Function at 0x1400226b4
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rbx, rdx
or rsi, 0xffffffffffffffff
lea rdx, str.EvaluateApplicability
mov rcx, r8
mov r14d, esi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
xor edi, edi
test eax, eax
jne 0x140022dfb
lea r8d, [rsi + 5]
mov rcx, rbx
lea rdx, str.Path
call fcn.140014c40
mov r15, rax
test rax, rax
je 0x140022e38
lea r8d, [rsi + 9]
mov rcx, rbx
lea rdx, str.ProcName
call fcn.140014c40
mov r14, rax
test rax, rax
je 0x140022e38
lea r8d, [rsi + 0xa]
mov rcx, rbx
lea rdx, str.ContextId
call fcn.140014c40
mov qword [rbp - 0x70], rax
call fcn.140001b5c
test rax, rax
je 0x140022e47
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rdx, [rsp + 0x50]
xor ecx, ecx
add rax, 0x18
mov qword [rsp + 0x50], rax
call fcn.14001bfb4
test eax, eax
jne 0x140022e19
lea r8d, [rsi + 6]
mov rcx, rbx
lea rdx, str.Flags
call fcn.140014c40
lea r12, [0x140063614]
test rax, rax
je 0x1400227be
cmp qword [rax + 8], rdi
lea r8d, [rsi + 0xb]
mov rcx, r12
cmovne rcx, qword [rax + 8]
xor edx, edx
call qword [sym.imp.msvcrt.dll_strtoul]
mov dword [rbp + 0x78], eax
jmp 0x1400227c1
mov dword [rbp + 0x78], edi
mov r8d, 7
lea rdx, str.Wow6432
mov rcx, rbx
call fcn.140014c40
test rax, rax
je 0x140022855
cmp qword [rax + 8], rdi
lea rdx, str.true
mov rcx, r12
cmovne rcx, qword [rax + 8]
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140022855
mov rbx, qword [rsp + 0x50]
lea edx, [rax + 0x5c]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
jne 0x140022811
mov eax, esi
jmp 0x140022817
sub rax, rbx
sar rax, 1
lea ecx, [rax + 1]
test ecx, ecx
js 0x140022e3c
cmp ecx, dword [rbx - 0xc]
jg 0x140022e3c
cdqe
lea rdx, [0x14005bd90]
mov dword [rbx - 0x10], ecx
mov word [rbx + rax*2 + 2], di
mov rax, rsi
inc rax
cmp word [rdx + rax*2], di
jne 0x14002283f
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.140019f84
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.14002d080
test eax, eax
je 0x140022e1e
mov r13, rdi
mov rsi, rdi
call fcn.140001b5c
mov rcx, rax
test rax, rax
je 0x140022e47
mov rax, qword [rax]
call qword [rax + 0x18]
mov rcx, qword [r14 + 8]
xor r8d, r8d
add rax, 0x18
mov qword [rsp + 0x58], rax
test rcx, rcx
je 0x1400228a2
mov rax, qword [r14 + 0x18]
jmp 0x1400228a5
mov rax, r8
test rcx, rcx
mov rdx, r12
mov r8d, eax
cmovne rdx, rcx
lea rcx, [rbp - 0x78]
call fcn.14001d36c
mov rcx, qword [r15 + 8]
xor r8d, r8d
mov r14, qword [rax]
test rcx, rcx
je 0x1400228d0
mov rax, qword [r15 + 0x18]
jmp 0x1400228d3
mov rax, r8
test rcx, rcx
mov rdx, r12
mov r8d, eax
cmovne rdx, rcx
lea rcx, [rbp - 0x80]
call fcn.14001d36c
mov ecx, dword [rbp + 0x78]
lea rdx, str.__s___ProxyCall__EvaluateApplicability___s____s___d
mov dword [rsp + 0x28], ecx
mov r8, rbx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], r14
mov r9, qword [rax]
call fcn.14001aa6c
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
xor r14d, r14d
test eax, eax
jg 0x140022931
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp - 0x78]
mov eax, ebx
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14002294f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r15, qword [rbp - 0x70]
mov eax, 1
test r15, r15
je 0x140022a86
mov qword [rsp + 0x28], r14
lea r8d, [rax + 3]
xor r9d, r9d
mov dword [rsp + 0x20], 0x400000
lea rdx, [rbp - 0x68]
mov dword [rbp - 0x68], 0x18
mov rcx, rbx
mov qword [rbp - 0x60], r14
mov dword [rbp - 0x58], eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r13, rax
test rax, rax
je 0x140022a86
xor r9d, r9d
mov qword [rsp + 0x20], 0x400000
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, qword [rbp + 0x60]
mov rsi, rax
test rax, rax
je 0x140022a8a
mov rcx, qword [rbx + 0x20]
lea rdx, str.upd:Update
add rcx, 0x18
mov r8d, 0xa
call fcn.14001565c
test rax, rax
je 0x140022a56
mov r8d, 0x11
lea rdx, str.by360:ContextRoot
mov rcx, rax
call fcn.14001565c
test rax, rax
je 0x140022a56
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x140022a10
mov r8, qword [r15 + 0x18]
jmp 0x140022a13
mov r8, r14
test rcx, rcx
mov rdx, r12
cmovne rdx, rcx
mov rcx, rax
call fcn.14001565c
mov rdi, rax
test rax, rax
je 0x140022a56
mov rax, qword [rax + 8]
test rax, rax
je 0x140022a3c
mov rcx, qword [rdi + 0x18]
jmp 0x140022a3f
mov rcx, r14
test rax, rax
mov r8d, ecx
mov rdx, r12
mov rcx, rsi
cmovne rdx, rax
call fcn.14001ace8
jmp 0x140022a5e
mov rcx, rsi
call fcn.14001acc8
test al, al
jne 0x140022a70
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rsi, r14
jmp 0x140022a8a
mov r8, r13
lea rdx, [0x140064358]
lea rcx, [rsp + 0x58]
call fcn.14001afac
jmp 0x140022a8a
mov rbx, qword [rbp + 0x60]
xor edx, edx
mov dword [rbp - 0x50], 0x68
lea rcx, [rbp - 0x48]
lea r8d, [rdx + 0x60]
call sub.msvcrt.dll_memset
xor eax, eax
mov word [rbp - 0x10], r14w
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x58]
mov dword [rbp - 0x14], 0x101
cmp dword [rax - 8], 1
jle 0x140022ad5
mov edx, dword [rax - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140001fb0
mov rdx, qword [rsp + 0x58]
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140022b5b
mov rcx, qword [rsp + 0x68]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x68]
lea rdx, [rbp + 0x78]
mov dword [rbp + 0x78], 0x80004005
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x70]
call qword [fcn.140037368]
mov rcx, qword [rsp + 0x68]
call qword [fcn.140037368]
mov eax, dword [rbp + 0x78]
jmp 0x140022b60
call fcn.14001b570
cmp eax, 0x600f0001
je 0x140022b78
or r14d, 0xffffffff
cmp eax, 0x600f0002
lea eax, [r14 + 2]
cmove r14d, eax
xor eax, eax
test rsi, rsi
je 0x140022daf
cmp dword [rsi + 8], eax
je 0x140022da6
cmp dword [rsi + 4], 0x3ffff4
ja 0x140022da6
call fcn.140001b5c
test rax, rax
je 0x140022e47
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rdx, [rsp + 0x60]
mov rcx, rsi
add rax, 0x18
mov qword [rsp + 0x60], rax
call fcn.14001ad48
xor r9d, r9d
test rdi, rdi
jne 0x140022cfc
mov rcx, qword [rbx + 0x20]
lea r8d, [r9 + 0xa]
add rcx, 0x18
lea rdx, str.upd:Update
call fcn.14001565c
mov rdi, rax
test rax, rax
je 0x140022c47
mov rcx, qword [rbx + 0x20]
lea rdx, str.by360:ContextRoot
add rcx, 0x18
mov r8d, 0x11
call fcn.14001565c
xor r9d, r9d
mov rbx, rax
test rax, rax
jne 0x140022c81
mov rcx, qword [rbp + 0x60]
lea r8, str.by360:ContextRoot
mov qword [rsp + 0x28], r9
lea edx, [rax + 1]
mov qword [rsp + 0x20], r9
mov rcx, qword [rcx + 0x20]
sub rcx, 0xffffffffffffff80
call fcn.1400107a0
xor r9d, r9d
mov rbx, rax
test rax, rax
jne 0x140022c55
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
jmp 0x140022d90
cmp qword [rdi + 0x38], r9
je 0x140022c6d
mov rax, qword [rdi + 0x40]
mov qword [rbx + 0x58], rax
mov rax, qword [rdi + 0x40]
mov qword [rax + 0x60], rbx
jmp 0x140022c75
mov qword [rax + 0x58], r9
mov qword [rdi + 0x38], rbx
mov qword [rdi + 0x40], rbx
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x60], r9
mov rax, qword [r15 + 8]
test rax, rax
je 0x140022c90
mov rdx, qword [r15 + 0x18]
jmp 0x140022c93
mov rdx, r9
mov r15, qword [rbp + 0x60]
test rax, rax
mov qword [rsp + 0x28], r9
mov r8, r12
cmovne r8, rax
mov qword [rsp + 0x20], rdx
xor r9d, r9d
mov rcx, qword [r15 + 0x20]
sub rcx, 0xffffffffffffff80
lea edx, [r9 + 1]
call fcn.1400107a0
xor r9d, r9d
mov rdi, rax
test rax, rax
je 0x140022c47
cmp qword [rbx + 0x38], r9
je 0x140022ce6
mov rax, qword [rbx + 0x40]
mov qword [rdi + 0x58], rax
mov rax, qword [rbx + 0x40]
mov qword [rax + 0x60], rdi
jmp 0x140022cee
mov qword [rax + 0x58], r9
mov qword [rbx + 0x38], rdi
mov qword [rbx + 0x40], rdi
mov qword [rdi + 0x20], rbx
mov qword [rdi + 0x60], r9
jmp 0x140022d00
mov r15, qword [rbp + 0x60]
mov rax, qword [rdi + 0x38]
jmp 0x140022d0e
mov qword [rax + 0x20], r9
mov rax, qword [rax + 0x60]
test rax, rax
jne 0x140022d06
mov rax, qword [rdi + 8]
mov qword [rdi + 0x38], r9
test rax, rax
je 0x140022d26
mov rcx, qword [rdi + 0x18]
jmp 0x140022d29
mov rcx, r9
mov rbx, qword [rsp + 0x60]
movsxd rdx, dword [rbx - 0x10]
mov r8, rdx
cmp rcx, rdx
jb 0x140022d65
test rax, rax
mov rdx, rbx
cmovne r12, rax
mov rcx, r12
call sub.msvcrt.dll_memcpy
movsxd rax, dword [rbx - 0x10]
xor r8d, r8d
mov byte [rax + r12], r8b
movsxd rax, dword [rbx - 0x10]
mov qword [rdi + 0x18], rax
mov qword [rdi + 8], r12
jmp 0x140022d8c
mov rcx, qword [r15 + 0x20]
lea eax, [rdx + 1]
movsxd r8, eax
sub rcx, 0xffffffffffffff80
mov rdx, rbx
call fcn.14002d6e0
test rax, rax
je 0x140022d8c
movsxd rcx, dword [rbx - 0x10]
mov qword [rdi + 0x18], rcx
mov qword [rdi + 8], rax
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140022da6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test r13, r13
je 0x140022dbd
mov rcx, r13
call qword [fcn.140037368]
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140022ddc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140022dfb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, r14d
mov rbx, qword [rsp + 0x168]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x50]
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140022e38
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, esi
jmp 0x140022dfe
mov ecx, 0x80070057
call fcn.140002198
int3
mov ecx, 0x80004005
call fcn.140002198
int3