Function at 0x7fff25d47840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x388]
sub rsp, 0x488
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rbp + 0x370], rax
and qword [rsp + 0x28], 0
mov r13, rcx
mov rsi, qword gs:[0x60]
lea rcx, [rbp - 0x60]
movups xmm0, xmmword [rdx]
mov rax, qword [rbp + 0x408]
mov rdx, r9
mov r14, qword [rbp + 0x3f0]
mov r15, r8
mov r12, qword [rbp + 0x3f8]
mov rdi, qword [rbp + 0x410]
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x50], rax
call qword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25dd9e09
mov rdx, r15
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
nop dword [rax + rax]
xor r15d, r15d
mov ebx, eax
test eax, eax
js 0x7fff25dd9e09
mov rdx, r12
lea rcx, [rbp + 0x340]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25dd9e09
mov rdx, r14
lea rcx, [rbp - 0x80]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25dd9e09
lea r12d, [r15 + 2]
test r14, r14
jne 0x7fff25d47970
cmp byte [rbp + 0x400], r15b
jne 0x7fff25d47970
test dword [rbp + 0x428], 0x10000
jne 0x7fff25d47970
lea rcx, [rbp - 0x80]
call qword [sym.imp.ntdll.dll_LdrGetDllDirectory]
nop dword [rax + rax]
cmp word [rbp - 0x80], r12w
ja 0x7fff25d47c8a
xor edx, edx
lea rcx, [rbp - 0x80]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov r14b, r15b
mov rdx, qword [rdi + 0x10]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25dd9e09
mov rdx, qword [rdi + 8]
lea rcx, [rbp]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25dd9e09
mov rax, qword [rdi + 0x48]
lea rcx, [rbp - 0x20]
mov rdx, qword [rdi + 0x18]
mov qword [rbp + 0x18], rax
movzx eax, word [rdi + 0x42]
mov word [rbp + 0x10], ax
mov word [rbp + 0x12], ax
test rdx, rdx
jne 0x7fff25d479d3
mov rdx, r13
call qword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25dd9e09
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntdll.dll_RtlCreateProcessParametersWithTemplate]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25dd9e09
mov rax, qword [rsp + 0x28]
mov r10d, 0x200
mov ecx, dword [rdi + 0x20]
mov edx, dword [rbp + 0x418]
mov dword [rax + 0x88], ecx
mov rax, qword [rsp + 0x28]
mov ecx, dword [rdi + 0x24]
mov dword [rax + 0x8c], ecx
mov rax, qword [rsp + 0x28]
mov ecx, dword [rdi + 0x28]
mov dword [rax + 0x90], ecx
mov rax, qword [rsp + 0x28]
mov ecx, dword [rdi + 0x2c]
mov dword [rax + 0x94], ecx
mov rax, qword [rsp + 0x28]
mov ecx, dword [rdi + 0x30]
mov dword [rax + 0x98], ecx
mov rax, qword [rsp + 0x28]
mov ecx, dword [rdi + 0x34]
mov dword [rax + 0x9c], ecx
mov rax, qword [rsp + 0x28]
mov ecx, dword [rdi + 0x38]
mov dword [rax + 0xa0], ecx
mov rax, qword [rsp + 0x28]
mov ecx, dword [rdi + 0x3c]
mov dword [rax + 0xa4], ecx
mov rax, qword [rsp + 0x28]
movzx ecx, word [rdi + 0x40]
mov dword [rax + 0xa8], ecx
test r10d, edx
jne 0x7fff25d47c47
mov rax, qword [rsi + 0x20]
mov ecx, dword [rax + 0x408]
mov rax, qword [rsp + 0x28]
mov dword [rax + 0x408], ecx
mov eax, dword [rdi + 0x3c]
mov r9d, 0x700
test r9d, eax
je 0x7fff25d47b07
cmp qword [rbp + 0x438], r15
jne 0x7fff25d47bb6
bt eax, 8
setb cl
test byte [rbp + 0x428], 4
sete al
test al, cl
je 0x7fff25d47bb6
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], r15
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x28], r15
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x30], r15
test dl, 8
jne 0x7fff25d47c7b
test dl, 0x10
jne 0x7fff25d47c58
bt edx, 0x1b
jb 0x7fff25d47d10
mov r8, qword [rbp + 0x430]
test r8, r8
je 0x7fff25d47b3b
mov rcx, qword [r8]
test rcx, rcx
jne 0x7fff25dd9e2d
mov rcx, qword [rsp + 0x28]
mov rax, qword [0x7fff25fd1010]
mov qword [rcx + 0x10], rax
mov r8, qword [rsp + 0x28]
cmp qword [r8 + 0x10], r15
je 0x7fff25d47c6a
test dword [rdi + 0x3c], r9d
je 0x7fff25d47bed
and edx, 0x210
cmp edx, r10d
je 0x7fff25d47be2
mov rax, qword [rsi + 0x20]
mov rdx, qword [rsp + 0x28]
mov ecx, dword [rax + 8]
and ecx, 0x100
or dword [rdx + 8], ecx
test r14b, r14b
jne 0x7fff25d47cec
mov rax, qword [rsp + 0x28]
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.7fff25dce640
add rsp, 0x488
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, qword [rsp + 0x28]
mov rcx, qword [rdi + 0x50]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rdi + 0x58]
mov qword [rax + 0x28], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rdi + 0x60]
mov qword [rax + 0x30], rcx
jmp 0x7fff25d47b07
mov rax, qword [rsp + 0x28]
or dword [rax + 0x18], 1
jmp 0x7fff25d47b6f
cmp dword [rbp + 0x420], r15d
je 0x7fff25d47b64
mov rcx, qword [rsi + 0x20]
test dword [rcx + 0xa4], r10d
jne 0x7fff25d47c18
mov rcx, qword [rcx + 0x20]
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], rcx
mov rcx, qword [rsi + 0x20]
test dword [rcx + 0xa4], 0x400
jne 0x7fff25d47c35
mov rcx, qword [rcx + 0x28]
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x28], rcx
mov rcx, qword [rsi + 0x20]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov qword [rax + 0x30], rcx
jmp 0x7fff25d47b64
mov rax, qword [rsp + 0x28]
mov dword [rax + 0x408], r15d
jmp 0x7fff25d47ab8
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x10], 0xfffffffffffffffe
jmp 0x7fff25d47b64
mov rax, qword [rsi + 0x20]
mov rcx, qword [rax + 0x10]
mov qword [r8 + 0x10], rcx
jmp 0x7fff25d47b5a
mov rax, qword [rsp + 0x28]
or qword [rax + 0x10], 0xffffffffffffffff
jmp 0x7fff25d47b64
cmp eax, 0xc0000023
jne 0x7fff25d4795e
mov rcx, qword gs:[0x60]
xor edx, edx
movzx r8d, word [rbp - 0x80]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rbp - 0x78], rax
test rax, rax
je 0x7fff25dd9e04
movzx eax, word [rbp - 0x80]
lea rcx, [rbp - 0x80]
mov word [rbp - 0x7e], ax
mov r14b, 1
call qword [sym.imp.ntdll.dll_LdrGetDllDirectory]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x7fff25d47973
jmp 0x7fff25dd9e09
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x78]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
jmp 0x7fff25d47b8d
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x10], 0xfffffffffffffffd
jmp 0x7fff25d47b64
mov ebx, 0xc0000017
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x7fff25dd9e1f
call qword [sym.imp.ntdll.dll_RtlDestroyProcessParameters]
nop dword [rax + rax]
mov ecx, ebx
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25d47b92
mov rax, qword [rsp + 0x28]
mov rcx, qword [rcx]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x28]
or dword [rax + 0x18], r12d
cmp byte [r8 + 8], r15b
je 0x7fff25d47b5a
mov rax, qword [rsp + 0x28]
or dword [rax + 0x18], 4
jmp 0x7fff25d47b5a