Function at 0x140014fc0
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rax, qword gs:[0x30]
mov rbp, rcx
mov r15, rdx
xor r12b, r12b
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
movzx eax, byte [rcx + 1]
mov byte [rsp + 0x50], al
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov byte [rcx + 1], r12b
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
xor eax, eax
mov edi, eax
mov r14d, eax
mov r13d, eax
lea rsi, [rax - 1]
test r15, r15
je 0x1400150a5
mov rbx, rsi
nop dword [rax]
inc rbx
cmp word [r15 + rbx*2], ax
jne 0x140015060
mov rdx, qword [0x1402418e8]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r14, rax
xor ecx, ecx
mov r8, rbx
mov rdx, r15
mov qword [rax], rbx
add rax, 0x10
mov qword [r14 + 8], rax
mov word [rax + rbx], cx
mov rcx, qword [r14 + 8]
call fcn.140188690
test rbp, rbp
je 0x140015165
mov rbx, rsi
inc rbx
cmp word [rbp + rbx*2], di
jne 0x1400150b1
mov rdx, qword [0x1402418e8]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
xor ecx, ecx
mov r8, rbx
mov rdx, rbp
mov qword [rax], rbx
add rax, 0x10
mov qword [rdi + 8], rax
mov word [rax + rbx], cx
mov rcx, qword [rdi + 8]
call fcn.140188690
test rdi, rdi
je 0x140015108
cmp qword [rdi], r13
je 0x140015108
mov rcx, rdi
call sym.ProcessHacker.exe_PhGetBaseDirectory
mov r13, rax
xor ebp, ebp
xorps xmm0, xmm0
mov dword [rsp + 0x80], 0x68
xor eax, eax
mov dword [rsp + 0xe4], eax
movups xmmword [rsp + 0x84], xmm0
movups xmmword [rsp + 0x94], xmm0
movups xmmword [rsp + 0xa4], xmm0
movups xmmword [rsp + 0xb4], xmm0
movups xmmword [rsp + 0xc4], xmm0
movups xmmword [rsp + 0xd4], xmm0
test r13, r13
je 0x140015213
mov rax, qword ds:[r13 + 8]
jmp 0x140015216
test r14, r14
je 0x140015108
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x58]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
test rax, rax
je 0x140015108
mov rcx, qword [rax]
call sym.ProcessHacker.exe_PhCreateString
mov rcx, rbx
mov rdi, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax]
test rbp, rbp
je 0x140015108
mov rcx, qword [rbp + 8]
call sym.ProcessHacker.exe_PhDoesFileExistsWin32
test al, al
jne 0x1400150f6
mov rcx, qword ss:[rbp + 8]
call fcn.1400f8160
mov rdi, rax
lea rcx, [rbp - 0x10]
test rax, rax
mov eax, esi
je 0x1400151f3
lock xadd dword ds:[rcx + 8], eax
cmp eax, 1
jne 0x1400150f6
call fcn.1400fbcc0
jmp 0x1400150f6
xor ebp, ebp
mov edi, ebp
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001510a
call fcn.1400fbcc0
jmp 0x14001510a
mov rax, rbp
test r14, r14
je 0x140015222
mov rdx, qword ds:[r14 + 8]
jmp 0x140015225
mov rdx, rbp
test rdi, rdi
je 0x140015230
mov rcx, qword [rdi + 8]
jmp 0x140015233
mov rcx, rbp
lea r8, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x48], r8
lea r8, [rsp + 0x80]
mov qword [rsp + 0x40], r8
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140015274
mov ebx, ebp
jmp 0x14001528d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14001528d
movzx ebx, ax
or ebx, 0xc0070000
test rdi, rdi
je 0x1400152aa
lea rcx, ds:[rdi - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400152aa
call fcn.1400fbcc0
test r14, r14
je 0x1400152c5
lea rcx, [r14 - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400152c5
nop
call fcn.1400fbcc0
test r13, r13
je 0x1400152dd
lea rcx, [r13 - 0x10]
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x1400152dd
call fcn.1400fbcc0
nop dword [rax]
test ebx, ebx
js 0x14001537c
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400152fd
call qword [sym.imp.ntdll.dll_NtClose]
mov r9d, 8
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0xf0]
mov rcx, rbx
lea edx, [r9 + 0x16]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
nop dword [rax]
test eax, eax
js 0x140015374
mov rcx, qword [rsp + 0xf0]
lea r8, [rsp + 0xf8]
mov r9d, 4
mov dword [rsp + 0xf8], ebp
mov qword [rsp + 0x20], rbp
lea edx, [r9 - 3]
call qword [sym.imp.ntdll.dll_NtSetInformationDebugObject]
test eax, eax
js 0x140015366
mov rdx, qword ds:[rsp + 0xf0]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtRemoveProcessDebug]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ntdll.dll_NtClose]
mov r12b, 1
mov rcx, rbx
jmp 0x140015396
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001538c
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14001539c
call qword [sym.imp.ntdll.dll_NtClose]
movzx ebx, byte [rsp + 0x50]
test bl, bl
je 0x1400153e6
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 0x60]
mov byte [rdx + 1], bl
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
movzx eax, r12b
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1401848a0
mov rbx, qword [rsp + 0x160]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret