Function at 0x140005180
Capabilities:
Create process on windows
Create process suspended
Create thread
Get common file path
Resume thread
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x620]
sub rsp, 0x720
mov rax, qword [0x14000f068]
xor rax, rsp
mov qword [rbp + 0x610], rax
mov esi, edx
mov r15, rcx
xor edx, edx
xor ecx, ecx
mov r12, r8
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
nop dword [rax + rax]
mov r14, rax
mov ebx, 0x80004005
test rax, rax
jne 0x140005205
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
test ebx, ebx
js 0x140005560
mov ebx, eax
mov edx, 0x104
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test byte [0x14000f901], 0x20
mov edi, eax
je 0x140005234
mov r8, r15
lea rdx, [0x14000ae50]
call fcn.140004e84
lea eax, [rdi - 1]
cmp eax, 0x102
ja 0x140005551
lea r8, str.RunDLL32.EXE
mov edx, 0x104
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchAppend]
nop dword [rax + rax]
test eax, eax
js 0x140005551
mov r9d, 0x400
mov qword [rsp + 0x20], r15
lea r8, str.RunDLL32.EXE_Shell32.DLL_ShellExec_RunDLL__0x_X__s
mov edx, 0x208
lea rcx, [rbp + 0x200]
call fcn.140002830
test eax, eax
js 0x140005551
xor edx, edx
mov dword [rbp - 0x80], 0x68
lea rcx, [rbp - 0x78]
lea r8d, [rdx + 0x60]
call sub.msvcrt.dll_memset
xor eax, eax
lea rdx, [rbp + 0x200]
mov qword [rsp + 0x60], rax
lea rcx, [rbp - 0x10]
lea rax, [rsp + 0x50]
xorps xmm0, xmm0
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp - 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
and dword [rsp + 0x20], 0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
nop dword [rax + rax]
test eax, eax
jne 0x140005331
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
mov edi, 0x80004005
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, edi
test ebx, ebx
js 0x140005551
jmp 0x140005336
mov edi, 0x80004005
mov rdx, qword [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
nop dword [rax + rax]
test eax, eax
je 0x140005352
xor ebx, ebx
jmp 0x140005379
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, edi
test ebx, ebx
js 0x140005519
test sil, 2
je 0x1400054c5
mov r9d, 1
xor r8d, r8d
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [sym.imp.api_ms_win_core_io_l1_1_0.dll_CreateIoCompletionPort]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1400053e8
mov r9d, 0x10
mov qword [rsp + 0x68], r14
lea r8, [rsp + 0x68]
mov qword [rsp + 0x70], rax
mov rcx, r14
lea edx, [r9 - 9]
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
nop dword [rax + rax]
test eax, eax
jne 0x1400053e3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
xor edi, edi
test rdi, rdi
jne 0x140005418
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
mov r12d, 0x80004005
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, r12d
test ebx, ebx
js 0x1400054e9
jmp 0x14000541e
mov r12d, 0x80004005
lea rax, [rsp + 0x78]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x140005130]
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x140005453
xor ebx, ebx
jmp 0x140005477
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, r12d
test ebx, ebx
js 0x1400054b4
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
nop dword [rax + rax]
xor r8d, r8d
mov qword [rsp + 0x68], rsi
test rsi, rsi
lea rdx, [rsp + 0x68]
setne r8b
or r9d, 0xffffffff
call fcn.140005928
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x1400054e9
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
nop dword [rax + rax]
test sil, 0x40
je 0x1400054e9
mov rdx, qword [rsp + 0x50]
mov rcx, r12
call fcn.140005824
test byte [0x14000f901], 0x20
je 0x140005515
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetProcessId]
nop dword [rax + rax]
mov r9, r15
lea rdx, [0x14000add0]
mov r8d, eax
call fcn.140005890
test ebx, ebx
jns 0x14000552f
mov rcx, qword [rsp + 0x50]
mov edx, 5
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x610]
xor rcx, rsp
call fcn.140009590
lea r11, [rsp + 0x720]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret