Function at 0x140001220
Capabilities:
Create process on windows
Create process suspended
Create thread
Inject dll
Inject thread
Resume thread
Use process replacement

Disassembly:
sub rsp, 0x518
mov rax, qword [0x140019008]
xor rax, rsp
mov qword [rsp + 0x500], rax
lea rcx, [rsp + 0x2f0]
call section..text
test al, al
jne 0x140001283
mov r9d, 0x10
lea r8, str.tcrun
lea rdx, str.Cannot_find_Total_Commander
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.140001500
add rsp, 0x518
ret
mov qword [rsp + 0x520], rbx
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x528], rbp
lea rcx, [0x140000000]
mov r8d, 0x104
mov qword [rsp + 0x510], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rdi, 0xffffffffffffffff
lea rax, [rsp + 0xe0]
mov rbx, rdi
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400012d0
mov edx, 0x5c
lea rcx, [rsp + 0xe0]
call fcn.140002100
mov rcx, rdi
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1400012f0
sub ebx, ecx
lea rdx, str.tcnag64.dll
movsxd rax, ebx
lea rcx, [rsp + 0xe2]
mov r8d, 0xb
lea rcx, [rcx + rax*2]
call fcn.140003948
lea eax, [rbx + 0xc]
xor ebp, ebp
movsxd rcx, eax
xor edx, edx
mov word [rsp + rcx*2 + 0xe0], bp
lea rcx, [rsp + 0xe0]
call fcn.1400035a4
test eax, eax
je 0x140001362
lea r9d, [rbp + 0x10]
xor ecx, ecx
lea r8, str.tcrun
lea rdx, str.Cannot_find_nag_dll
call qword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [rbp + 1]
jmp 0x1400014bf
xorps xmm0, xmm0
lea rcx, [rsp + 0x2f0]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0xd0], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400014bd
mov rbx, qword [rsp + 0x50]
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x530], rsi
nop dword [rax]
cmp word [rax + rdi*2 + 2], bp
lea rdi, [rdi + 1]
jne 0x140001400
lea eax, [rdi*2 + 2]
mov dword [rsp + 0x20], 4
movsxd rsi, eax
mov r9d, 0x1000
mov r8, rsi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
je 0x14000149f
mov r9, rsi
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0xe0]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000149f
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000149f
lea rdx, str.LoadLibraryW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000149f
mov qword [rsp + 0x30], rbp
mov r9, rax
mov dword [rsp + 0x28], ebp
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x530]
xor eax, eax
mov rbp, qword [rsp + 0x528]
mov rbx, qword [rsp + 0x520]
mov rdi, qword [rsp + 0x510]
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.140001500
add rsp, 0x518
ret