Function at 0x140008680
Capabilities:
Get common file path
Resume thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x730
movaps xmmword [rsp + 0x720], xmm6
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14004b3b8]
xor rax, rsp
mov qword [rsp + 0x718], rax
lea r14, [rsp + 0x510]
mov r8d, 0x208
mov rcx, r14
xor edx, edx
call fcn.140010db0
lea r15, [rsp + 0x300]
mov r8d, 0x208
mov rcx, r15
xor edx, edx
call fcn.140010db0
mov ecx, 0x104
mov rdx, r15
call qword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea rdx, [0x140040c28]
mov rcx, r15
xor r8d, r8d
mov r9, r14
call qword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
mov rcx, r14
mov rdx, rsi
mov r8d, ebx
call fcn.1400096f0
mov rbx, rax
inc rax
cmp rax, 1
ja 0x140008732
lea rcx, [0x14004c7b0]
lea rdx, str.Creating_transacted_section_has_failed__n
jmp 0x140008980
lea r14, [rsp + 0xf0]
mov r8d, 0x208
mov rcx, r14
xor edx, edx
call fcn.140010db0
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
call fcn.140009a30
mov edx, 0x104
mov rcx, r14
call fcn.140020424
mov r15, rax
xorps xmm6, xmm6
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x70], 0
lea rcx, [0x14004006f]
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
lea rdx, str.CreateProcessInternalW
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x14004c438], rax
test rax, rax
je 0x140008952
test r15, r15
cmove r14, r15
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
mov qword [rsp + 0xe0], 0
mov dword [rsp + 0x80], 0x68
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x800000c
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor ecx, ecx
xor edx, edx
mov r8, rdi
xor r9d, r9d
call rax
test eax, eax
je 0x14000893e
lea rcx, [0x14004c7b0]
lea rdx, str.Created_Process__PID:
call fcn.1400034e0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x200
mov dword [rax + rcx + 0x18], edx
mov edx, dword [rsp + 0x70]
mov rcx, rax
call fcn.1400089b0
lea rdx, [0x140040afb]
mov rcx, rax
call fcn.1400034e0
mov rcx, qword [rsp + 0x60]
mov rdx, rbx
call fcn.140008250
test rax, rax
je 0x140008962
mov rdi, rax
mov rcx, rsi
call fcn.1400096b0
xor al, 1
lea r8, [rsp + 0x60]
mov rcx, rsi
mov rdx, rdi
mov r9d, eax
call fcn.140009470
test al, al
je 0x140008972
lea rcx, [0x14004c7b0]
lea rdx, str.Resuming__PID
call fcn.1400034e0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x200
mov dword [rax + rcx + 0x18], edx
mov edx, dword [rsp + 0x70]
mov rcx, rax
call fcn.1400089b0
mov rcx, rax
call fcn.140003be0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.DLL_ResumeThread]
mov sil, 1
jmp 0x140008987
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rcx, str._ERROR__CreateProcessInternalW_failed__Error___x_n
mov edx, eax
call fcn.140001450
lea rcx, [0x14004c680]
lea rdx, str.Creating_process_failed__n
jmp 0x140008980
lea rcx, [0x14004c680]
lea rdx, str.Failed_mapping_the_buffer__n
jmp 0x140008980
lea rcx, [0x14004c680]
lea rdx, str.Failed_to_redirect__n
call fcn.1400034e0
xor esi, esi
mov rcx, qword [rsp + 0x718]
xor rcx, rsp
call fcn.140009f90
mov eax, esi
movaps xmm6, xmmword [rsp + 0x720]
add rsp, 0x730
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret