Function at 0x1400c3ad0
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x300
xor ebx, ebx
or rbp, 0xffffffffffffffff
mov r13, r9
mov r15, rdx
mov r12, rcx
mov esi, ebx
mov r14d, ebx
test rdx, rdx
je 0x1400c3b4d
mov rdi, rbp
nop dword [rax + rax]
inc rdi
cmp word [rdx + rdi*2], bx
jne 0x1400c3b10
mov rdx, qword [0x140196800]
add rdi, rdi
lea rcx, [rdi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r14, rax
mov r8, rdi
mov rdx, r15
mov qword [rax], rdi
add rax, 0x10
mov qword [r14 + 8], rax
mov word [rax + rdi], bx
mov rcx, qword [r14 + 8]
call fcn.14010e700
test r12, r12
je 0x1400c3b98
mov rdi, rbp
inc rdi
cmp word [r12 + rdi*2], bx
jne 0x1400c3b55
mov rdx, qword [0x140196800]
add rdi, rdi
lea rcx, [rdi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rsi, rax
mov r8, rdi
mov rdx, r12
mov qword [rax], rdi
add rax, 0x10
mov qword [rsi + 8], rax
mov word [rax + rdi], bx
mov rcx, qword [rsi + 8]
call fcn.14010e700
jmp 0x1400c3ca1
test r14, r14
je 0x1400c3ca1
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x340]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r12, rax
test rax, rax
je 0x1400c3ca1
mov rsi, qword [rax]
mov rdi, rbp
inc rdi
cmp word [rsi + rdi*2], bx
jne 0x1400c3bc5
mov rdx, qword [0x140196800]
add rdi, rdi
lea rcx, [rdi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r15, rax
mov qword [rax], rdi
add rax, 0x10
mov qword [r15 + 8], rax
mov word [rax + rdi], bx
test rsi, rsi
je 0x1400c3c07
mov rcx, qword [r15 + 8]
mov r8, rdi
mov rdx, rsi
call fcn.14010e700
mov rcx, r12
mov rsi, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [r15 + 8]
call qword [sym.imp.ntdll.dll_RtlDoesFileExists_U]
test al, al
jne 0x1400c3ca1
mov rcx, qword [r15 + 8]
lea r8, [rsp + 0xf0]
call fcn.1400c7af0
test al, al
je 0x1400c3c89
lea rax, [rsp + 0xf0]
mov rdi, rbp
inc rdi
cmp word [rax + rdi*2], bx
jne 0x1400c3c45
mov rdx, qword [0x140196800]
add rdi, rdi
lea rcx, [rdi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rsi, rax
lea rdx, [rsp + 0xf0]
mov r8, rdi
mov qword [rax], rdi
add rax, 0x10
mov qword [rsi + 8], rax
mov word [rax + rdi], bx
mov rcx, qword [rsi + 8]
call fcn.14010e700
jmp 0x1400c3c8c
mov rsi, rbx
lea rcx, [r15 - 0x10]
mov eax, ebp
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400c3ca1
call fcn.1400c8bc0
mov edi, dword [rsp + 0x368]
mov ecx, edi
mov r15, qword [rsp + 0x360]
and ecx, 2
shl ecx, 9
mov eax, edi
mov edx, ecx
or edx, 4
and al, 4
mov eax, edi
cmove edx, ecx
mov ecx, edx
bts ecx, 0x18
and al, 8
mov eax, edi
cmove ecx, edx
mov edx, ecx
or edx, 0x10
and al, 0x10
mov eax, edi
cmove edx, ecx
mov r12d, edx
bts r12d, 0x13
and al, 0x20
cmove r12d, edx
test r15, r15
jne 0x1400c3d10
xor edx, edx
lea r8d, [r15 + 0x68]
lea rcx, [rsp + 0x80]
call fcn.14010ed90
mov dword [rsp + 0x80], 0x68
mov rcx, qword [rsp + 0x370]
test rcx, rcx
je 0x1400c3d85
test r14, r14
je 0x1400c3d28
mov r8, qword [r14 + 8]
jmp 0x1400c3d2b
mov r8, rbx
test rsi, rsi
je 0x1400c3d36
mov rdx, qword [rsi + 8]
jmp 0x1400c3d39
mov rdx, rbx
test r15, r15
lea r9, [rsp + 0x60]
mov qword [rsp + 0x50], r9
lea rax, [rsp + 0x80]
cmovne rax, r15
and edi, 1
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov rax, qword [rsp + 0x350]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x1400c3de9
test r14, r14
je 0x1400c3d90
mov rdx, qword [r14 + 8]
jmp 0x1400c3d93
mov rdx, rbx
test rsi, rsi
je 0x1400c3d9e
mov rcx, qword [rsi + 8]
jmp 0x1400c3da1
mov rcx, rbx
test r15, r15
lea r8, [rsp + 0x60]
mov qword [rsp + 0x48], r8
lea rax, [rsp + 0x80]
cmovne rax, r15
and edi, 1
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov rax, qword [rsp + 0x350]
xor r8d, r8d
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400c3e04
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1400c3dfb
mov ebx, eax
jmp 0x1400c3e04
movzx ebx, ax
or ebx, 0xc0070000
test rsi, rsi
je 0x1400c3e1e
lea rcx, [rsi - 0x10]
mov eax, ebp
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400c3e1e
call fcn.1400c8bc0
test r14, r14
je 0x1400c3e36
lea rcx, [r14 - 0x10]
lock xadd dword [rcx + 8], ebp
cmp ebp, 1
jne 0x1400c3e36
call fcn.1400c8bc0
test ebx, ebx
js 0x1400c3e9f
mov rcx, qword [rsp + 0x378]
test rcx, rcx
je 0x1400c3e56
mov eax, dword [rsp + 0x70]
mov qword [rcx], rax
mov eax, dword [rsp + 0x74]
mov qword [rcx + 8], rax
mov rcx, qword [rsp + 0x380]
test rcx, rcx
je 0x1400c3e6d
mov rax, qword [rsp + 0x60]
mov qword [rcx], rax
jmp 0x1400c3e7d
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400c3e7d
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rsp + 0x388]
mov rcx, qword [rsp + 0x68]
test rax, rax
je 0x1400c3e94
mov qword [rax], rcx
jmp 0x1400c3e9f
test rcx, rcx
je 0x1400c3e9f
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rbx, qword [rsp + 0x358]
add rsp, 0x300
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret