Function at 0x1400aac80
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
xor ebx, ebx
or rbp, 0xffffffffffffffff
mov r15, r9
mov r12, r8
mov rax, rdx
mov r13, rcx
mov esi, ebx
test rdx, rdx
je 0x1400aacd7
mov rdx, rbp
nop dword [rax + rax]
inc rdx
cmp word [rax + rdx*2], bx
jne 0x1400aacc0
add rdx, rdx
mov rcx, rax
call sym.ProcessHacker.exe_PhCreateStringEx
mov rsi, rax
mov r14d, dword [rsp + 0x148]
mov edi, ebx
movzx eax, r14b
mov ecx, 0x400
and al, 2
cmovne edi, ecx
test r14b, 4
je 0x1400aacf8
or edi, 4
test r14b, 8
je 0x1400aad02
bts edi, 0x18
test r14b, 0x10
je 0x1400aad0b
or edi, 0x10
mov rax, qword [rsp + 0x140]
test rax, rax
je 0x1400aad6f
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x80], xmm0
movups xmm0, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x90], xmm1
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rsp + 0xa0], xmm0
movups xmm0, xmmword [rax + 0x40]
movaps xmmword [rsp + 0xb0], xmm1
movups xmm1, xmmword [rax + 0x50]
movaps xmmword [rsp + 0xc0], xmm0
movsd xmm0, qword [rax + 0x60]
movsd qword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm1
jmp 0x1400aad8d
xor edx, edx
lea rcx, [rsp + 0x80]
lea r8d, [rdx + 0x68]
call fcn.1400e3c20
mov dword [rsp + 0x80], 0x68
mov rcx, qword [rsp + 0x150]
test rcx, rcx
jne 0x1400aade7
test rsi, rsi
je 0x1400aada5
mov rdx, qword [rsi + 8]
jmp 0x1400aada8
mov rdx, rbx
lea rax, [rsp + 0x60]
and r14d, 1
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rcx, r13
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x1400aae34
test rsi, rsi
je 0x1400aadf2
mov r8, qword [rsi + 8]
jmp 0x1400aadf5
mov r8, rbx
lea rax, [rsp + 0x60]
and r14d, 1
mov qword [rsp + 0x50], rax
xor r9d, r9d
lea rax, [rsp + 0x80]
mov rdx, r13
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x1400aae4f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1400aae46
mov ebx, eax
jmp 0x1400aae4f
movzx ebx, ax
or ebx, 0xc0070000
test rsi, rsi
je 0x1400aae67
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], ebp
cmp ebp, 1
jne 0x1400aae67
call fcn.1400ae580
test ebx, ebx
js 0x1400aaec6
mov rcx, qword [rsp + 0x158]
test rcx, rcx
je 0x1400aae87
mov eax, dword [rsp + 0x70]
mov qword [rcx], rax
mov eax, dword [rsp + 0x74]
mov qword [rcx + 8], rax
mov rcx, qword [rsp + 0x160]
test rcx, rcx
je 0x1400aae9e
mov rax, qword [rsp + 0x60]
mov qword [rcx], rax
jmp 0x1400aaea9
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x68]
test rax, rax
je 0x1400aaec0
mov qword [rax], rcx
jmp 0x1400aaec6
call qword [sym.imp.ntdll.dll_NtClose]
lea r11, [rsp + 0xf0]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret