Function at 0x1400ccccd
Capabilities:
Create process on windows
Create process suspended
Get common file path

Disassembly:
jmp 0x1400dfc40
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x17f8
call fcn.1400ca194
sub rsp, rax
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x46a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1818]
mov rax, qword [0x1402d9238]
xor rax, rbp
mov qword [rbp + 0x1798], rax
lea rcx, [0x14030404c]
call fcn.1400cf004
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x800
rep stosb byte [rdi], al
lea rax, [rbp + 0x830]
mov rdi, rax
xor eax, eax
mov ecx, 0x800
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x17c0]
mov rax, qword [rax + 0x10]
mov qword [rax + 0x10], 0
mov r8d, 0x400
lea rdx, [rbp + 0x10]
mov rax, qword [rbp + 0x17c0]
mov rcx, qword [rax]
call fcn.1400cf96e
test eax, eax
je 0x1400dfef9
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp eax, 0x400
jae 0x1400dfd09
lea rdx, [rbp + 0x830]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rax, qword [rbp + 0x17c0]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x17c0]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x830]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov rax, qword [rbp + 0x17c0]
mov eax, dword [rax + 0x20]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x10]
xor r8d, r8d
mov edx, 2
mov rcx, qword [0x1402dce90]
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
test eax, eax
je 0x1400dfd73
mov eax, 1
jmp 0x1400dff0f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x522
jne 0x1400dfda5
cmp dword [0x1402e2da0], 1
jne 0x1400dfda5
lea r8, [rbp + 0x830]
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x17c0]
call fcn.1400cf379
jmp 0x1400dff0f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1400dfdeb
mov rax, qword [rbp + 0x17c0]
mov rax, qword [rax + 0x10]
cmp dword [rax], 0x48
jne 0x1400dfdeb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x1044], eax
mov rax, qword [rbp + 0x17c0]
mov r8, qword [rax]
mov edx, dword [rbp + 0x1044]
mov ecx, 0x4a
call fcn.1400ca28e
jmp 0x1400dfef7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x1400dfedb
mov rax, qword [rbp + 0x17c0]
mov rcx, qword [rax]
call fcn.1400cbb43
cmp rax, 0x100
jae 0x1400dfedb
lea rax, [rbp + 0x1070]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
lea rdx, str.sysnative
mov rax, qword [rbp + 0x17c0]
mov rcx, qword [rax]
call fcn.1400cbbe8
mov qword [rbp + 0x1188], rax
cmp qword [rbp + 0x1188], 0
je 0x1400dfedb
mov r8d, 0x100
xor edx, edx
lea rcx, [rbp + 0x1070]
call fcn.1400cd75e
mov r8d, 8
lea rdx, str.system32
mov rcx, qword [rbp + 0x1188]
call fcn.1400cbec2
mov rax, qword [rbp + 0x1188]
add rax, 9
mov qword [rbp + 0x1188], rax
mov rcx, qword [rbp + 0x1188]
call fcn.1400cbb43
mov r8, rax
mov rdx, qword [rbp + 0x1188]
lea rcx, [rbp + 0x1070]
call fcn.1400cbec2
mov rax, qword [rbp + 0x1188]
dec rax
lea rdx, [rbp + 0x1070]
mov rcx, rax
call fcn.1400cafd6
mov rcx, qword [rbp + 0x17c0]
call fcn.1400ccccd
jmp 0x1400dff0f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x17c0]
mov r8, qword [rcx]
mov edx, eax
mov ecx, 0x29
call fcn.1400ca28e
jmp 0x1400dff0d
mov rax, qword [rbp + 0x17c0]
mov edx, dword [rax + 8]
mov ecx, 7
call fcn.1400caa5e
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.1400cdefc
mov rax, rdi
mov rcx, qword [rbp + 0x1798]
xor rcx, rbp
call fcn.1400cbea4
lea rsp, [rbp + 0x17a8]
pop rdi
pop rbp
ret