Function at 0x7ff7c00bfbf0
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0x100
xor ebx, ebx
mov r13, r9
mov r12, rcx
mov edi, ebx
mov r15d, ebx
mov esi, ebx
test rdx, rdx
je 0x7ff7c00bfc30
mov rcx, rdx
call sym.ProcessHacker.exe_PhCreateString
mov r15, rax
mov r14d, 0xffffffff
test r12, r12
je 0x7ff7c00bfc48
mov rcx, r12
call sym.ProcessHacker.exe_PhCreateString
mov rdi, rax
jmp 0x7ff7c00bfcbb
test r15, r15
je 0x7ff7c00bfcbb
mov rcx, qword [r15 + 8]
lea rdx, [rbp + 0x47]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r12, rax
test rax, rax
je 0x7ff7c00bfcbb
mov rcx, qword [rax]
call sym.ProcessHacker.exe_PhCreateString
mov rcx, r12
mov qword [rbp + 0x4f], rax
mov rdi, rax
call qword [sym.imp.kernel32.dll_LocalFree]
test rdi, rdi
je 0x7ff7c00bfcbb
mov rcx, qword [rdi + 8]
call sym.ProcessHacker.exe_PhDoesFileExistsWin32
test al, al
jne 0x7ff7c00bfcbb
mov rcx, qword [rdi + 8]
call fcn.7ff7c00c34e0
mov rcx, qword [rbp + 0x4f]
mov rdi, rax
add rcx, 0xfffffffffffffff0
test rax, rax
mov eax, r14d
jne 0x7ff7c00bfcac
mov rdi, rbx
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7c00bfcbb
call fcn.7ff7c00c6290
test r13, r13
je 0x7ff7c00bfccd
mov rcx, r13
call sym.ProcessHacker.exe_PhCreateString
mov rsi, rax
jmp 0x7ff7c00bfd46
nop dword [rax]
test rdi, rdi
je 0x7ff7c00bfd46
cmp qword [rdi], rbx
je 0x7ff7c00bfd46
movups xmm0, xmmword ds:[rdi]
mov edx, 0x5c
xor r8d, r8d
mov rcx, rdi
movups xmmword [rsp + 0x78], xmm0
call sym.ProcessHacker.exe_PhFindLastCharInStringRef
cmp rax, 0xffffffffffffffff
je 0x7ff7c00bfd46
lea r13, [rax + rax]
test r13, r13
jne 0x7ff7c00bfd0e
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rsi, rax
jmp 0x7ff7c00bfd46
mov rdx, qword [0x7ff7c01d3b58]
lea rcx, [r13 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, qword [rbp - 0x79]
mov rsi, rax
mov qword [rax], r13
add rax, 0x10
mov qword [rsi + 8], rax
mov word [rax + r13], bx
test rdx, rdx
je 0x7ff7c00bfd46
mov rcx, qword [rsi + 8]
mov r8, r13
call fcn.7ff7c0125120
mov r8d, dword [rbp + 0x6f]
mov ecx, r8d
mov r11, qword [rbp + 0x67]
and ecx, 2
shl ecx, 9
mov eax, r8d
mov edx, ecx
or edx, 4
and al, 4
mov eax, r8d
cmove edx, ecx
mov ecx, edx
bts ecx, 0x18
and al, 8
mov eax, r8d
cmove ecx, edx
mov edx, ecx
or edx, 0x10
and al, 0x10
mov eax, r8d
cmove edx, ecx
mov ecx, edx
or ecx, 1
and al, 0x20
mov eax, r8d
cmove ecx, edx
mov edx, ecx
or edx, 2
and al, 0x40
mov eax, r8d
cmove edx, ecx
mov r12d, edx
bts r12d, 0x13
and al, 0x80
cmove r12d, edx
test r11, r11
jne 0x7ff7c00bfdd6
xorps xmm0, xmm0
mov dword [rbp - 0x69], 0x68
xor eax, eax
movups xmmword [rbp - 0x65], xmm0
mov dword [rbp - 5], eax
movups xmmword [rbp - 0x55], xmm0
movups xmmword [rbp - 0x45], xmm0
movups xmmword [rbp - 0x35], xmm0
movups xmmword [rbp - 0x25], xmm0
movups xmmword [rbp - 0x15], xmm0
mov r10, qword [rbp + 0x77]
test r10, r10
je 0x7ff7c00bfe58
test rsi, rsi
je 0x7ff7c00bfdea
mov r9, qword [rsi + 8]
jmp 0x7ff7c00bfded
mov r9, rbx
nop dword [rax]
test r15, r15
je 0x7ff7c00bfdfb
mov rcx, qword [r15 + 8]
jmp 0x7ff7c00bfdfe
mov rcx, rbx
test rdi, rdi
je 0x7ff7c00bfe09
mov rdx, qword [rdi + 8]
jmp 0x7ff7c00bfe0c
mov rdx, rbx
test r11, r11
lea rax, [rbp - 0x69]
cmovne rax, r11
and r8d, 1
lea r11, [rsp + 0x60]
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x57]
mov qword [rsp + 0x40], r9
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r8d
mov r8, rcx
mov rcx, r10
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x7ff7c00bfec5
test rsi, rsi
je 0x7ff7c00bfe63
mov r9, qword [rsi + 8]
jmp 0x7ff7c00bfe66
mov r9, rbx
test r15, r15
je 0x7ff7c00bfe72
mov rdx, qword ds:[r15 + 8]
jmp 0x7ff7c00bfe75
mov rdx, rbx
test rdi, rdi
je 0x7ff7c00bfe80
mov rcx, qword [rdi + 8]
jmp 0x7ff7c00bfe83
mov rcx, rbx
test r11, r11
lea r10, [rsp + 0x60]
mov qword [rsp + 0x48], r10
lea rax, [rbp - 0x69]
cmovne rax, r11
and r8d, 1
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x57]
mov qword [rsp + 0x38], r9
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r8d
xor r8d, r8d
call qword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
jne 0x7ff7c00bfee1
call qword [sym.imp.kernel32.dll_GetLastError]
nop
test eax, eax
jg 0x7ff7c00bfed8
mov ebx, eax
jmp 0x7ff7c00bfee1
movzx ebx, ax
or ebx, 0xc0070000
test rdi, rdi
je 0x7ff7c00bfefc
lea rcx, [rdi - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7c00bfefc
call fcn.7ff7c00c6290
test r15, r15
je 0x7ff7c00bff1a
lea rcx, ds:[r15 - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7c00bff1a
call fcn.7ff7c00c6290
test rsi, rsi
je 0x7ff7c00bff35
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x7ff7c00bff35
nop
call fcn.7ff7c00c6290
test ebx, ebx
js 0x7ff7c00bff92
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x7ff7c00bff51
mov eax, dword [rsp + 0x70]
mov qword [rcx], rax
mov eax, dword [rsp + 0x74]
mov qword [rcx + 8], rax
mov rcx, qword [rbp + 0x87]
test rcx, rcx
je 0x7ff7c00bff67
mov rax, qword [rsp + 0x60]
mov qword [rcx], rax
jmp 0x7ff7c00bff7b
mov rcx, qword ds:[rsp + 0x60]
test rcx, rcx
je 0x7ff7c00bff7b
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rbp + 0x8f]
mov rcx, qword [rsp + 0x68]
test rax, rax
je 0x7ff7c00bffa7
mov qword ds:[rax], rcx
jmp 0x7ff7c00bffb6
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x7ff7c00bffa2
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x7ff7c00bffb6
nop dword [rax]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rbx, qword [rsp + 0x158]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret