Function at 0x7d2729a0
Capabilities:
Create process on windows

Disassembly:
jmp 0x7d2729a0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
or rdi, 0xffffffffffffffff
mov r13, r9
mov rax, rdi
mov r15, r8
mov rsi, rdx
mov r14, rcx
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x7d2729d0
add eax, 0x208
test rsi, rsi
je 0x7d2729fc
mov rcx, rdi
nop word [rax + rax]
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x7d2729f0
add eax, ecx
lea ecx, [rax + rax]
call fcn.7d2212da
mov edx, 0x2e
mov rcx, r14
mov rbx, rax
call sub.ntdll.dll_wcsrchr
xor ebp, ebp
lea r12d, [rbp + 1]
test rax, rax
je 0x7d272a3d
lea rdx, str..exe
mov rcx, rax
call sub.ntdll.dll__wcsicmp
test eax, eax
jne 0x7d272a3d
mov eax, 0x22
mov ebp, r12d
mov word [rbx], ax
xor ecx, ecx
mov eax, ebp
cmp qword [0x7d2abf58], rcx
je 0x7d272b03
lea r8, [rbx + rax*2]
xor edx, edx
mov r9d, 0x104
call sym.imfsbDll.dll_SbieApi_GetHomePath
lea rcx, [rbx - 2]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x7d272a63
mov eax, dword [0x7d28ee24]
mov dword [rcx], eax
xor r8d, r8d
lea rcx, [rbx - 2]
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x7d272a80
xor edx, edx
nop dword [rax]
movzx eax, word [r14 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x7d272a90
test ebp, ebp
je 0x7d272b53
lea rcx, [rbx - 2]
test rsi, rsi
je 0x7d272b40
nop word [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x7d272ac0
mov eax, dword [0x7d297060]
mov dword [rcx], eax
movzx eax, word [0x7d297064]
mov word [rcx + 4], ax
lea rcx, [rbx - 2]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x7d272ae2
xor edx, edx
nop
movzx eax, word [rsi + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x7d272af0
jmp 0x7d272b53
lea rdx, [rbx + rax*2]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x5c
mov rcx, rbx
call sub.ntdll.dll_wcsrchr
test rax, rax
je 0x7d272a76
xor r8d, r8d
mov word [rax + 2], r8w
jmp 0x7d272a79
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x7d272b40
mov eax, dword [0x7d297028]
mov dword [rcx], eax
test r13, r13
jne 0x7d272bbe
nop dword [rax + rax]
cmp word [rbx + rdi*2 + 2], 0
lea rdi, [rdi + 1]
jne 0x7d272b60
lea edi, [rdi*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [r15 + 8], rax
test rax, rax
je 0x7d272baf
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call sub.ntdll.dll_memcpy
mov rcx, rbx
call fcn.7d221938
movzx eax, r12b
jmp 0x7d272cc6
mov rcx, rbx
call fcn.7d221938
xor al, al
jmp 0x7d272cc6
cmp qword [r15 + 8], 0
je 0x7d272bcb
mov qword [r15 + 8], r8
jmp 0x7d272bce
mov r12d, r8d
mov eax, dword [str.sbox5.40]
cmp dword [r15 + 0x30], eax
jne 0x7d272bef
cmp dword [r15 + 0x34], eax
jne 0x7d272bef
mov esi, 0x8000
mov qword [r15 + 0x30], 0
jmp 0x7d272bf2
mov esi, r8d
mov qword [rsp + 0x48], r13
xor eax, eax
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x38], r8
mov rdx, rbx
mov qword [rsp + 0x30], r8
xor ecx, ecx
mov qword [r13], rax
xor r8d, r8d
mov qword [r13 + 8], rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r12d
mov qword [r13 + 0x10], rax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test ebp, ebp
jne 0x7d272c95
cmp eax, 0x4ec
jne 0x7d272c95
cmp qword [0x7d2abf58], 0
je 0x7d272c95
xor ecx, ecx
call fcn.7d22196a
mov qword [rsp + 0x48], r13
xor ebp, ebp
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x38], rbp
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov rdx, rbx
mov dword [rsp + 0x28], esi
xor ecx, ecx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov cl, 1
mov edi, eax
call fcn.7d22196a
mov rcx, rbx
call fcn.7d221938
test ebp, ebp
jne 0x7d272cc4
mov r9d, edi
lea rdx, str._S___d_
mov r8, r14
mov ecx, 0x909
call sym.imfsbDll.dll_SbieApi_Log
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x7d272cc6
mov al, 1
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret