Function at 0x140046e40
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov byte [rax + 0x20], r9b
mov qword [rax + 8], rcx
sub rsp, 0x118
mov qword [rax + 0x10], rbx
mov qword [rax - 8], rbp
mov qword [rax - 0x10], rsi
mov rsi, rcx
mov qword [rax - 0x18], rdi
mov rcx, rdx
mov qword [rax - 0x20], r12
movzx edi, r9b
mov qword [rax - 0x28], r13
mov r12, r8
mov qword [rax - 0x30], r14
mov qword [rax - 0x38], r15
call sym.ProcessHacker.exe_PhGetStringSetting
mov edx, 0x3a
xor r8d, r8d
mov rcx, rax
mov rbp, rax
call sym.ProcessHacker.exe_PhFindCharInStringRef
or r14, 0xffffffffffffffff
cmp rax, r14
jne 0x140046ecb
mov rcx, qword [0x14015e7d0]
mov rdx, rbp
call sym.ProcessHacker.exe_PhConcatStringRef2
mov rbx, rax
lea rcx, [rbp - 0x10]
mov edx, r14d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x140046ec8
call fcn.1400258b0
mov rbp, rbx
movups xmm0, xmmword [rbp]
xor r8d, r8d
lea rdx, [0x1401558d0]
mov rcx, rbp
movups xmmword [rsp + 0x60], xmm0
call sym.ProcessHacker.exe_PhFindStringInStringRef
xor r13d, r13d
cmp rax, 0xffffffffffffffff
je 0x140046fc1
mov rdx, qword [rsp + 0x68]
lea rcx, [rax + rax]
mov r13, qword [rsp + 0x60]
add rdx, rcx
add rdx, qword [0x1401558d0]
sub r13, rcx
sub r13, qword [0x1401558d0]
mov rsi, r14
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rcx
inc rsi
cmp word [r12 + rsi*2], 0
jne 0x140046f22
mov rbx, qword [0x14015f3f8]
add rsi, rsi
lea rdi, [rsi + r13]
add rdi, rcx
mov rcx, rbx
lea rdx, [rdi + 0x12]
call fcn.1400257d0
lock inc dword [rbx + 4]
mov rdx, qword [rsp + 0x68]
lea r15, [rax + 0x10]
mov dword [rax + 8], 1
movzx ecx, byte [rbx + 2]
mov word [rax], cx
lea rax, [r15 + 0x10]
xor ecx, ecx
mov qword [r15 + 8], rax
mov qword [r15], rdi
mov word [rax + rdi], cx
mov rbx, qword [r15 + 8]
mov rdi, qword [rsp + 0x50]
mov rcx, rbx
mov r8, rdi
call fcn.1400e19b0
add rbx, rdi
mov r8, rsi
mov rcx, rbx
mov rdx, r12
call fcn.1400e19b0
mov rdx, qword [rsp + 0x58]
lea rcx, [rsi + rbx]
mov r8, r13
call fcn.1400e19b0
mov rsi, qword [rsp + 0x120]
xor r13d, r13d
movzx edi, byte [rsp + 0x138]
jmp 0x140046fc8
mov r15, rbp
lock inc dword [rbp - 8]
lea rcx, [rbp - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
mov r12, qword [rsp + 0xf8]
mov rbp, qword [rsp + 0x110]
cmp eax, 1
jne 0x140046fee
call fcn.1400258b0
test dil, dil
je 0x14004703f
mov rbx, qword [r15 + 8]
lea rcx, [rsp + 0x74]
xor edx, edx
mov dword [rsp + 0x70], 0x70
lea r8d, [rdx + 0x6c]
call fcn.1400e2690
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], r13
mov dword [rsp + 0xa0], 5
mov qword [rsp + 0x78], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x1400470e1
mov rdx, qword [r15 + 8]
xor r9d, r9d
mov qword [rsp + 0x48], r13
xor r8d, r8d
mov qword [rsp + 0x40], r13
xor ecx, ecx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call sym.ProcessHacker.exe_PhCreateProcessWin32Ex
test eax, eax
jns 0x1400470e1
mov rdi, qword [rsp + 0x140]
test rdi, rdi
je 0x1400470cc
mov ecx, eax
call sym.ProcessHacker.exe_PhGetNtMessage
mov rbx, rax
test rax, rax
je 0x140047094
mov r9, qword [rax + 8]
jmp 0x14004709b
lea r9, str.An_unknown_error_occurred.
lea r8, str.Unable_to_execute_the_command:__s_n_s
mov qword [rsp + 0x20], rdi
mov edx, 0x10
mov rcx, rsi
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400470e1
call fcn.1400258b0
jmp 0x1400470e1
xor r9d, r9d
lea rdx, str.Unable_to_execute_the_command
mov r8d, eax
mov rcx, rsi
call sym.ProcessHacker.exe_PhShowStatus
lea rcx, [r15 - 0x10]
lock xadd dword [rcx + 8], r14d
mov r15, qword [rsp + 0xe0]
cmp r14d, 1
mov r14, qword [rsp + 0xe8]
mov r13, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0x100]
mov rsi, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x128]
jne 0x140047126
call fcn.1400258b0
add rsp, 0x118
ret