Function at 0x14001e690
Capabilities:
Create thread
Get windows directory from kuser_shared_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
xor r13d, r13d
mov r12, r8
mov r15, rdx
mov qword [rbp - 0x19], r13
lea r8, [rbp + 0x7f]
mov qword [rsp + 0x20], r13
mov r14, rcx
lea r9d, [r13 + 8]
lea edx, [r13 + 0x1a]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x14001e7d1
cmp qword [rbp + 0x7f], r13
setne al
test al, al
je 0x14001e7d1
lea rax, [rbp + 7]
mov r8b, 1
lea r9, [rbp - 1]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r15
call sym.ProcessHacker.exe_PhMapViewOfEntireFile
mov ebx, eax
test eax, eax
js 0x14001e8db
mov r8, qword [rbp + 7]
lea rcx, [rbp - 1]
mov rdx, qword [rbp - 1]
call sym.ProcessHacker.exe_PhInitializeMappedImage
mov rdx, qword [rbp - 1]
mov ebx, eax
test eax, eax
jns 0x14001e740
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
jmp 0x14001e8db
mov eax, 0x10b
cmp word [rbp + 0x27], ax
sete bl
or rsi, 0xffffffffffffffff
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
test bl, bl
je 0x14001e7d1
mov rdi, qword [0x14015a368]
test rdi, rdi
jne 0x14001e7fb
lea rdx, str.SysWow64kernel32.dll
mov ecx, 0x7ffe0030
call sym.ProcessHacker.exe_PhConcatStrings2
mov rbx, rax
mov qword [rsp + 0x28], r13
lea rax, [0x14015a368]
xor r9d, r9d
lea r8, [0x140122d00]
mov qword [rsp + 0x20], rax
mov rcx, r14
mov rdx, qword [rbx + 8]
call sym.ProcessHacker.exe_PhGetProcedureAddressRemote
mov edi, eax
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x14001e7bd
call fcn.1400258b0
test edi, edi
jns 0x14001e7c8
mov eax, edi
jmp 0x14001e8dd
mov rdi, qword [0x14015a368]
jmp 0x14001e7fb
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001e7f8
lea rdx, [0x140122d00]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
jmp 0x14001e7fb
mov rdi, r13
mov rcx, r15
call sym.ProcessHacker.exe_PhCountStringZ
mov dword [rsp + 0x28], 4
lea r9, [rbp - 9]
xor r8d, r8d
mov dword [rsp + 0x20], 0x1000
lea rdx, [rbp - 0x19]
mov rcx, r14
lea rbx, [rax*2 + 2]
mov qword [rbp - 9], rbx
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
js 0x14001e8dd
mov rdx, qword [rbp - 0x19]
mov r9, rbx
mov r8, r15
mov qword [rsp + 0x20], r13
mov rcx, r14
call sym.ProcessHacker.exe_PhWriteVirtualMemory
mov ebx, eax
test eax, eax
js 0x14001e8c0
xor edx, edx
mov rcx, r14
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3c
jb 0x14001e8fe
mov qword [rsp + 0x48], r13
lea rax, [rbp - 0x11]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov rax, qword [rbp - 0x19]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntdll.dll_RtlCreateUserThread]
mov ebx, eax
test eax, eax
js 0x14001e8c0
mov rax, qword [rbp - 0x11]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov rcx, qword [rbp - 0x11]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov r9d, 0x8000
mov qword [rbp - 9], r13
lea r8, [rbp - 9]
mov rcx, r14
lea rdx, [rbp - 0x19]
call qword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
mov eax, ebx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rax, qword [rbp - 0x19]
mov r9, rdi
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp - 0x11], rax
test rax, rax
jne 0x14001e8a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14001e8c0
movzx ebx, ax
or ebx, 0xc0070000
jmp 0x14001e8c0