Function at 0x1400bb9e0
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push rbx
push rsi
push r12
push r13
push r14
sub rsp, 0x60
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rdx
lea rcx, str.wdc.dll
xor r12d, r12d
xor edx, edx
mov r8d, 0x800
mov r14d, r12d
xor r13b, r13b
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x1400bba49
xor edx, edx
lea rcx, str.wdc.dll
mov r8d, 0xa00
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
je 0x1400bbd07
mov eax, 0x5a4d
mov qword [rsp + 0x90], rbp
cmp word [rsi], ax
jne 0x1400bbcf4
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x1400bbcf4
cmp dword [rcx + rsi], 0x4550
jne 0x1400bbcf4
lea rdx, [rsi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1400bbcf4
cmp dword [rdx + 4], r12d
je 0x1400bbcf4
lea r8, [rsi + rax]
mov word [rsp + 0x20], r12w
lea r9, str.WdcRunTaskAsInteractiveUser
mov rcx, rsi
call fcn.1400fa1a0
mov qword ds:[rsp + 0x38], rax
mov rbp, rax
test rax, rax
je 0x1400bbcf4
mov rcx, qword ds:[rbx + 8]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0xa8], r15
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r15, rax
test rax, rax
je 0x1400bbcda
mov rcx, qword ds:[rax]
mov qword [rsp + 0xa0], rdi
call sym.ProcessHacker.exe_PhCreateString
mov rbx, rax
mov edi, 0xffffffff
test rax, rax
je 0x1400bbc57
mov rcx, qword [rax + 8]
call sym.ProcessHacker.exe_PhDoesFileExistsWin32
nop
test al, al
jne 0x1400bbb54
mov rcx, qword [rbx + 8]
call fcn.1400f8160
mov rcx, rax
test rax, rax
je 0x1400bbc10
mov rax, rbx
mov rbx, rcx
lea rcx, [rax - 0x10]
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400bbb54
call fcn.1400fbcc0
mov r8, qword [rbx + 8]
lea r9, [0x1401da1d8]
lea rdx, [0x1401da1d8]
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov r14, rax
lea rcx, [rbx - 0x10]
mov rbp, rax
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400bbb8b
call fcn.1400fbcc0
cmp dword [rsp + 0x48], 2
jne 0x1400bbc38
mov rcx, qword [r15 + 8]
call sym.ProcessHacker.exe_PhCreateString
lea r9, [0x1401da1d8]
mov ecx, 3
lea rdx, [0x1401da1d8]
mov rbx, rax
mov r8, qword [rax + 8]
call sym.ProcessHacker.exe_PhConcatStrings
mov qword [rsp + 0x40], rax
lea rcx, [rbx - 0x10]
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400bbbd8
call fcn.1400fbcc0
mov rbx, qword [rsp + 0x40]
lea r8, [0x1401da1dc]
mov rdx, qword [r14 + 8]
mov ecx, 3
mov r9, qword [rbx + 8]
call sym.ProcessHacker.exe_PhConcatStrings
mov r14, rax
lea rcx, [rbx - 0x10]
mov edx, edi
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x1400bbc3d
call fcn.1400fbcc0
jmp 0x1400bbc3d
lea rcx, ds:[rbx - 0x10]
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400bbc57
call fcn.1400fbcc0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400bbcd2
lock inc dword [r14 - 8]
lea rcx, [rbp - 0x10]
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400bbc52
call fcn.1400fbcc0
mov rbp, qword [rsp + 0x38]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r14, r14
je 0x1400bbcd2
cmp qword [r14], r12
je 0x1400bbcbf
xor ecx, ecx
call fcn.1400bb7c0
mov rbx, rax
test rax, rax
je 0x1400bbc83
mov r12, qword [rax + 8]
mov rcx, qword [r14 + 8]
xor r8d, r8d
mov rdx, r12
mov rax, rbp
call qword [case.0x1400f654f.0]
movzx r13d, r13b
mov ecx, 1
test eax, eax
cmove r13d, ecx
test rbx, rbx
je 0x1400bbcbf
lea rcx, [rbx - 0x10]
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400bbcbf
call fcn.1400fbcc0
lea rcx, [r14 - 0x10]
lock xadd dword [rcx + 8], edi
cmp edi, 1
jne 0x1400bbcd2
call fcn.1400fbcc0
mov rdi, qword [rsp + 0xa0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r15, qword [rsp + 0xa8]
movzx eax, r13b
jmp 0x1400bbcff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
mov rbp, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401848a0
add rsp, 0x60
pop r14
pop r13
pop r12
pop rsi
pop rbx
ret