Function at 0x1400ff960
Capabilities:
Create process on windows
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rbx, r9
mov rsi, r8
mov rdi, rdx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
test eax, eax
js 0x1400ffb7a
nop
test rdi, rdi
je 0x1400ff9c5
movzx eax, word [rdi]
mov word [rbp - 0x71], ax
add ax, 2
cmp qword [rdi], 0xfffe
mov word [rbp - 0x6f], ax
mov rax, qword [rdi + 8]
mov qword [rbp - 0x69], rax
ja 0x1400ff9ea
test rbx, rbx
je 0x1400ff9f4
movzx eax, word [rbx]
mov word [rbp - 0x61], ax
add ax, 2
cmp qword [rbx], 0xfffe
mov word [rbp - 0x5f], ax
mov rax, qword [rbx + 8]
mov qword [rbp - 0x59], rax
jbe 0x1400ff9f4
mov eax, 0xc0000106
jmp 0x1400ffb7a
mov rdx, qword [rbp + 0x57]
mov qword [rsp + 0x110], r14
xor r14d, r14d
test rdx, rdx
je 0x1400ffa17
mov r8, qword [rdx + 8]
mov rcx, qword [rdx + 0x10]
test r8, r8
jne 0x1400ffa1f
jmp 0x1400ffa1a
mov rcx, r14
lea r8, [rsp + 0x58]
nop
test rcx, rcx
jne 0x1400ffa3d
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x20]
add rcx, 0xc0
nop dword [rax]
test rdx, rdx
je 0x1400ffa52
mov r10, qword [rdx + 0x20]
mov r11, qword [rdx + 0x18]
mov rdx, qword [rdx]
jmp 0x1400ffa5b
mov r10, r14
mov r11, r14
mov rdx, r14
mov qword [rsp + 0x48], r10
lea r9, [rsp + 0x58]
mov qword [rsp + 0x40], r11
lea rax, [rbp - 0x71]
mov qword [rsp + 0x38], rcx
test rdi, rdi
mov qword [rsp + 0x30], r8
lea rcx, [rsp + 0x50]
cmove rax, r9
mov qword [rsp + 0x28], rsi
mov r8, rdx
mov qword [rsp + 0x20], rax
test rbx, rbx
lea r9, [rbp - 0x61]
lea rdx, [rsp + 0x58]
cmove r9, r14
call qword [sym.imp.ntdll.dll_RtlCreateProcessParameters]
mov edi, dword [rbp + 0x5f]
mov ebx, eax
test eax, eax
js 0x1400ffaff
mov r8, qword [rsp + 0x50]
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x48], rcx
movzx eax, dil
mov qword [rsp + 0x40], r14
lea rcx, [rsp + 0x58]
and al, 1
mov qword [rsp + 0x38], r14
mov byte [rsp + 0x30], al
xor r9d, r9d
mov rax, qword [rbp + 0x67]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea edx, [r9 + 0x40]
call qword [sym.imp.ntdll.dll_RtlCreateUserProcess]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlDestroyProcessParameters]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov r14, qword [rsp + 0x110]
test ebx, ebx
js 0x1400ffb78
test dil, 4
jne 0x1400ffb28
mov rcx, qword [rbp - 0x39]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtResumeThread]
mov rax, qword [rbp + 0x6f]
test rax, rax
je 0x1400ffb38
movups xmm0, xmmword [rbp - 0x31]
movups xmmword [rax], xmm0
mov rcx, qword ds:[rbp + 0x77]
test rcx, rcx
je 0x1400ffb4e
mov rax, qword [rbp - 0x41]
mov qword [rcx], rax
jmp 0x1400ffb58
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword ds:[rbp + 0x7f]
test rcx, rcx
je 0x1400ffb6e
mov rax, qword [rbp - 0x39]
mov qword [rcx], rax
jmp 0x1400ffb78
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret