov rcx, qword [rsp + 0x830]
call fcn.14003a130
mov r8, qword [rsp + 0x840]
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.14003cf00
lea rcx, [rsp + 0x1c0]
call fcn.14003d9e0
nop
lea rdx, [rsp + 0x1c0]
mov rcx, qword [rsp + 0x830]
call fcn.14003dca0
lea r11, [rsp + 0x1c0]
mov qword [rsp + 0x60], r11
mov rcx, qword [rsp + 0x60]
call fcn.140039f00
movzx eax, al
test eax, eax
je 0x14003ed96
mov qword [rsp + 0x808], 0
jmp 0x14003eda8
mov rcx, qword [rsp + 0x60]
call fcn.14003cdb0
mov qword [rsp + 0x808], rax
mov rax, qword [rsp + 0x808]
mov qword [rsp + 0x58], rax
call fcn.140039430
mov rcx, rax
call fcn.140038800
movzx eax, al
test eax, eax
je 0x14003efc7
mov rcx, qword [rsp + 0x830]
call fcn.14003d350
movzx eax, al
test eax, eax
jne 0x14003eecb
mov rcx, qword [rsp + 0x830]
call fcn.14003cc70
movzx eax, al
test eax, eax
jne 0x14003eecb
mov edx, 1
lea rcx, [rsp + 0x68]
call fcn.1400333d0
mov rcx, qword [rsp + 0x830]
call fcn.14003a0f0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x578]
call fcn.14003d780
nop
mov rcx, qword [rsp + 0x838]
call fcn.14003b980
lea r8, [rsp + 0x578]
lea rdx, [0x140056458]
mov rcx, rax
call fcn.14003bed0
mov qword [rsp + 0x7f8], rax
mov rcx, qword [rsp + 0x7f8]
call fcn.140004608
mov byte [rsp + 0x571], al
lea rcx, [rsp + 0x578]
call fcn.14003cdf0
nop
lea rcx, [rsp + 0x1c0]
call fcn.14003cdf0
nop
lea rcx, [rsp + 0x80]
call fcn.14003a260
nop
lea rcx, [rsp + 0x68]
call fcn.140033e30
mov al, byte [rsp + 0x571]
jmp 0x14003f182
mov rcx, qword [rsp + 0x830]
call fcn.14003a0f0
mov rdx, rax
lea rcx, [rsp + 0x300]
call fcn.140042e40
nop
mov rax, qword [rsp + 0x858]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x850]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x848]
mov r8, qword [rsp + 0x840]
mov rdx, qword [rsp + 0x838]
lea rcx, [rsp + 0x300]
call fcn.140043020
movzx eax, al
test eax, eax
jne 0x14003ef57
mov edx, 0xa
lea rcx, [rsp + 0x68]
call fcn.1400333d0
mov rcx, qword [rsp + 0x838]
call fcn.14003b8d0
jmp 0x14003ef61
lea rcx, [rsp + 0x68]
call fcn.1400333b0
mov rcx, qword [rsp + 0x838]
call fcn.1400010b0
mov byte [rsp + 0x6b0], al
lea rcx, [rsp + 0x438]
call fcn.14003cdf0
lea rcx, [rsp + 0x300]
call fcn.14003cdf0
nop
lea rcx, [rsp + 0x1c0]
call fcn.14003cdf0
nop
lea rcx, [rsp + 0x80]
call fcn.14003a260
nop
lea rcx, [rsp + 0x68]
call fcn.140033e30
mov al, byte [rsp + 0x6b0]
jmp 0x14003f182
lea rcx, [rsp + 0x80]
call fcn.140039ee0
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.14003a4e0
mov rbx, rax
mov rcx, qword [rsp + 0x830]
call fcn.14003a0f0
mov rcx, rax
mov rax, qword [rsp + 0x858]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x850]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x848]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14003f128
mov edx, 2
lea rcx, [rsp + 0x68]
call fcn.1400333d0
lea rcx, [rsp + 0x80]
call fcn.14003a9a0
mov rcx, qword [rsp + 0x830]
call fcn.14003a0f0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x6b8]
call fcn.14003d780
nop
mov rcx, qword [rsp + 0x838]
call fcn.14003b980
lea r8, [rsp + 0x6b8]
lea rdx, [0x140056a90]
mov rcx, rax
call fcn.14003bed0
nop
lea rcx, [rsp + 0x6b8]
call fcn.14003cdf0
mov rcx, qword [rsp + 0x838]
call fcn.14003bc30
mov rcx, rax
call fcn.140004608
mov byte [rsp + 0x7f0], al
lea rcx, [rsp + 0x1c0]
call fcn.14003cdf0
nop
lea rcx, [rsp + 0x80]
call fcn.14003a260
nop
lea rcx, [rsp + 0x68]
call fcn.140033e30
mov al, byte [rsp + 0x7f0]
jmp 0x14003f182
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.1400333d0
lea rcx, [rsp + 0x80]
call fcn.14003a9a0
mov rcx, qword [rsp + 0x838]
call fcn.1400010b0
mov byte [rsp + 0x7f1], al
lea rcx, [rsp + 0x1c0]
call fcn.14003cdf0
nop
lea rcx, [rsp + 0x80]
call fcn.14003a260
nop
lea rcx, [rsp + 0x68]
call fcn.140033e30
mov al, byte [rsp + 0x7f1]
mov rcx, qword [rsp + 0x810]
xor rcx, rsp
call fcn.14000fd20
add rsp, 0x820
pop rbx
ret