Function at 0x16003ec60
Capabilities:
Create process on windows
Resume thread

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x218]
sub rsp, 0x2f0
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov edi, edx
mov rsi, rcx
lea r12, [rcx + 0x140]
mov qword [rbp - 0x70], r12
mov r14d, 1
mov dword [rbp - 0x68], r14d
mov rcx, r12
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop
test dword [0x160274340], 0x800
jne 0x160094b66
lea r15, [0x1601db300]
xor r13d, r13d
test edi, edi
jne 0x160094b7f
mov rax, qword [rsi + 0x1038]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x16003ed38
mov edi, r13d
test r14d, r14d
je 0x16003ed06
mov rcx, r12
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov eax, edi
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.16006e590
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.160068f7c
nop
test al, al
je 0x16003ed5c
cmp qword [rsi + 0x1088], r13
je 0x160094bac
cmp qword [rsi + 0x1098], r13
je 0x160094bc1
mov rcx, qword [rsi + 0x1050]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
test eax, eax
sete al
mov rcx, qword [rbp + 0x218]
test al, al
jne 0x160094bec
lea rcx, [rbp + 0x20]
call fcn.160040b68
nop
lea rdx, str.SearchFilterHost.exe
lea rcx, [rbp + 0x110]
call fcn.16005a488
nop
mov r9d, dword [rax + 0x14]
mov rdx, qword [rax + 8]
mov rax, qword [rbp + 0x20]
mov r8d, dword [rbp + 0x34]
lea rcx, [rbp + 0x20]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
nop
lea rcx, [rbp + 0x110]
call fcn.160040b2c
mov rax, qword [rbp + 0x20]
or ebx, 0xffffffff
mov r9d, ebx
mov r8d, dword [rbp + 0x34]
lea rdx, [0x1601d6c90]
lea rcx, [rbp + 0x20]
mov rax, qword [rax + 0x18]
call qword [case.0x16003fc5a.0]
mov rax, qword [rbp + 0x20]
mov r9d, ebx
mov r8d, dword [rbp + 0x34]
lea rcx, [rbp + 0x20]
mov rax, qword [rax + 0x18]
cmp dword [rsi + 0xf28], r14d
lea rdx, [0x160203b84]
ja 0x16003ee13
lea rdx, [0x1601d6c8c]
call qword [case.0x16003fc5a.0]
mov r9, qword [rsi + 0x1028]
lea rdx, [rbp + 0x1b0]
call fcn.16003e798
mov edi, eax
test eax, eax
js 0x160094bff
mov rax, qword [rbp + 0x20]
mov r9d, ebx
mov r8d, dword [rbp + 0x34]
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x20]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov rax, qword [rbp + 0x20]
mov r9d, ebx
mov r8d, dword [rbp + 0x34]
lea rdx, [0x1601d66f8]
lea rcx, [rbp + 0x20]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov r9, qword [rsi + 0x1050]
lea rdx, [rbp + 0x1b0]
call fcn.16003e798
mov edi, eax
test eax, eax
js 0x160094c06
mov rax, qword [rbp + 0x20]
mov r9d, ebx
mov r8d, dword [rbp + 0x34]
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x20]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov rax, qword [rbp + 0x20]
mov r9d, ebx
mov r8d, dword [rbp + 0x34]
lea rdx, [0x1601d66f8]
lea rcx, [rbp + 0x20]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov r9, qword [rsi + 0x1078]
lea rdx, [rbp + 0x1b0]
call fcn.16003e798
mov edi, eax
test eax, eax
js 0x160094c0d
mov rax, qword [rbp + 0x20]
mov r9d, ebx
mov r8d, dword [rbp + 0x34]
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x20]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov rax, qword [rbp + 0x20]
mov r9d, ebx
mov r8d, dword [rbp + 0x34]
lea rdx, [0x1601d66f8]
lea rcx, [rbp + 0x20]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
lea rdi, [rbp + 0x1b0]
xor eax, eax
lea edx, [rax + 0x15]
mov ecx, edx
rep stosb byte [rdi], al
mov r9d, 0x2000
lea r8, [0x1601d65a4]
lea rcx, [rbp + 0x1b0]
call fcn.160059e34
mov edi, eax
test eax, eax
js 0x160094c14
mov rax, qword [rbp + 0x20]
mov r9d, ebx
mov r8d, dword [rbp + 0x34]
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x20]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov rax, qword [rbp + 0x20]
mov r9d, ebx
mov r8d, dword [rbp + 0x34]
lea rdx, [0x1601d66f8]
lea rcx, [rbp + 0x20]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov r9, qword [rsi + 0x1058]
lea rdx, [rbp + 0x1b0]
call fcn.16003e798
mov edi, eax
test eax, eax
js 0x160094c1b
cmp dword [rsi + 0xfa4], r13d
jne 0x16003f27c
mov rax, qword [rbp + 0x20]
mov r9d, ebx
mov r8d, dword [rbp + 0x34]
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x20]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov rax, qword [rbp + 0x20]
mov r9d, ebx
mov r8d, dword [rbp + 0x34]
lea rdx, [0x1601d66f8]
lea rcx, [rbp + 0x20]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
lea rdi, [rbp - 0x50]
xor eax, eax
lea edx, [rax + 0x68]
mov ecx, edx
rep stosb byte [rdi], al
mov dword [rbp - 0x50], edx
lea rax, str.mssrestricteddesk
mov qword [rbp - 0x40], rax
lea rax, str.p__f_
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov edx, 0x8f
lea rcx, [rsp + 0x60]
call fcn.16005ea70
test al, al
je 0x160094c38
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xd0], r13
lea rax, [0x1601bc3d0]
mov qword [rbp + 0xc0], rax
lea rax, [rsp + 0x60]
mov qword [rbp + 0xd8], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xf0], xmm1
movsd xmm0, qword [0x1601f6ab8]
movsd qword [rbp + 0x100], xmm0
mov eax, dword [0x1601f6ac0]
mov dword [rbp + 0x108], eax
mov dword [rbp + 0x10c], 0x221
lea rcx, [rbp + 0xc0]
call fcn.16005fce8
test al, al
je 0x160094c53
mov ebx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1600bfd80]
lea rcx, [0x160273cd0]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitOnceExecuteOnce]
mov eax, 0x100000c
cmp byte [0x1602742e0], r13b
cmovne ebx, eax
mov rdi, qword [rbp + 0xc8]
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.160034ad4
mov r8, rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessAsUserW]
test eax, eax
je 0x160094c5d
lea r15, [rsi + 0x1038]
mov rdx, qword [rsp + 0x78]
mov rcx, r15
call fcn.1600161cc
mov eax, dword [rbp - 0x78]
mov dword [rsi + 0x10ac], eax
lea rbx, [rsi + 0x1040]
mov rdx, qword [rbp - 0x80]
mov rcx, rbx
call fcn.1600161cc
test dword [0x160274340], 0x800
jne 0x160094c67
mov rcx, rsi
call fcn.16003e980
mov edi, eax
test eax, eax
js 0x160094c7d
mov rdx, qword [r15]
mov rcx, qword [rsi + 0x1048]
call qword [sym.imp.api_ms_win_core_job_l2_1_0.dll_AssignProcessToJobObject]
test eax, eax
je 0x160094c9e
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x160094ca5
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov dword [rsi + 0x10a4], eax
mov edx, 0x1d4c0
mov rcx, qword [rsi + 0x1050]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test eax, eax
jne 0x160094cc4
cmp dword [rsi + 0xfa4], r13d
jne 0x160094cd2
mov rcx, rsi
call fcn.16003e6b0
mov edi, eax
test eax, eax
js 0x160094cee
mov rcx, r12
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov r14d, r13d
mov dword [rbp - 0x68], r13d
lea rdx, [0x160056f30]
mov rcx, rsi
call fcn.16003e3bc
nop
lea rcx, [rbp + 0xc0]
call fcn.16005fd74
nop
lea rax, str.p__f_
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x16003f25a
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rsp + 0x68], r13
mov rcx, qword [rsp + 0x70]
test rcx, rcx
jne 0x16003f281
mov qword [rsp + 0x70], r13
lea rcx, [rbp + 0x20]
call fcn.160040b2c
jmp 0x16003ecf8
mov edi, r13d
jmp 0x16003f26e
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x16003f269
lea rdx, [0x1601f92a8]
lea rcx, [0x16026f450]
call fcn.1600e979c
nop
jmp 0x16003ecd3
mov rcx, rsi
call fcn.16003e7c8
mov rcx, qword [rbp + 0x218]
test eax, eax
jns 0x16003ed38
mov r9d, eax
mov r8, r15
mov edx, 0x9f5
call fcn.160071f6c
nop
jmp 0x16003ed38
mov edi, dword [rsi + 0x1090]
test edi, edi
jns 0x16003ecf8
mov edx, 0x9fe
jmp 0x160094bd4
mov edi, dword [rsi + 0x10a0]
test edi, edi
jns 0x16003ecf8
mov edx, 0x9ff
mov r8, r15
mov r9d, edi
mov rcx, qword [rbp + 0x218]
call fcn.1600b29f8
nop
jmp 0x16003ecf8
mov r8, r15
mov edx, 0xa04
call fcn.160108704
nop
jmp 0x16003ed7d
mov edx, 0xa29
jmp 0x160094c20
mov edx, 0xa2e
jmp 0x160094c20
mov edx, 0xa33
jmp 0x160094c20
mov edx, 0xa3a
jmp 0x160094c20
mov edx, 0xa3f
mov rcx, qword [rbp + 0x218]
mov r9d, eax
mov r8, r15
call fcn.1600b29f8
nop
jmp 0x16003f26e
mov rcx, qword [rbp + 0x218]
mov r8, r15
mov edx, 0xa58
call fcn.1600b29e0
mov edi, eax
jmp 0x16003f23e
mov r8, r15
mov edx, 0xa5c
jmp 0x160094cb1
mov r8, r15
mov edx, 0xa6e
jmp 0x160094cb1
mov r8d, dword [rbp - 0x78]
lea rdx, [0x1601f95d8]
call fcn.1600c260c
nop
jmp 0x16003f190
mov rcx, qword [rbp + 0x218]
mov r9d, eax
lea r8, [0x1601db300]
mov edx, 0xa76
call fcn.1600b29f8
nop
jmp 0x16003f231
mov edx, 0xa78
jmp 0x160094caa
mov edx, 0xa7b
lea r8, [0x1601db300]
mov rcx, qword [rbp + 0x218]
call fcn.1600b29e0
mov edi, eax
jmp 0x16003f231
cmp eax, 0x102
je 0x160094ce9
cmp eax, 0x80
je 0x160094ce9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x160094cee
movzx edi, ax
or edi, 0x80070000
jmp 0x160094cee
mov edi, 0x800705b4
mov rcx, rsi
call fcn.16003e7c8
nop
jmp 0x16003f231