Function at 0x1400aaf30
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
xor ebx, ebx
or rbp, 0xffffffffffffffff
mov r15, r9
mov r12, r8
mov rax, rdx
mov r13, rcx
mov esi, ebx
test rdx, rdx
je 0x1400aaf87
mov rdx, rbp
nop dword [rax + rax]
inc rdx
cmp word [rax + rdx*2], bx
jne 0x1400aaf70
add rdx, rdx
mov rcx, rax
call sym.ProcessJacker.exe_PhCreateStringEx
mov rsi, rax
mov r14d, dword [rsp + 0x148]
mov edi, ebx
movzx eax, r14b
mov ecx, 0x400
and al, 2
cmovne edi, ecx
test r14b, 4
je 0x1400aafa8
or edi, 4
test r14b, 8
je 0x1400aafb2
bts edi, 0x18
test r14b, 0x10
je 0x1400aafbb
or edi, 0x10
mov rax, qword [rsp + 0x140]
test rax, rax
je 0x1400ab01f
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x80], xmm0
movups xmm0, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x90], xmm1
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rsp + 0xa0], xmm0
movups xmm0, xmmword [rax + 0x40]
movaps xmmword [rsp + 0xb0], xmm1
movups xmm1, xmmword [rax + 0x50]
movaps xmmword [rsp + 0xc0], xmm0
movsd xmm0, qword [rax + 0x60]
movsd qword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm1
jmp 0x1400ab03d
xor edx, edx
lea rcx, [rsp + 0x80]
lea r8d, [rdx + 0x68]
call fcn.1400e43c0
mov dword [rsp + 0x80], 0x68
mov rcx, qword [rsp + 0x150]
test rcx, rcx
jne 0x1400ab097
test rsi, rsi
je 0x1400ab055
mov rdx, qword [rsi + 8]
jmp 0x1400ab058
mov rdx, rbx
lea rax, [rsp + 0x60]
and r14d, 1
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rcx, r13
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x1400ab0e4
test rsi, rsi
je 0x1400ab0a2
mov r8, qword [rsi + 8]
jmp 0x1400ab0a5
mov r8, rbx
lea rax, [rsp + 0x60]
and r14d, 1
mov qword [rsp + 0x50], rax
xor r9d, r9d
lea rax, [rsp + 0x80]
mov rdx, r13
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x1400ab0ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1400ab0f6
mov ebx, eax
jmp 0x1400ab0ff
movzx ebx, ax
or ebx, 0xc0070000
test rsi, rsi
je 0x1400ab117
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], ebp
cmp ebp, 1
jne 0x1400ab117
call fcn.1400ae900
test ebx, ebx
js 0x1400ab176
mov rcx, qword [rsp + 0x158]
test rcx, rcx
je 0x1400ab137
mov eax, dword [rsp + 0x70]
mov qword [rcx], rax
mov eax, dword [rsp + 0x74]
mov qword [rcx + 8], rax
mov rcx, qword [rsp + 0x160]
test rcx, rcx
je 0x1400ab14e
mov rax, qword [rsp + 0x60]
mov qword [rcx], rax
jmp 0x1400ab159
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x68]
test rax, rax
je 0x1400ab170
mov qword [rax], rcx
jmp 0x1400ab176
call qword [sym.imp.ntdll.dll_NtClose]
lea r11, [rsp + 0xf0]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret