Function at 0x140005840
Capabilities:
Get common file path
Map section object
Resume thread

Disassembly:
push rbp
push rbx
push r13
push r14
push r15
lea rbp, [rsp - 0x650]
sub rsp, 0x750
mov rax, qword [0x140042088]
xor rax, rsp
mov qword [rbp + 0x630], rax
mov ebx, r8d
mov r15, rdx
mov r14, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x420]
call fcn.14000b250
xor edx, edx
lea rcx, [rbp + 0x210]
mov r8d, 0x208
call fcn.14000b250
lea rdx, [rbp + 0x210]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rbp + 0x420]
xor r8d, r8d
lea rdx, [0x14002bb80]
lea rcx, [rbp + 0x210]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov r8d, ebx
lea rcx, [rbp + 0x420]
mov rdx, r15
call fcn.1400063d0
mov r13, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140005c1e
mov qword [rsp + 0x748], rsi
lea rcx, [rbp]
xor edx, edx
mov qword [rsp + 0x740], rdi
mov r8d, 0x208
xor ebx, ebx
call fcn.14000b250
xor r8d, r8d
lea rdx, [rbp]
mov rcx, r14
call fcn.1400060d0
mov edx, 0x104
lea rcx, [rbp]
call fcn.14000d894
test rax, rax
lea rdi, [rbp]
lea rcx, [0x14002ba68]
cmove rdi, rbx
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.CreateProcessInternalW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140043180], rax
mov rsi, rax
test rax, rax
je 0x1400059ec
xor edx, edx
lea r8d, [rbx + 0x64]
lea rcx, [rbp - 0x6c]
call fcn.14000b250
lea rax, [rsp + 0x60]
mov dword [rbp - 0x70], 0x68
mov qword [rsp + 0x58], rax
xor r9d, r9d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rax
mov r8, r14
lea rax, [rbp - 0x70]
xor edx, edx
mov qword [rsp + 0x48], rax
xor ecx, ecx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x800000c
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call rsi
test eax, eax
jne 0x140005a30
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._ERROR__CreateProcessInternalW_failed__Error___x_n
call fcn.140005c70
lea rdx, str.Creating_process_failed__n
lea rcx, [0x1400434d0]
call fcn.1400011f0
xor al, al
mov rsi, qword [rsp + 0x748]
mov rdi, qword [rsp + 0x740]
mov rcx, qword [rbp + 0x630]
xor rcx, rsp
call fcn.1400096e0
add rsp, 0x750
pop r15
pop r14
pop r13
pop rbx
pop rbp
ret
lea rdx, str.Created_Process__PID:
lea rcx, [0x1400433a0]
call fcn.1400011f0
mov r8, rax
test rax, rax
jne 0x140005a50
mov rcx, rbx
jmp 0x140005a5a
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, r8
and dword [rcx + 0x18], 0xfffff3ff
or dword [rcx + 0x18], 0x200
mov rcx, r8
mov edx, dword [rsp + 0x78]
call fcn.140002a60
mov rcx, rax
lea rdx, [0x14002bb6c]
call fcn.1400011f0
mov rdx, qword [rsp + 0x68]
lea rax, [rbp - 0x80]
mov dword [rsp + 0x48], 2
lea r8, [rsp + 0x60]
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov rcx, r13
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov qword [rbp - 0x80], rbx
mov qword [rsp + 0x60], rbx
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov edi, eax
test eax, eax
je 0x140005ae9
lea rcx, [0x1400434d0]
cmp eax, 0x40000003
jne 0x140005b09
lea rdx, str._WARNING__Image_could_not_be_mapped_at_its_original_base__If_the_payload_has_no_relocations__it_wont_work__n
call fcn.1400011f0
lea rdx, str.Mapped_Base:_t
lea rcx, [0x1400433a0]
call fcn.1400011f0
mov r8, rax
test rax, rax
jne 0x140005b50
mov rcx, rbx
jmp 0x140005b5a
lea rdx, str._ERROR__NtMapViewOfSection_failed__status:
call fcn.1400011f0
mov rcx, rax
test rax, rax
je 0x140005b27
mov rax, qword [rax]
movsxd rbx, dword [rax + 4]
add rbx, rcx
and dword [rbx + 0x18], 0xfffff9ff
mov edx, edi
or dword [rbx + 0x18], 0x800
call fcn.140002870
mov rcx, rax
call fcn.140001960
lea rdx, str.Failed_mapping_the_buffer__n
jmp 0x1400059f3
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, r8
and dword [rcx + 0x18], 0xfffff9ff
or dword [rcx + 0x18], 0x800
mov rcx, r8
mov rdx, qword [rsp + 0x60]
call fcn.140002c50
mov rcx, rax
lea rdx, [0x14002bb6c]
call fcn.1400011f0
mov rdi, qword [rsp + 0x60]
test rdi, rdi
jne 0x140005b9a
lea rdx, str.Failed_mapping_the_buffer__n
jmp 0x1400059f3
mov rcx, r15
call fcn.1400061a0
test al, al
lea r8, [rsp + 0x68]
mov rdx, rdi
mov rcx, r15
sete r9b
call fcn.1400061e0
test al, al
jne 0x140005bc8
lea rdx, str.Failed_to_redirect__n
jmp 0x1400059f3
lea rdx, str.Resuming__PID
lea rcx, [0x1400433a0]
call fcn.1400011f0
mov rcx, rax
test rax, rax
je 0x140005bed
mov rax, qword [rax]
movsxd rbx, dword [rax + 4]
add rbx, rcx
and dword [rbx + 0x18], 0xfffff3ff
or dword [rbx + 0x18], 0x200
mov edx, dword [rsp + 0x78]
call fcn.140002a60
mov rcx, rax
call fcn.140001960
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
jmp 0x140005a01
lea rdx, str.Creating_transacted_section_has_failed__n
lea rcx, [0x1400433a0]
call fcn.1400011f0
xor al, al
jmp 0x140005a11