Function at 0x14002ba50
Capabilities:
Create process on windows
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rbx, r9
mov rsi, r8
mov rdi, rdx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
jne 0x14002ba94
mov eax, 0xc0000034
jmp 0x14002bc6c
test rdi, rdi
je 0x14002babf
cmp qword [rdi], 0xfffe
movzx eax, word [rdi]
mov word [rbp - 0x71], ax
mov word [rbp - 0x6f], ax
mov rax, qword [rdi + 8]
mov qword [rbp - 0x69], rax
jbe 0x14002babf
mov eax, 0xc0000106
jmp 0x14002bc6c
test rbx, rbx
je 0x14002bae0
cmp qword [rbx], 0xfffe
movzx eax, word [rbx]
mov word [rbp - 0x61], ax
mov word [rbp - 0x5f], ax
mov rax, qword [rbx + 8]
mov qword [rbp - 0x59], rax
ja 0x14002bab5
mov rdx, qword [rbp + 0x57]
mov qword [rsp + 0x110], r14
xor r14d, r14d
test rdx, rdx
je 0x14002bb03
mov r8, qword [rdx + 8]
mov rcx, qword [rdx + 0x10]
test r8, r8
jne 0x14002bb0b
jmp 0x14002bb06
mov rcx, r14
lea r8, [rsp + 0x58]
test rcx, rcx
jne 0x14002bb28
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x20]
add rcx, 0xc0
test rdx, rdx
je 0x14002bb3a
mov r10, qword [rdx + 0x20]
mov r11, qword [rdx + 0x18]
mov rdx, qword [rdx]
jmp 0x14002bb43
mov r10, r14
mov r11, r14
mov rdx, r14
mov qword [rsp + 0x48], r10
lea r9, [rsp + 0x58]
mov qword [rsp + 0x40], r11
lea rax, [rbp - 0x71]
mov qword [rsp + 0x38], rcx
test rdi, rdi
mov qword [rsp + 0x30], r8
lea rcx, [rsp + 0x50]
cmove rax, r9
mov qword [rsp + 0x28], rsi
mov r8, rdx
mov qword [rsp + 0x20], rax
test rbx, rbx
lea r9, [rbp - 0x61]
lea rdx, [rsp + 0x58]
cmove r9, r14
call qword [sym.imp.ntdll.dll_RtlCreateProcessParameters]
mov edi, dword [rbp + 0x5f]
mov ebx, eax
test eax, eax
js 0x14002bbe7
mov r8, qword [rsp + 0x50]
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x48], rcx
movzx eax, dil
mov qword [rsp + 0x40], r14
lea rcx, [rsp + 0x58]
and al, 1
mov qword [rsp + 0x38], r14
mov byte [rsp + 0x30], al
xor r9d, r9d
mov rax, qword [rbp + 0x67]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea edx, [r9 + 0x40]
call qword [sym.imp.ntdll.dll_RtlCreateUserProcess]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlDestroyProcessParameters]
mov rax, qword gs:[0x30]
xor edx, edx
mov r8, qword [rbp - 0x79]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r14, qword [rsp + 0x110]
test ebx, ebx
js 0x14002bc6a
test dil, 4
jne 0x14002bc22
mov rcx, qword [rbp - 0x39]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtResumeThread]
mov rax, qword [rbp + 0x6f]
test rax, rax
je 0x14002bc32
movups xmm0, xmmword [rbp - 0x31]
movups xmmword [rax], xmm0
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x14002bc44
mov rax, qword [rbp - 0x41]
mov qword [rcx], rax
jmp 0x14002bc4e
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x14002bc60
mov rax, qword [rbp - 0x39]
mov qword [rcx], rax
jmp 0x14002bc6a
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret