Function at 0x21007aed0
Capabilities:
Create process on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rbx
sub rsp, 0x270
lea rbp, [rsp + 0x80]
test cl, cl
je 0x21007b1d0
lea r12, [rbp + 0xa0]
xor r9d, r9d
mov r8d, 0x21
mov dword [rbp + 0xa0], 0xffffffff
lea rdx, [0x21028b328]
mov rcx, r12
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xb0], 0
mov dword [rbp + 0xb8], 0
mov dword [rbp + 0xbc], 0
mov byte [rbp + 0xc0], 0
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x138], 0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x148], 0
mov qword [rbp + 0x150], 0
mov dword [rbp + 0x1c0], 0
mov qword [rbp + 0x1c8], 0
mov qword [rbp + 0x1d0], 0
mov qword [rbp + 0x1d8], 0
mov qword [rbp + 0x1e0], 0
mov qword [rbp + 0x1e8], 0
call method.path_conv.check_char_const__unsigned_int__suffix_info_const_
cmp dword [rbp + 0xa0], 0xffffffff
jne 0x21007b008
call sym.AllocConsole
mov rcx, r12
call method.path_conv.path_conv__
mov eax, 1
mov byte [0x21024fa20], 1
lea rsp, [rbp + 0x1f0]
pop rbx
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r14, [0x2102d1ce0]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, r14
call sym.CreateEventA
mov r13, rax
test rax, rax
je 0x21007afd8
mov rcx, r14
xor r9d, r9d
xor r8d, r8d
mov edx, 1
call sym.CreateEventA
mov r14, rax
test rax, rax
je 0x21007b318
xor eax, eax
lea rdi, [rbp + 0x30]
mov ecx, 0xd
xor edx, edx
rep stosq qword [rdi], rax
mov rcx, r12
mov rbx, rsp
call method.path_conv.get_nt_native_path__UNICODE_STRING_
movzx eax, word [rbp + 0x118]
shr rax, 1
lea rdx, [rax + rax + 2]
lea rax, [rdx + 0xf]
and eax, 0x3fff0
call fcn.21021b550
sub rsp, rax
lea rax, [rdx + 0x61]
lea r15, [rsp + 0x50]
and eax, 0x3fff0
call fcn.21021b550
movabs rdx, 0x6c006200690073
sub rsp, rax
mov qword [rbp - 8], rdx
mov rcx, r12
movabs rax, 0x690076006e0069
mov qword [rbp - 0x10], rax
lea rdi, [rsp + 0x50]
movabs rax, 0x79006300200065
movabs rdx, 0x6e006900770067
mov qword [rbp], rax
movabs rax, 0x6e006f00630020
mov qword [rbp + 8], rdx
movabs rdx, 0x65006c006f0073
mov qword [rbp + 0x10], rax
xor eax, eax
mov qword [rbp + 0x18], rdx
mov rdx, r15
mov word [rbp + 0x20], ax
call method.path_conv.get_wide_win32_path_wchar_t_
mov qword [rsp + 0x20], r14
mov r9, r13
mov r8, r15
lea rdx, str.__W___p__p
mov rcx, rdi
call sym.__small_swprintf_wchar_t__wchar_t_const__::_
lea rax, [rbp - 0x10]
xor edx, edx
mov rcx, r15
mov qword [rbp + 0x48], rax
lea rax, [rbp - 0x30]
lea r9, [0x2102d1cc0]
mov word [rbp + 0x70], dx
mov r8, r9
mov rdx, rdi
mov dword [rbp + 0x30], 0x68
mov dword [rbp + 0x6c], 1
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
call sym.CreateProcessW
test eax, eax
jne 0x21007b2d8
call sym.AllocConsole
mov rsp, rbx
call sym.GetConsoleWindow
mov rdx, 0xfffffffffffffffd
mov rcx, rax
call fcn.21022e7c0
mov rcx, r13
call sym.CloseHandle
mov rcx, r14
call sym.SetEvent
mov rcx, r14
call sym.CloseHandle
mov rcx, r12
call method.path_conv.path_conv__
jmp 0x21007afe5
mov ecx, 0xffffffff
call sym.AttachConsole
test eax, eax
jne 0x21007afe5
call sym.GetLastError
lea r12, [rbp + 0xa0]
xor r9d, r9d
mov r8d, 0x21
mov ebx, eax
mov rcx, r12
lea rdx, [0x21028b328]
mov dword [rbp + 0xa0], 0xffffffff
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xb0], 0
mov dword [rbp + 0xb8], 0
mov dword [rbp + 0xbc], 0
mov byte [rbp + 0xc0], 0
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x138], 0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x148], 0
mov qword [rbp + 0x150], 0
mov dword [rbp + 0x1c0], 0
mov qword [rbp + 0x1c8], 0
mov qword [rbp + 0x1d0], 0
mov qword [rbp + 0x1d8], 0
mov qword [rbp + 0x1e0], 0
mov qword [rbp + 0x1e8], 0
call method.path_conv.check_char_const__unsigned_int__suffix_info_const_
cmp ebx, 0x7f
jne 0x21007afcf
jmp 0x21007afd8
mov rcx, qword [rbp - 0x30]
call sym.CloseHandle
mov rcx, qword [rbp - 0x28]
call sym.CloseHandle
mov edx, 0x2710
mov rcx, r13
call sym.WaitForSingleObject
test eax, eax
jne 0x21007b18b
mov ecx, dword [rbp - 0x20]
call sym.AttachConsole
test eax, eax
je 0x21007b18b
jmp 0x21007b190
call sym.AllocConsole
mov rcx, r13
call sym.CloseHandle
jmp 0x21007afdd