Function at 0x14000be70
Capabilities:
Patch process command line

Disassembly:
jmp 0x14000be70
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x3b8]
sub rsp, 0x490
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov r15, rdx
mov r14, rcx
xor ebx, ebx
mov dword [rsp + 0x34], ebx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x14000bee0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cannot_get_handle_to_ntdll.dll
call fcn.140002f27
lea rdx, str.NtQueryInformationProcess
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x30], ebx
je 0x14000bf19
lea rcx, str.Cannot_fetch_current_directory_for_WoW64_process
call fcn.140001091
mov qword [rsp + 0x20], rbx
mov r9d, 0x30
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, r15
call rdi
test eax, eax
jns 0x14000bfd0
mov edx, eax
lea rcx, [rbp + 0x260]
call fcn.140003c92
nop
mov r8, rax
lea rdx, str.NtQueryInformationProcess_failed_to_fetch_ProcessBasicInformation
lea rcx, [rbp + 0x240]
call fcn.140004511
nop
cmp qword [rax + 0x18], 8
jb 0x14000bf68
mov rax, qword [rax]
mov rcx, rax
call fcn.140001091
nop
mov r8, qword [rbp + 0x258]
cmp r8, 8
jb 0x14000bf94
inc r8
mov rdx, qword [rbp + 0x240]
lea rcx, [rbp + 0x240]
call fcn.14000452a
mov qword [rbp + 0x258], 7
mov qword [rbp + 0x250], rbx
mov word [rbp + 0x240], bx
mov r8, qword [rbp + 0x278]
cmp r8, 8
jb 0x14000bfd0
inc r8
mov rdx, qword [rbp + 0x260]
lea rcx, [rbp + 0x260]
call fcn.14000452a
mov qword [rsp + 0x20], rbx
mov r9d, 0x2c8
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x14000c006
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_read_PROCESS_BASIC_INFORMATION.PebBaseAddress
call fcn.140002f27
mov qword [rsp + 0x20], rbx
mov r9d, 0x80
lea r8, [rbp + 0x300]
mov rdx, qword [rbp - 0x70]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x14000c03d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_read_PEB.ProcessParameters
call fcn.140002f27
movups xmm0, xmmword [rbp + 0x338]
movups xmmword [rbp + 0x240], xmm0
movq rcx, xmm0
test cx, cx
je 0x14000c074
mov rax, rcx
shr rax, 0x10
test ax, ax
je 0x14000c074
cmp cx, ax
jae 0x14000c074
mov edx, 0x2000
cmp ax, dx
jbe 0x14000c205
shr rcx, 0x10
movzx edx, cx
lea rcx, [rbp + 0x2e0]
call fcn.140003b8e
mov rdi, rax
movzx edx, word [rbp + 0x240]
lea rcx, [rbp + 0x260]
call fcn.140003b8e
nop
mov r8, rax
lea rdx, str.Bad_current_directory:_Length
lea rcx, [rbp + 0x2c0]
call fcn.140004511
nop
lea r8, str.__MaximumLength
mov rdx, rax
lea rcx, [rbp + 0x2a0]
call fcn.1400031a2
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x280]
call fcn.140001aaf
nop
cmp qword [rax + 0x18], 8
jb 0x14000c0e9
mov rax, qword [rax]
mov rcx, rax
call fcn.140001091
nop
mov r8, qword [rbp + 0x298]
cmp r8, 8
jb 0x14000c115
inc r8
mov rdx, qword [rbp + 0x280]
lea rcx, [rbp + 0x280]
call fcn.14000452a
mov qword [rbp + 0x298], 7
mov qword [rbp + 0x290], rbx
mov word [rbp + 0x280], bx
mov r8, qword [rbp + 0x2b8]
cmp r8, 8
jb 0x14000c151
inc r8
mov rdx, qword [rbp + 0x2a0]
lea rcx, [rbp + 0x2a0]
call fcn.14000452a
mov qword [rbp + 0x2b8], 7
mov qword [rbp + 0x2b0], rbx
mov word [rbp + 0x2a0], bx
mov r8, qword [rbp + 0x2d8]
cmp r8, 8
jb 0x14000c18d
inc r8
mov rdx, qword [rbp + 0x2c0]
lea rcx, [rbp + 0x2c0]
call fcn.14000452a
mov qword [rbp + 0x2d8], 7
mov qword [rbp + 0x2d0], rbx
mov word [rbp + 0x2c0], bx
mov r8, qword [rbp + 0x278]
cmp r8, 8
jb 0x14000c1c9
inc r8
mov rdx, qword [rbp + 0x260]
lea rcx, [rbp + 0x260]
call fcn.14000452a
mov qword [rbp + 0x278], 7
mov qword [rbp + 0x270], rbx
mov word [rbp + 0x260], bx
mov r8, qword [rbp + 0x2f8]
cmp r8, 8
jb 0x14000c205
inc r8
mov rdx, qword [rbp + 0x2e0]
lea rcx, [rbp + 0x2e0]
call fcn.14000452a
movzx edi, word [rbp + 0x242]
mov edx, edi
shr rdx, 1
inc rdx
mov eax, 2
mul rdx
mov r12, 0xffffffffffffffff
cmovo rax, r12
mov rcx, rax
call fcn.140002aa4
mov rsi, rax
mov qword [rsp + 0x20], rbx
mov r9d, edi
mov r8, rax
mov rdx, qword [rbp + 0x248]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x14000c26d
mov rcx, rsi
call fcn.1400012cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_read_ProcessParameters.CurrentDirectory
call fcn.140002f27
mov qword [r14 + 0x18], 7
mov qword [r14 + 0x10], rbx
mov word [r14], bx
cmp word [rsi], 0
je 0x14000c290
mov rbx, r12
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x14000c286
mov r8, rbx
mov rdx, rsi
mov rcx, r14
call fcn.14000346d
mov rcx, rsi
call fcn.1400012cb
mov rax, r14
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.140003cb0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret