Function at 0x1400ffbf0
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0x100
xor ebx, ebx
mov r13, r9
mov r12, rcx
mov edi, ebx
mov r15d, ebx
mov esi, ebx
test rdx, rdx
je 0x1400ffc30
mov rcx, rdx
call sym.ProcessHacker.exe_PhCreateString
mov r15, rax
mov r14d, 0xffffffff
test r12, r12
je 0x1400ffc48
mov rcx, r12
call sym.ProcessHacker.exe_PhCreateString
mov rdi, rax
jmp 0x1400ffcbb
test r15, r15
je 0x1400ffcbb
mov rcx, qword [r15 + 8]
lea rdx, [rbp + 0x47]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r12, rax
test rax, rax
je 0x1400ffcbb
mov rcx, qword [rax]
call sym.ProcessHacker.exe_PhCreateString
mov rcx, r12
mov qword [rbp + 0x4f], rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x1400ffcbb
mov rcx, qword [rdi + 8]
call sym.ProcessHacker.exe_PhDoesFileExistsWin32
test al, al
jne 0x1400ffcbb
mov rcx, qword [rdi + 8]
call fcn.1401034e0
mov rcx, qword [rbp + 0x4f]
mov rdi, rax
add rcx, 0xfffffffffffffff0
test rax, rax
mov eax, r14d
jne 0x1400ffcac
mov rdi, rbx
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400ffcbb
call fcn.140106290
test r13, r13
je 0x1400ffccd
mov rcx, r13
call sym.ProcessHacker.exe_PhCreateString
mov rsi, rax
jmp 0x1400ffd46
nop dword [rax]
test rdi, rdi
je 0x1400ffd46
cmp qword [rdi], rbx
je 0x1400ffd46
movups xmm0, xmmword ds:[rdi]
mov edx, 0x5c
xor r8d, r8d
mov rcx, rdi
movups xmmword [rsp + 0x78], xmm0
call sym.ProcessHacker.exe_PhFindLastCharInStringRef
cmp rax, 0xffffffffffffffff
je 0x1400ffd46
lea r13, [rax + rax]
test r13, r13
jne 0x1400ffd0e
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rsi, rax
jmp 0x1400ffd46
mov rdx, qword [0x140213b58]
lea rcx, [r13 + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, qword [rbp - 0x79]
mov rsi, rax
mov qword [rax], r13
add rax, 0x10
mov qword [rsi + 8], rax
mov word [rax + r13], bx
test rdx, rdx
je 0x1400ffd46
mov rcx, qword [rsi + 8]
mov r8, r13
call fcn.140165120
mov r8d, dword [rbp + 0x6f]
mov ecx, r8d
mov r11, qword [rbp + 0x67]
and ecx, 2
shl ecx, 9
mov eax, r8d
mov edx, ecx
or edx, 4
and al, 4
mov eax, r8d
cmove edx, ecx
mov ecx, edx
bts ecx, 0x18
and al, 8
mov eax, r8d
cmove ecx, edx
mov edx, ecx
or edx, 0x10
and al, 0x10
mov eax, r8d
cmove edx, ecx
mov ecx, edx
or ecx, 1
and al, 0x20
mov eax, r8d
cmove ecx, edx
mov edx, ecx
or edx, 2
and al, 0x40
mov eax, r8d
cmove edx, ecx
mov r12d, edx
bts r12d, 0x13
and al, 0x80
cmove r12d, edx
test r11, r11
jne 0x1400ffdd6
xorps xmm0, xmm0
mov dword [rbp - 0x69], 0x68
xor eax, eax
movups xmmword [rbp - 0x65], xmm0
mov dword [rbp - 5], eax
movups xmmword [rbp - 0x55], xmm0
movups xmmword [rbp - 0x45], xmm0
movups xmmword [rbp - 0x35], xmm0
movups xmmword [rbp - 0x25], xmm0
movups xmmword [rbp - 0x15], xmm0
mov r10, qword [rbp + 0x77]
test r10, r10
je 0x1400ffe58
test rsi, rsi
je 0x1400ffdea
mov r9, qword [rsi + 8]
jmp 0x1400ffded
mov r9, rbx
nop dword [rax]
test r15, r15
je 0x1400ffdfb
mov rcx, qword [r15 + 8]
jmp 0x1400ffdfe
mov rcx, rbx
test rdi, rdi
je 0x1400ffe09
mov rdx, qword [rdi + 8]
jmp 0x1400ffe0c
mov rdx, rbx
test r11, r11
lea rax, [rbp - 0x69]
cmovne rax, r11
and r8d, 1
lea r11, [rsp + 0x60]
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x57]
mov qword [rsp + 0x40], r9
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r8d
mov r8, rcx
mov rcx, r10
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x1400ffec5
test rsi, rsi
je 0x1400ffe63
mov r9, qword [rsi + 8]
jmp 0x1400ffe66
mov r9, rbx
test r15, r15
je 0x1400ffe72
mov rdx, qword ds:[r15 + 8]
jmp 0x1400ffe75
mov rdx, rbx
test rdi, rdi
je 0x1400ffe80
mov rcx, qword [rdi + 8]
jmp 0x1400ffe83
mov rcx, rbx
test r11, r11
lea r10, [rsp + 0x60]
mov qword [rsp + 0x48], r10
lea rax, [rbp - 0x69]
cmovne rax, r11
and r8d, 1
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x57]
mov qword [rsp + 0x38], r9
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r8d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400ffee1
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
test eax, eax
jg 0x1400ffed8
mov ebx, eax
jmp 0x1400ffee1
movzx ebx, ax
or ebx, 0xc0070000
test rdi, rdi
je 0x1400ffefc
lea rcx, [rdi - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400ffefc
call fcn.140106290
test r15, r15
je 0x1400fff1a
lea rcx, ds:[r15 - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400fff1a
call fcn.140106290
test rsi, rsi
je 0x1400fff35
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], r14d
cmp r14d, 1
jne 0x1400fff35
nop
call fcn.140106290
test ebx, ebx
js 0x1400fff92
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x1400fff51
mov eax, dword [rsp + 0x70]
mov qword [rcx], rax
mov eax, dword [rsp + 0x74]
mov qword [rcx + 8], rax
mov rcx, qword [rbp + 0x87]
test rcx, rcx
je 0x1400fff67
mov rax, qword [rsp + 0x60]
mov qword [rcx], rax
jmp 0x1400fff7b
mov rcx, qword ds:[rsp + 0x60]
test rcx, rcx
je 0x1400fff7b
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rbp + 0x8f]
mov rcx, qword [rsp + 0x68]
test rax, rax
je 0x1400fffa7
mov qword ds:[rax], rcx
jmp 0x1400fffb6
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400fffa2
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400fffb6
nop dword [rax]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rbx, qword [rsp + 0x158]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret