Function at 0x140135860
Capabilities:
Create process on windows
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rdi, rdx
mov rbx, r9
lea rdx, [rsp + 0x50]
mov rsi, r8
call fcn.14015f820
test eax, eax
jns 0x14013589b
lfence
jmp 0x140135aa8
nop dword [rax + rax]
test rdi, rdi
je 0x1401358c5
movzx eax, word [rdi]
mov word [rbp - 0x71], ax
add ax, 2
cmp qword [rdi], 0xfffe
mov word [rbp - 0x6f], ax
mov rax, qword [rdi + 8]
mov qword [rbp - 0x69], rax
ja 0x1401358ea
test rbx, rbx
je 0x1401358f4
movzx eax, word [rbx]
mov word [rbp - 0x61], ax
add ax, 2
cmp qword [rbx], 0xfffe
mov word [rbp - 0x5f], ax
mov rax, qword [rbx + 8]
mov qword [rbp - 0x59], rax
jbe 0x1401358f4
mov eax, 0xc0000106
jmp 0x140135aa8
mov rdx, qword [rbp + 0x57]
mov qword [rsp + 0x110], r14
xor r14d, r14d
test rdx, rdx
je 0x140135917
mov r8, qword [rdx + 8]
mov rcx, qword [rdx + 0x10]
test r8, r8
jne 0x14013591f
jmp 0x14013591a
mov rcx, r14
lea r8, [rsp + 0x50]
nop
test rcx, rcx
jne 0x14013593d
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x20]
add rcx, 0xc0
nop dword [rax]
test rdx, rdx
je 0x140135952
mov r10, qword [rdx + 0x20]
mov r11, qword [rdx + 0x18]
mov rdx, qword [rdx]
jmp 0x14013595b
mov r10, r14
mov r11, r14
mov rdx, r14
mov qword [rsp + 0x48], r10
lea r9, [rsp + 0x50]
mov qword [rsp + 0x40], r11
lea rax, [rbp - 0x71]
mov qword [rsp + 0x38], rcx
test rdi, rdi
mov qword [rsp + 0x30], r8
lea rcx, [rbp - 0x79]
cmove rax, r9
mov qword [rsp + 0x28], rsi
mov r8, rdx
mov qword [rsp + 0x20], rax
test rbx, rbx
lea r9, [rbp - 0x61]
lea rdx, [rsp + 0x50]
cmove r9, r14
call qword [sym.imp.ntdll.dll_RtlCreateProcessParameters]
mov edi, dword [rbp + 0x5f]
mov ebx, eax
test eax, eax
js 0x140135a0f
mov r8, qword [rbp - 0x79]
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x48], rcx
movzx eax, dil
mov qword [rsp + 0x40], r14
lea rcx, [rsp + 0x50]
and al, 1
mov qword [rsp + 0x38], r14
mov byte [rsp + 0x30], al
xor r9d, r9d
mov rax, qword [rbp + 0x67]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea edx, [r9 + 0x40]
call qword [sym.imp.ntdll.dll_RtlCreateUserProcess]
mov ebx, eax
xor edx, edx
mov rax, qword gs:[0x30]
mov r8, qword [rbp - 0x79]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp qword [rsp + 0x58], 0
mov r14, qword [rsp + 0x110]
je 0x140135a45
mov rax, qword gs:[0x30]
xor edx, edx
mov r8, qword [rsp + 0x58]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
test ebx, ebx
js 0x140135aa6
test dil, 4
jne 0x140135a5b
mov rcx, qword [rbp - 0x39]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtResumeThread]
mov rax, qword ds:[rbp + 0x6f]
test rax, rax
je 0x140135a6c
movups xmm0, xmmword [rbp - 0x31]
movups xmmword [rax], xmm0
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x140135a7e
mov rax, qword [rbp - 0x41]
mov qword [rcx], rax
jmp 0x140135a88
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x140135a9a
mov rax, qword [rbp - 0x39]
mov qword [rcx], rax
jmp 0x140135aa6
mov rcx, qword ds:[rbp - 0x39]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret