Function at 0x70dbc0
Capabilities:
Create process on windows
Resume thread

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1a8
xor eax, eax
mov r15, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, dword [rsp + 0x250]
mov r14d, dword [rsp + 0x240]
movzx ebx, bl
lea r13, [rsp + 0xa0]
mov r12, rcx
mov ecx, 0xd
mov rbp, r9
mov rdi, r13
mov qword [rsp + 0x1f8], rdx
rep stosq qword [rdi], rax
mov ecx, 0xfffffff6
mov qword [rsp + 0x200], r8
mov qword [rsp + 0x50], 0xffffffffffffffff
mov qword [rsp + 0x58], 0xffffffffffffffff
mov qword [rsp + 0x60], 0xffffffffffffffff
mov qword [rsp + 0x68], 0xffffffffffffffff
mov qword [rsp + 0x70], 0xffffffffffffffff
mov qword [rsp + 0x78], 0xffffffffffffffff
mov dword [rsp + 0xa0], 0x68
mov dword [rsp + 0xdc], 0x100
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
call r15
mov ecx, 0xfffffff5
mov rsi, rax
call r15
mov ecx, 0xfffffff4
mov rdi, rax
call r15
mov dword [rsp + 0x38], ebx
lea r9, [rsp + 0x58]
mov rdx, rbp
mov dword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
mov r15, rax
lea rcx, [rsp + 0xf0]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
call fcn.0070d9c0
test al, al
je 0x70de68
mov dword [rsp + 0x38], ebx
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x210]
mov dword [rsp + 0x30], 1
lea rcx, [rsp + 0xf8]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rdi
call fcn.0070d9c0
test al, al
je 0x70de68
mov dword [rsp + 0x38], ebx
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x218]
mov dword [rsp + 0x30], 1
lea rcx, [rsp + 0x100]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], r15
call fcn.0070d9c0
test al, al
je 0x70de68
mov edx, dword [rsp + 0x238]
and edx, 2
cmp rsi, rbp
sete al
and al, byte [rsp + 0x238]
cmp qword [rsp + 0xf0], rsi
je 0x70df10
cmp qword [rsp + 0xf8], rdi
je 0x70df10
cmp qword [rsp + 0x100], r15
je 0x70df10
test edx, edx
jne 0x70e0c0
test al, al
je 0x70e0f0
cmp rdi, qword [rsp + 0x210]
jne 0x70ddcf
xor esi, esi
mov eax, 0x8000400
cmp r15, qword [rsp + 0x218]
je 0x70dde0
mov eax, 0x8000400
mov esi, 1
nop dword [rax]
mov edx, eax
or edx, 8
test byte [rsp + 0x238], 4
cmovne eax, edx
mov edx, eax
or edx, 0x10
test byte [rsp + 0x238], 0x10
cmovne eax, edx
test r14b, r14b
jne 0x70df50
mov rdi, qword [rsp + 0x248]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea rdx, [rsp + 0x80]
mov qword [rdi], 0
mov rdi, qword [rsp + 0x1f8]
mov qword [rsp + 0x48], rdx
mov rdx, r12
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsp + 0x200]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x70e033
nop dword [rax]
mov rcx, qword [rsp + 0x50]
cmp rcx, 0xffffffffffffffff
je 0x70de79
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
cmp rcx, 0xffffffffffffffff
je 0x70de8a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
cmp rcx, 0xffffffffffffffff
je 0x70de9b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x70deac
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x70debd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x70dece
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x248], 0
je 0x70def4
test r14b, r14b
je 0x70def4
mov rax, qword [rsp + 0x248]
mov rcx, qword [rax]
test rcx, rcx
je 0x70def4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.012341f0
xor eax, eax
add rsp, 0x1a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov esi, 1
test al, al
je 0x70df37
cmp rdi, qword [rsp + 0x210]
jne 0x70e0b0
xor esi, esi
cmp r15, qword [rsp + 0x218]
jne 0x70e0b0
mov eax, 0x400
test edx, edx
je 0x70dde0
mov eax, 0x600
jmp 0x70dde0
or eax, 4
xor edx, edx
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov ecx, 0x12
mov r9d, 0x90
lea r8, [rsp + 0x110]
mov rbp, rax
mov rdi, r8
xor eax, eax
mov edx, 9
rep stosq qword [rdi], rax
mov rcx, rbp
mov dword [rsp + 0x120], 0x2000
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
je 0x70e100
mov rax, qword [rsp + 0x248]
mov qword [rax], rbp
test rbp, rbp
je 0x70de68
lea rax, [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x1f8]
mov rdx, r12
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x200]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x70de68
mov rax, qword [rsp + 0x248]
mov rcx, qword [rax]
test rcx, rcx
je 0x70e033
mov rdx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x70de68
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x88]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x50]
cmp rcx, 0xffffffffffffffff
je 0x70e051
call rbx
mov rcx, qword [rsp + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x70e05e
call rbx
mov rcx, qword [rsp + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x70e06b
call rbx
mov rax, qword [rsp + 0x220]
mov rdx, qword [rsp + 0x58]
mov qword [rax], rdx
mov rax, qword [rsp + 0x228]
mov rdx, qword [rsp + 0x60]
mov qword [rax], rdx
mov rax, qword [rsp + 0x230]
mov rdx, qword [rsp + 0x70]
mov qword [rax], rdx
mov rax, qword [rsp + 0x80]
jmp 0x70defb
mov esi, 1
jmp 0x70df37
test al, al
je 0x70e0e0
cmp r15, qword [rsp + 0x218]
jne 0x70e0e0
xor esi, esi
cmp rdi, qword [rsp + 0x210]
je 0x70df44
nop
mov esi, 1
jmp 0x70df44
mov esi, 1
mov eax, 0x8000400
jmp 0x70dde0
call fcn.012341f0
mov rax, qword [rsp + 0x248]
mov qword [rax], 0
jmp 0x70de68