Function at 0x140001770
Capabilities:
Create process on windows
Create process suspended
Create thread
Inject dll
Inject thread
Resume thread
Use process replacement

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x178
lea rcx, [rsp + 0x110]
call sym.std::env::current_dir::h0e7e45106c563caa
xor eax, eax
cmp rax, qword [rsp + 0x110]
jo 0x140001b2d
movups xmm0, xmmword [rsp + 0x110]
movups xmm1, xmmword [rsp + 0x120]
movaps xmmword [rsp + 0xa0], xmm1
movaps xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x90]
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h9e9e85ff17162f42
mov r8, rdx
mov qword [rsp + 0x20], 7
lea r9, str.ext.dllext.dll_not_found_n
lea rcx, [rsp + 0xb8]
mov rdx, rax
call sym.std::path::Path::_join::h959ff4742bbcd35e
lea rcx, [rsp + 0xb8]
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h9e9e85ff17162f42
mov rcx, rax
call sym.std::path::Path::is_file::h3466c2e08d53a86a
test al, al
je 0x1400019f3
lea rsi, [rsp + 0xf8]
mov rcx, rsi
call sym._ZN116__LT_windows..Win32..System..Threading..PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE_u20_as_u20_core..default..Default_GT_7def
lea rdi, [rsp + 0x110]
mov rcx, rdi
call sym.__windows::Win32::System::Threading::STARTUPINFOA_as_core::default::Default_::default::h244f3d2903f5b68c
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
lea rcx, str.GenshinImpact.exe
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x140001b68
mov rbx, qword [rsp + 0xf8]
lea rcx, [rsp + 0xb8]
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h9e9e85ff17162f42
mov r8, rdx
lea rcx, [rsp + 0x50]
mov rdx, rax
call sym._ZN3std3ffi6os_str95__LT_impl_u20_core..convert..TryFrom_LT__RF_std..ffi..os_str..OsStr_GT__u20_for_u20__RF_str_GT_8try_from17
test byte [rsp + 0x50], 1
jne 0x140001ba4
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
lea rcx, [0x1400c7178]
call sub.kernel32.dll_GetModuleHandleA
test rax, rax
je 0x140001bad
lea rdx, str.LoadLibraryA
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140001be9
mov r14, rax
lea r12, [rsp + 0xd8]
mov rcx, r12
mov rdx, rsi
mov r8, rdi
call sym.__str_as_alloc::ffi::c_str::CString::new::SpecNewImpl_::spec_new_impl::h49c97cfeb3af6dca
movabs rax, 0x8000000000000000
cmp qword [rsp + 0xd8], rax
jne 0x140001bfa
mov rdi, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0xe8]
mov dword [rsp + 0x20], 4
mov rcx, rbx
xor edx, edx
mov r8, rsi
mov r9d, 0x3000
call sub.kernel32.dll_VirtualAllocEx
test rax, rax
je 0x140001a37
mov r15, rax
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rax
mov r8, rdi
mov r9, rsi
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
je 0x140001cba
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rcx, rbx
xor edx, edx
xor r8d, r8d
mov r9, r14
call sub.kernel32.dll_CreateRemoteThread
mov r14, rax
dec rax
cmp rax, 0xfffffffffffffffe
jae 0x140001cf6
mov rcx, r14
mov edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov rcx, rbx
mov rdx, r15
xor r8d, r8d
mov r9d, 0x8000
call sub.kernel32.dll_VirtualFreeEx
test eax, eax
je 0x140001d2f
mov rcx, r14
call fcn.1400c3c14
test eax, eax
je 0x140001d68
mov byte [rdi], 0
test rsi, rsi
je 0x1400019e1
mov r8d, 1
mov rcx, rdi
mov rdx, rsi
call sym.__rust_dealloc
mov rcx, qword [rsp + 0x100]
call sub.kernel32.dll_ResumeThread
jmp 0x140001ab1
lea rax, [0x1400c72e8]
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], 1
mov qword [rsp + 0x120], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x128], xmm0
lea rcx, [rsp + 0x110]
call sym.std::io::stdio::_print::hd32beba760f94c36
jmp 0x140001adb
call sub.kernel32.dll_GetLastError
mov dword [rsp + 0x8c], eax
lea rax, [rsp + 0x8c]
mov qword [rsp + 0xd8], rax
lea rax, [sym.__windows::Win32::Foundation::WIN32_ERROR_as_core::fmt::Debug_::fmt::h2475a9846b62b952]
mov qword [rsp + 0xe0], rax
lea rax, str.Failed_allocating_memory_in_the_target_process._GetLastError__:__n
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 1
lea rcx, [rsp + 0x50]
call sym.std::io::stdio::_print::hd32beba760f94c36
mov byte [rdi], 0
test rsi, rsi
je 0x140001ab1
mov r8d, 1
mov rcx, rdi
mov rdx, rsi
call sym.__rust_dealloc
mov rcx, qword [rsp + 0x100]
call fcn.1400c3c14
test eax, eax
je 0x140001c42
mov rcx, qword [rsp + 0xf8]
call fcn.1400c3c14
test eax, eax
je 0x140001c7e
mov rdx, qword [rsp + 0xb8]
test rdx, rdx
je 0x140001afb
mov rcx, qword [rsp + 0xc0]
mov r8d, 1
call sym.__rust_dealloc
mov rdx, qword [rsp + 0x90]
test rdx, rdx
je 0x140001b1b
mov rcx, qword [rsp + 0x98]
mov r8d, 1
call sym.__rust_dealloc
nop
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x50], rax
lea rax, str.src_main.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1400c70c0]
lea r9, sym.core::ptr::drop_in_place_std::io::error::Error_::h1765a5d7520b0daf
lea r8, [rsp + 0x50]
mov edx, 0x2b
call sym.core::result::unwrap_failed::h068d2ce9302e27b1
jmp 0x140001d9f
call sym.windows_result::error::Error::from_win32::h03c3b55a10ff2588
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], edx
lea rax, str.src_main.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1400c70c0]
lea r9, sym.core::ptr::drop_in_place_windows_result::error::Error_::heb60e29f8463fa72
lea r8, [rsp + 0x50]
mov edx, 0x2b
call sym.core::result::unwrap_failed::h068d2ce9302e27b1
jmp 0x140001d9f
lea rcx, str.src_main.rs
jmp 0x140001bf0
call sym.windows_result::error::Error::from_win32::h03c3b55a10ff2588
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], edx
lea rax, str.src_main.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1400c70c0]
lea r9, sym.core::ptr::drop_in_place_windows_result::error::Error_::heb60e29f8463fa72
lea r8, [rsp + 0x50]
mov edx, 0x2b
call sym.core::result::unwrap_failed::h068d2ce9302e27b1
jmp 0x140001d9f
lea rcx, str.src_main.rs
call sym.core::option::unwrap_failed::h5b3151c7fecd49f4
jmp 0x140001d9f
movups xmm0, xmmword [rsp + 0xd8]
movups xmm1, xmmword [rsp + 0xe8]
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
lea rax, str.src_main.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1400c70c0]
lea r9, sym.core::ptr::drop_in_place_alloc::ffi::c_str::NulError_::hd5d0a05c31bb7aae
lea r8, [rsp + 0x50]
mov edx, 0x2b
call sym.core::result::unwrap_failed::h068d2ce9302e27b1
jmp 0x140001d9f
call sym.windows_result::error::Error::from_win32::h03c3b55a10ff2588
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], edx
lea rax, str.src_main.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1400c70c0]
lea r9, sym.core::ptr::drop_in_place_windows_result::error::Error_::heb60e29f8463fa72
lea r8, [rsp + 0x50]
mov edx, 0x2b
call sym.core::result::unwrap_failed::h068d2ce9302e27b1
jmp 0x140001d9f
call sym.windows_result::error::Error::from_win32::h03c3b55a10ff2588
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], edx
lea rax, str.src_main.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1400c70c0]
lea r9, sym.core::ptr::drop_in_place_windows_result::error::Error_::heb60e29f8463fa72
lea r8, [rsp + 0x50]
mov edx, 0x2b
call sym.core::result::unwrap_failed::h068d2ce9302e27b1
jmp 0x140001d9f
call sym.windows_result::error::Error::from_win32::h03c3b55a10ff2588
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], edx
lea rax, str.src_main.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1400c70c0]
lea r9, sym.core::ptr::drop_in_place_windows_result::error::Error_::heb60e29f8463fa72
lea r8, [rsp + 0x50]
mov edx, 0x2b
call sym.core::result::unwrap_failed::h068d2ce9302e27b1
jmp 0x140001d9f
call sym.windows_result::error::Error::from_win32::h03c3b55a10ff2588
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], edx
lea rax, str.src_main.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1400c70c0]
lea r9, sym.core::ptr::drop_in_place_windows_result::error::Error_::heb60e29f8463fa72
lea r8, [rsp + 0x50]
mov edx, 0x2b
call sym.core::result::unwrap_failed::h068d2ce9302e27b1
jmp 0x140001d9f
call sym.windows_result::error::Error::from_win32::h03c3b55a10ff2588
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], edx
lea rax, str.src_main.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1400c70c0]
lea r9, sym.core::ptr::drop_in_place_windows_result::error::Error_::heb60e29f8463fa72
lea r8, [rsp + 0x50]
mov edx, 0x2b
call sym.core::result::unwrap_failed::h068d2ce9302e27b1
jmp 0x140001d9f
call sym.windows_result::error::Error::from_win32::h03c3b55a10ff2588
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], edx
lea rax, str.src_main.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1400c70c0]
lea r9, sym.core::ptr::drop_in_place_windows_result::error::Error_::heb60e29f8463fa72
lea r8, [rsp + 0x50]
mov edx, 0x2b
call sym.core::result::unwrap_failed::h068d2ce9302e27b1
ud2