Function at 0x14003f0e0
Capabilities:
Accept command line arguments
Create process on windows
Get number of processors
Parse pe header

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x38]
sub rsp, 0x138
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rbp + 0x18], rax
xorps xmm0, xmm0
mov dword [rbp - 0x60], 0x70
xor eax, eax
mov bl, 1
cmp dword [0x140237d34], 0x68
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp + 8], rax
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
jb 0x14003f6be
call fcn.140072e80
nop dword [rax]
test al, al
je 0x14003f6be
mov rax, qword gs:[0x30]
lea rdx, [0x14023a998]
mov qword [rsp + 0x158], rdi
xor r8d, r8d
mov qword [rsp + 0x120], r15
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x20]
lea rcx, [rbp - 0x78]
movzx edi, word [rax + 0x70]
mov r15, qword [rax + 0x78]
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], r15
call sym.ProcessHacker.exe_PhFindStringInStringRef
cmp rax, 0xffffffffffffffff
jne 0x14003f687
mov r9, qword [0x14023a978]
nop dword [rax]
cmp r9, rdi
ja 0x14003f258
mov rdx, qword [str.__nomp]
mov ecx, edi
sub rcx, r9
mov r8, r9
add rcx, r15
cmp byte [0x140244611], bl
jb 0x14003f202
shr r8, 4
test r8, r8
je 0x14003f1f5
nop dword [rax]
movdqu xmm0, xmmword [rdx]
movdqu xmm1, xmmword [rcx]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x14003f258
add rcx, 0x10
add rdx, 0x10
sub r8, 1
jne 0x14003f1d0
mov r8, r9
shr r8, 1
and r8d, 7
jmp 0x14003f230
shr r8, 3
test r8, r8
je 0x14003f226
nop dword [rax + rax]
mov rax, qword [rdx]
cmp qword [rcx], rax
jne 0x14003f258
add rcx, 8
add rdx, 8
sub r8, 1
jne 0x14003f210
mov r8, r9
shr r8, 1
and r8d, 3
test r8, r8
je 0x14003f687
sub rdx, rcx
nop dword [rax]
movzx eax, word [rcx]
cmp ax, word [rdx + rcx]
jne 0x14003f258
add rcx, 2
sub r8, 1
jne 0x14003f240
jmp 0x14003f687
mov rdx, qword [0x1402418e8]
lea rbx, [rdi + r9]
lea rcx, [rbx + 0x12]
mov qword [rsp + 0x150], rsi
mov qword [rsp + 0x128], r14
call sym.ProcessHacker.exe_PhCreateObject
xor esi, esi
mov qword [rsp + 0x58], rax
mov r8, rdi
mov rdx, r15
mov r14, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], si
mov rcx, qword [rax + 8]
call fcn.140188690
mov rcx, qword [r14 + 8]
mov r8, qword [0x14023a978]
add rcx, rdi
mov rdx, qword [str.__nomp]
call fcn.140188690
lea rcx, [0x1401db740]
call fcn.1400f9d00
lea r14, [rsi - 1]
test rax, rax
je 0x14003f65b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003f65b
mov edx, dword [rax + 0x3c]
lea ecx, [rdx - 1]
cmp ecx, 0x7ffffffd
ja 0x14003f65b
cmp dword [rdx + rax], 0x4550
jne 0x14003f65b
add rdx, 0x88
add rdx, rax
mov ecx, dword [rdx]
test ecx, ecx
je 0x14003f65b
nop dword [rax]
cmp dword [rdx + 4], esi
je 0x14003f65b
lea r8, ds:[rax + rcx]
mov word [rsp + 0x20], si
mov rcx, rax
lea r9, str.LdrSystemDllInitBlock
call fcn.1400fa1a0
test rax, rax
je 0x14003f65b
mov edx, dword ds:[rax]
lea rcx, [rax + 0xb8]
add rdx, rax
cmp rcx, rdx
ja 0x14003f65b
mov rax, qword ds:[rax + 0xa0]
movabs rbx, 0x110011100111000
and rax, rbx
cmp rax, rbx
je 0x14003f65b
lea r9, [rbp - 0x68]
xor r8d, r8d
lea edx, [rsi + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x14003f3af
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14003f65b
mov r8, qword ds:[rbp - 0x68]
mov edx, 4
mov rcx, qword [0x140241998]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r8d, r8d
lea r9, [rbp - 0x68]
mov rcx, rax
mov qword [rbp + 8], rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
nop
test eax, eax
je 0x14003f65b
mov rcx, qword [rbp + 8]
lea r9, [rbp + 0x10]
mov qword [rsp + 0x30], rsi
xor edx, edx
mov qword [rsp + 0x28], rsi
mov r8d, 0x20007
mov qword [rsp + 0x20], 8
mov qword [rbp + 0x10], rbx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x14003f65b
mov qword [rsp + 0x160], r12
mov rbx, rsi
mov r12, qword [rsp + 0x58]
mov r15, rsi
mov qword [rsp + 0x130], r13
mov r13, rsi
mov r12, qword [r12 + 8]
test r12, r12
je 0x14003f535
mov rdi, r14
nop dword [rax]
inc rdi
cmp word [r12 + rdi*2], bx
jne 0x14003f450
mov rdx, qword [0x1402418e8]
add rdi, rdi
lea rcx, [rdi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r8, rdi
mov rdx, r12
mov r15, rax
lea rcx, [rax + 0x10]
mov qword [rax], rdi
mov qword [rax + 8], rcx
mov word [rdi + rcx], si
mov rcx, qword [rax + 8]
call fcn.140188690
mov rcx, qword [r15 + 8]
lea rdx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
test rax, rax
je 0x14003f535
mov rcx, qword [rax]
call sym.ProcessHacker.exe_PhCreateString
mov rcx, rdi
mov rbx, rax
mov r12, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbx, rbx
je 0x14003f535
mov rcx, qword [rbx + 8]
call sym.ProcessHacker.exe_PhDoesFileExistsWin32
test al, al
jne 0x14003f505
mov rcx, qword ds:[rbx + 8]
call fcn.1400f8160
mov rbx, rax
lea rcx, [r12 - 0x10]
test rax, rax
mov eax, r14d
je 0x14003f523
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14003f505
nop
call fcn.1400fbcc0
cmp qword [rbx], rsi
je 0x14003f535
mov rcx, rbx
call sym.ProcessHacker.exe_PhGetBaseDirectory
mov r13, rax
mov rcx, r15
test rax, rax
je 0x14003f535
mov rax, qword [rax + 8]
jmp 0x14003f538
mov rbx, rsi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14003f535
call fcn.1400fbcc0
mov rax, rsi
mov r12, qword [rsp + 0x160]
test r15, r15
je 0x14003f54b
mov rdx, qword [r15 + 8]
jmp 0x14003f54e
mov rdx, rsi
test rbx, rbx
je 0x14003f559
mov rcx, qword [rbx + 8]
jmp 0x14003f55c
mov rcx, rsi
lea r8, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x48], r8
lea r8, [rbp - 0x60]
mov qword [rsp + 0x40], r8
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x1080000
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14003f5ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x14003f5a3
mov esi, eax
jmp 0x14003f5ac
movzx esi, ax
or esi, 0xc0070000
test rbx, rbx
je 0x14003f5ca
lea rcx, ds:[rbx - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14003f5ca
call fcn.1400fbcc0
test r15, r15
je 0x14003f5ea
lea rcx, ds:[r15 - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14003f5ea
call fcn.1400fbcc0
test r13, r13
je 0x14003f60a
lea rcx, ds:[r13 - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14003f60a
call fcn.1400fbcc0
mov r13, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x70]
test esi, esi
js 0x14003f63f
nop dword [rax + rax]
test rcx, rcx
je 0x14003f62b
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14003f63b
call qword [sym.imp.ntdll.dll_NtClose]
xor bl, bl
jmp 0x14003f65d
nop
test rcx, rcx
je 0x14003f64b
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14003f65b
call qword [sym.imp.ntdll.dll_NtClose]
mov bl, 1
mov rcx, qword [rsp + 0x58]
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], r14d
mov rsi, qword [rsp + 0x150]
cmp r14d, 1
mov r14, qword [rsp + 0x128]
jne 0x14003f687
call fcn.1400fbcc0
mov rcx, qword ds:[rbp + 8]
mov r15, qword [rsp + 0x120]
mov rdi, qword [rsp + 0x158]
test rcx, rcx
je 0x14003f6be
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov r8, qword [rbp + 8]
xor edx, edx
mov rcx, qword [0x140241998]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
movzx eax, bl
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.1401848a0
add rsp, 0x138
pop rbx
pop rbp
ret