Function at 0x140007dc0
Capabilities:
Create thread
Get common file path
Inject thread

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x438
mov esi, ecx
mov rbx, rdx
call fcn.140001730
cmp esi, 3
je 0x140007dff
lea rcx, str.Example_Usage:_n
call fcn.140001450
lea rcx, str.adopt.exe_explorer.exe_C:windows_system32cmd.exe
call fcn.140001450
jmp 0x1400080d1
lea r15, [rsp + 0x228]
mov rsi, qword [rbx + 0x10]
mov ecx, 0x104
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rdx, qword [rbx + 8]
mov r8d, 0xff
lea rbx, [rsp + 0x129]
mov rcx, rbx
call sub.msvcrt.dll_wcstombs
mov rcx, rbx
call fcn.1400014f1
lea rcx, str.____Target_pid_is__d_n
mov edx, eax
mov dword [rsp + 0x48], eax
call fcn.140001450
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.dbghelp.dll_SymInitialize]
lea rcx, str.SymInitialize
test eax, eax
je 0x140007e99
mov rdx, qword [rsp + 0x48]
lea rcx, str.shell32.dll
call fcn.140001566
test al, al
jne 0x140007e9e
lea rcx, str.LoadSymbolModule_shell32.dll
call fcn.1400014a3
xor eax, eax
lea rdi, [rsp + 0x64]
mov ecx, 0x15
mov dword [rsp + 0x60], 0x58
rep stosd dword [rdi], eax
lea r8, [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
lea rdx, str.ShellExecuteExW
call qword [sym.imp.dbghelp.dll_SymFromName]
test eax, eax
je 0x140007eda
cmp qword [rsp + 0x98], 0
jne 0x140007ee6
lea rcx, str.SymFromName_ShellExecuteExW
call fcn.1400014cc
mov r14, qword [rsp + 0x98]
lea rcx, str.____ShellExecuteExW_is_at__p_n
mov rdx, r14
call fcn.140001450
mov dword [rsp + 0x20], 4
mov rcx, qword [rsp + 0x48]
xor edx, edx
mov r13, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, 0x3000
mov r8d, 0xff
call r13
mov rbx, rax
test rax, rax
jne 0x140007f36
lea rcx, str.VirtualAllocEx
jmp 0x140007e99
lea r12, [rsp + 0x5c]
mov rcx, qword [rsp + 0x48]
mov r8, rsi
mov rdx, rax
mov qword [rsp + 0x20], r12
mov rbp, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 0xff
call rbp
test eax, eax
jne 0x140007f6a
lea rcx, str.WriteProcessMemory
jmp 0x140007e99
mov dword [rsp + 0x20], 4
mov rcx, qword [rsp + 0x48]
mov r9d, 0x3000
xor edx, edx
mov r8d, 0xff
call r13
mov rsi, rax
test rax, rax
je 0x140007f2a
mov qword [rsp + 0x20], r12
mov rcx, qword [rsp + 0x48]
mov r8, r15
mov rdx, rax
mov r9d, 0xff
call rbp
test eax, eax
je 0x140007f5e
xor eax, eax
mov ecx, 0x1b
mov r9d, 0x3000
xor edx, edx
lea rdi, [rsp + 0xbc]
mov r8d, 0x70
mov dword [rsp + 0xb8], 0x70
rep stosd dword [rdi], eax
mov qword [rsp + 0xd0], rbx
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0xe0], rsi
mov dword [rsp + 0xe8], 6
mov dword [rsp + 0x20], 4
call r13
mov r13, rax
test rax, rax
je 0x140007f2a
mov qword [rsp + 0x20], r12
mov rcx, qword [rsp + 0x48]
mov rdx, rax
mov r9d, 0x70
lea r8, [rsp + 0xb8]
call rbp
test eax, eax
je 0x140007f5e
xor eax, eax
xor edx, edx
mov r9, r14
xor r8d, r8d
mov dword [rsp + 0x28], edx
mov rcx, qword [rsp + 0x48]
xor edx, edx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
lea rcx, str.____Thread_running__done___Handle:__d__n
mov rbp, rax
mov rdx, rax
call fcn.140001450
mov rcx, rbp
mov edx, 0xbb8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, str.WaitForSingleObject
test eax, eax
jne 0x140007e99
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rsi
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
call rsi
mov rcx, qword [rsp + 0x48]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbx
call rsi
mov rcx, qword [rsp + 0x48]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r13
call rsi
xor eax, eax
add rsp, 0x438
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret