Function at 0x140017ea8
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov rax, qword [0x1400f0020]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov r15, r8
mov rsi, rdx
mov r12, rcx
mov qword [rsp + 0x70], rcx
cmp dword [rdx + 0xa4], 5
je 0x140018912
mov eax, dword [rdx + 0xa0]
xor r13d, r13d
cmp eax, 2
jne 0x1400184fb
lea rbx, [rdx + 0xe0]
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140017f19
mov rdx, qword [rbx]
lea rcx, str.Waiting_on_process__ls
call fcn.140017a20
mov rdx, rbx
lea rcx, [rbp + 0x60]
call fcn.140024390
nop
mov qword [rbp + 0x50], r13
cmp qword [rbp + 0x70], r13
jne 0x140018001
mov edi, 7
mov qword [rbp + 0x58], rdi
mov word [rbp + 0x40], r13w
lea rdx, str.Warning
lea rcx, [rbp + 0x40]
call fcn.140006890
nop
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], rdi
mov word [rbp + 0x80], r13w
lea rdx, str.Please_select_executable_to_wait_for_n
lea rcx, [rbp + 0x80]
call fcn.140006890
nop
mov rax, qword [r12]
mov r9, qword [rax]
lea r8d, [rdi - 6]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.14001322c
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 8
jb 0x140017fc6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
call fcn.140008df4
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], rdi
mov word [rbp + 0x80], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x140017ff7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
call fcn.140008df4
mov ebx, 0xc0000225
jmp 0x1400183b5
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
lea r15, [rsi + 0x108]
mov rax, qword [r15 + 8]
cmp qword [r15], rax
jne 0x140018085
lea r8, [rbp + 0x60]
lea rcx, [rbp + 0x80]
call fcn.140031590
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
lea rdx, [rax + 8]
lea rcx, [rsp + 0x50]
cmp byte [rdx + 0x18], r13b
jne 0x140018049
lea rdx, [rbp - 0x80]
call fcn.14001b960
lea rdx, [rsp + 0x50]
mov rcx, r15
call fcn.14001ae40
lea rcx, [rsp + 0x50]
call fcn.14001add8
nop
lea rcx, [rbp - 0x80]
call fcn.14001add8
nop
cmp byte [rbp + 0xa0], r13b
je 0x140018085
lea rcx, [rbp + 0x88]
call fcn.14001add8
mov byte [rsi + 0x104], 1
mov r13, qword [rbp + 0x48]
movabs r9, 0x3ffffffffffffff
lea rbx, [rsi + 0x120]
mov rax, qword [rbx + 8]
cmp qword [rbx], rax
je 0x140018296
lea rax, [rbp + 0x40]
cmp r15, rax
je 0x140018230
mov rbx, r13
mov rax, qword [rbp + 0x40]
sub rbx, rax
sar rbx, 6
mov r12, qword [r15 + 8]
mov r14, qword [r15]
mov rdi, r12
sub rdi, r14
sar rdi, 6
cmp rbx, rdi
jbe 0x1400181fa
mov rdx, qword [r15 + 0x10]
mov rcx, rdx
sub rcx, r14
sar rcx, 6
cmp rbx, rcx
jbe 0x1400181b1
cmp rbx, r9
ja 0x14001893e
mov r8, rcx
shr r8, 1
mov rax, r9
sub rax, r8
cmp rcx, rax
ja 0x140018122
lea rax, [r8 + rcx]
cmp rax, rbx
cmovb rax, rbx
mov rbx, rax
xor edi, edi
test r14, r14
je 0x14001816a
cmp r14, r12
je 0x140018146
mov rcx, r14
call fcn.14001b76c
add r14, 0x40
cmp r14, r12
jne 0x14001812e
mov rdx, qword [r15 + 0x10]
mov r14, qword [r15]
sub rdx, r14
and rdx, 0xffffffffffffffc0
mov rcx, r14
call fcn.140008df4
mov qword [r15], rdi
mov qword [r15 + 8], rdi
mov qword [r15 + 0x10], rdi
movabs r9, 0x3ffffffffffffff
cmp rbx, r9
ja 0x140018944
shl rbx, 6
cmp rbx, 0x1000
jb 0x14001818a
mov rcx, rbx
call fcn.140009aa4
jmp 0x14001819c
test rbx, rbx
je 0x140018199
mov rcx, rbx
call fcn.14006a75c
jmp 0x14001819c
mov rax, rdi
mov qword [r15], rax
mov qword [r15 + 8], rax
add rax, rbx
mov qword [r15 + 0x10], rax
mov r14, qword [r15]
mov rax, qword [rbp + 0x40]
shl rdi, 6
add rdi, rax
mov r8, r14
mov rdx, rdi
mov rcx, rax
call fcn.14001c018
mov rbx, qword [r15 + 8]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], r15
jmp 0x1400181f3
mov rdx, rdi
mov rcx, rbx
call fcn.14001c52c
add rbx, 0x40
mov qword [rsp + 0x58], rbx
add rdi, 0x40
cmp rdi, r13
jne 0x1400181db
jmp 0x14001822c
shl rbx, 6
add rbx, r14
mov r8, r14
mov rdx, r13
mov rcx, rax
call fcn.14001c018
mov r14, qword [r15 + 8]
mov rdi, rbx
cmp rbx, r14
je 0x14001822c
mov rcx, rdi
call fcn.14001b76c
add rdi, 0x40
cmp rdi, r14
jne 0x14001821b
mov qword [r15 + 8], rbx
mov eax, dword [rsi + 0x100]
cmp eax, dword [rsi + 0xb0]
jae 0x1400183d7
inc eax
mov dword [rsi + 0x100], eax
mov r14, qword [rsi + 0x120]
mov rdi, qword [rsi + 0x128]
lea rbx, [r14 + 0x40]
cmp rbx, rdi
je 0x140018280
mov rdx, rbx
mov rcx, r14
call fcn.14001b668
add r14, 0x40
add rbx, 0x40
cmp rbx, rdi
jne 0x140018261
mov rdi, qword [rsi + 0x128]
lea rcx, [rdi - 0x40]
call fcn.14001b76c
add qword [rsi + 0x128], 0xffffffffffffffc0
jmp 0x140018382
lea r8, [rbp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.140031590
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x80], xmm0
and qword [rbp + 0x90], 0
lea rdx, [rax + 8]
lea rcx, [rsp + 0x50]
cmp byte [rdx + 0x18], 0
jne 0x1400182cd
lea rdx, [rbp + 0x80]
call fcn.14001b960
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x40]
call fcn.14001ae40
lea rcx, [rsp + 0x50]
call fcn.14001add8
nop
lea rcx, [rbp + 0x80]
call fcn.14001add8
nop
cmp byte [rbp - 0x40], 0
je 0x140018307
lea rcx, [rbp - 0x58]
call fcn.14001add8
mov rax, qword [rbx]
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rax
mov rdi, qword [r15]
mov rbx, qword [rbp + 0x40]
mov r14, qword [rsi + 0x110]
movaps xmm0, xmmword [rbp - 0x80]
movaps xmmword [rsp + 0x50], xmm0
mov r13, qword [rbp + 0x48]
cmp rbx, r13
je 0x140018364
cmp rdi, r14
je 0x14001835f
mov eax, dword [rdi]
cmp dword [rbx], eax
jae 0x140018350
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14001bc94
add rbx, 0x40
jmp 0x14001835a
ja 0x140018356
add rbx, 0x40
add rdi, 0x40
cmp rbx, r13
jne 0x140018332
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
jmp 0x14001837d
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14001bc94
add rbx, 0x40
cmp rbx, r13
jne 0x14001836c
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rsi + 0x104], 0
jne 0x140018090
lea rcx, str.Process_wait_canceled_by_user
call fcn.140017994
mov ebx, 0xc0000240
lea rcx, [rbp + 0x40]
call fcn.14001add8
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x1400183d0
mov rcx, qword [rbp + 0x60]
lea rdx, [rdx*2 + 2]
call fcn.140008df4
mov eax, ebx
jmp 0x140018914
mov rdi, qword [rsi + 0x120]
mov eax, dword [rdi]
mov dword [rsi + 0xc0], eax
mov r14, qword [rsi + 0x128]
lea rbx, [rdi + 0x40]
cmp rbx, r14
je 0x140018415
mov rdx, rbx
mov rcx, rdi
call fcn.14001b668
add rdi, 0x40
add rbx, 0x40
cmp rbx, r14
jne 0x1400183f6
mov r14, qword [rsi + 0x128]
lea rcx, [r14 - 0x40]
call fcn.14001b76c
add qword [rsi + 0x128], 0xffffffffffffffc0
mov edx, dword [rsi + 0xc0]
lea rcx, str.Got_process__d
call fcn.140017aac
nop
lea rcx, [rbp + 0x40]
call fcn.14001add8
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x14001845e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
call fcn.140008df4
xor r13d, r13d
mov r12, qword [rsp + 0x70]
cmp dword [rsi + 0xa4], 2
jae 0x140018912
cmp dword [rsi + 0xa0], 1
je 0x140018912
lea r14, [r12 + 8]
cmp byte [rsi + 0xb8], r13b
je 0x1400187a2
lea rcx, str.Escalating_process_handle_access
call fcn.140017a20
mov r8d, 0x1000
mov edx, dword [rsi + 0xc0]
mov rcx, r14
call fcn.140031100
mov ebx, eax
test eax, eax
js 0x1400184e8
call fcn.14001333c
mov rdi, rax
mov rbx, qword [r12 + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, 0x1d7b
mov r8, rbx
mov edx, eax
mov rcx, rdi
call fcn.140025db0
mov ebx, eax
test eax, eax
jns 0x1400187bc
mov edx, ebx
lea rcx, str.Failed_to_escalate_process_handle_access__status_0x_X
call fcn.14001787c
jmp 0x1400187d7
cmp eax, 1
jne 0x140018466
xor edx, edx
lea r8d, [rax + 0x63]
lea rcx, [rbp - 0x2c]
call fcn.140089280
mov dword [rbp - 0x30], 0x68
lea rdi, [rsi + 0x38]
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x14001852b
mov r8, qword [rdi]
lea rbx, [rsi + 0xe0]
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14001853f
mov rdx, qword [rbx]
lea rcx, str.Creating_new_process__ls_with_arguments__ls
call fcn.140017a20
mov rdx, rbx
lea rcx, [rbp + 0x60]
call fcn.1400246b0
cmp qword [rax + 0x18], 8
jb 0x140018561
mov rax, qword [rax]
cmp qword [rdi + 0x18], 8
jb 0x14001856b
mov rdi, qword [rdi]
cmp qword [rbx + 0x18], 8
jb 0x140018575
mov rbx, qword [rbx]
mov qword [rsp + 0x48], r15
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
sete bl
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x1400185cc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
call fcn.140008df4
test bl, bl
je 0x1400186cc
mov qword [rbp + 0x70], r13
mov edi, 7
mov qword [rbp + 0x78], rdi
mov word [rbp + 0x60], r13w
lea rdx, [0x1400d0430]
lea rcx, [rbp + 0x60]
call fcn.140006890
nop
mov rax, qword gs:[0x30]
mov edx, dword [rax + 0x1250]
lea rcx, [rbp + 0x40]
call fcn.1400250a0
nop
mov r8, rax
lea rdx, str.Failed_to_create_new_process._n
lea rcx, [rbp + 0x80]
call fcn.140016060
nop
mov rcx, qword [r12]
mov r9, qword [rcx]
xor r8d, r8d
lea rdx, [rbp + 0x60]
mov rcx, rax
call fcn.14001322c
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 8
jb 0x14001865f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
call fcn.140008df4
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], rdi
mov word [rbp + 0x80], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x140018690
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
call fcn.140008df4
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], rdi
mov word [rbp + 0x40], r13w
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x1400186b8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
call fcn.140008df4
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
jmp 0x140018914
lea r14, [r12 + 8]
cmp byte [rsi + 0xb8], r13b
je 0x14001872a
lea rcx, [0x1400d0358]
call fcn.140017a20
mov r8d, 0x1000
mov edx, dword [r15 + 0x10]
mov rcx, r14
call fcn.140031100
mov ebx, eax
test eax, eax
js 0x14001878f
call fcn.14001333c
mov rdi, rax
mov rbx, qword [r12 + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, 0x1d7b
mov r8, rbx
mov edx, eax
mov rcx, rdi
call fcn.140025db0
jmp 0x14001873c
mov r8d, 0xd7b
mov edx, dword [r15 + 0x10]
mov rcx, r14
call fcn.140031100
mov ebx, eax
test eax, eax
js 0x14001878f
mov rcx, r14
call fcn.140031320
cmp dword [rsi + 0xa4], 2
jb 0x140018783
mov eax, dword [r15 + 0x10]
mov dword [rsi + 0xc0], eax
mov rcx, r14
call fcn.1400311f0
cmp dword [rsi + 0xa4], 3
jne 0x140018783
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [rsi + 0xb4], r13b
jmp 0x140018466
mov edx, ebx
lea rcx, str.Failed_to_attach_to_process__status_0x_X
call fcn.14001787c
jmp 0x1400183d0
mov r8d, 0xd7b
mov edx, dword [rsi + 0xc0]
mov rcx, r14
call fcn.140031100
mov ebx, eax
test eax, eax
js 0x1400187cf
mov rcx, r14
call fcn.1400313d0
test al, al
jne 0x1400187cf
mov ebx, 0xc000010a
jmp 0x1400187d7
test ebx, ebx
je 0x14001889f
mov edx, ebx
lea rcx, [rbp + 0x80]
call fcn.1400250a0
nop
mov r8, rax
lea rdx, str.Can_not_attach_to_the_process._n
lea rcx, [rbp + 0x40]
call fcn.140016060
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 8
jb 0x14001881b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
call fcn.140008df4
mov qword [rbp + 0x90], r13
mov edi, 7
mov qword [rbp + 0x98], rdi
mov word [rbp + 0x80], r13w
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], rdi
mov word [rbp + 0x60], r13w
lea rdx, [0x1400d0550]
lea rcx, [rbp + 0x60]
call fcn.140006890
nop
mov rax, qword [r12]
mov r9, qword [rax]
xor r8d, r8d
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x40]
call fcn.14001322c
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x140018888
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
call fcn.140008df4
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x1400183d0
mov rcx, qword [rbp + 0x40]
jmp 0x1400183c3
mov rbx, qword [r12 + 0x18]
xor edx, edx
cmp byte [rbx + 0x15], r13b
je 0x1400188da
mov r8d, 0x250
lea rcx, [rbp + 0xb0]
call fcn.140089280
mov rax, qword [rbx]
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call qword [rax + 0x80]
cmp dword [rbp + 0xbc], r13d
jmp 0x140018903
mov r8d, 0x388
lea rcx, [rbp + 0xb0]
call fcn.140089280
mov rax, qword [rbx]
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call qword [rax + 0x78]
cmp qword [rbp + 0xc8], r13
setne al
test al, al
jne 0x140018912
mov rcx, r14
call fcn.140031320
xor eax, eax
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.14006a730
mov rbx, qword [rsp + 0x5a8]
add rsp, 0x550
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400091c0
nop
call fcn.1400011a0
int3