Function at 0x14002c6e0
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x248]
sub rsp, 0x348
mov eax, dword [rcx + 0x10]
mov r13, rcx
mov rcx, qword [0x140194638]
mov r12, rdx
cmp qword [r13], rcx
jne 0x14002c75e
cmp eax, 0xfffffdd8
jne 0x14002c74a
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x1401945d4], eax
xor al, al
add rsp, 0x348
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp eax, 0xfffffdd9
jne 0x14002c734
mov ecx, dword [0x1401945d4]
call fcn.14002f040
jmp 0x14002c734
cmp eax, 0xfffffe02
jne 0x14002ca5c
mov eax, dword [0x1401945d0]
cmp eax, 1
jne 0x14002c8ef
mov rbx, qword [r13 + 0x18]
mov rcx, rbx
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
mov qword [rbp - 0x68], rbx
lea r9, [rsp + 0x50]
mov qword [rbp - 0x70], rax
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x70]
call sym.ProcessHacker.exe_PhParseCommandLineFuzzy
mov r14, qword [rsp + 0x50]
xor esi, esi
test r14, r14
jne 0x14002c800
mov rbx, qword [rbp - 0x60]
test rbx, rbx
jne 0x14002c7c4
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov r14, rax
jmp 0x14002c7fb
mov rdx, qword [0x140196800]
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, qword [rbp - 0x58]
mov r14, rax
mov qword [rax], rbx
add rax, 0x10
mov qword [r14 + 8], rax
mov word [rax + rbx], si
test rdx, rdx
je 0x14002c7fb
mov rcx, qword [r14 + 8]
mov r8, rbx
call fcn.14010e700
mov qword [rsp + 0x50], r14
mov rbx, qword [rbp - 0x50]
test rbx, rbx
jne 0x14002c813
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov r15, rax
jmp 0x14002c84a
mov rdx, qword [0x140196800]
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, qword [rbp - 0x48]
mov r15, rax
mov qword [rax], rbx
add rax, 0x10
mov qword [r15 + 8], rax
mov word [rax + rbx], si
test rdx, rdx
je 0x14002c84a
mov rcx, qword [r15 + 8]
mov r8, rbx
call fcn.14010e700
mov esi, dword [r13 + 0x28]
lea rcx, [rbp - 0x3c]
mov rdi, qword [r15 + 8]
xor edx, edx
mov rbx, qword [r14 + 8]
mov dword [rbp - 0x40], 0x70
lea r8d, [rdx + 0x6c]
call fcn.14010ed90
mov rax, qword [sym.ProcessHacker.exe_PhMainWndHandle]
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x38], rax
lea rax, str.runas
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rdi
mov dword [rbp - 0x3c], 0x440
mov dword [rbp - 0x10], esi
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14002c8b3
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ntdll.dll_NtClose]
mov esi, 1
jmp 0x14002c8b8
mov esi, 2
or rdi, 0xffffffffffffffff
mov qword [r12], rsi
mov eax, edi
lea rcx, [r14 - 0x10]
lock xadd dword [rcx + 8], eax
sub eax, 1
jne 0x14002c8d5
call fcn.1400c8bc0
lea rcx, [r15 - 0x10]
lock xadd dword [rcx + 8], edi
cmp edi, 1
jne 0x14002c8e8
call fcn.1400c8bc0
mov al, 1
jmp 0x14002c736
cmp eax, 2
jne 0x14002c734
or rdi, 0xffffffffffffffff
lea r8, [rbp + 0x2a8]
mov rcx, rdi
mov edx, 0x600cb
call qword [sym.imp.ntdll.dll_NtOpenProcessToken]
mov esi, eax
cmp eax, 0xc0000022
jne 0x14002c939
cmp byte [0x1401937ba], 0
je 0x14002c939
lea r8, [rbp + 0x2a8]
mov edx, 0x600cb
mov rcx, rdi
call fcn.1400dcbd0
mov esi, eax
test esi, esi
js 0x14002c9b7
mov rcx, qword [rbp + 0x2a8]
lea rdx, [rsp + 0x68]
call fcn.1400c4670
mov esi, eax
test eax, eax
js 0x14002c994
mov rbx, qword [rsp + 0x68]
xor esi, esi
mov rdx, qword [r13 + 0x18]
xor r9d, r9d
mov qword [rsp + 0x48], rsi
xor r8d, r8d
mov qword [rsp + 0x40], rsi
xor ecx, ecx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call sym.ProcessHacker.exe_PhCreateProcessWin32Ex
mov rcx, rbx
mov esi, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x14002c9b7
mov esi, 1
mov qword [r12], rsi
movzx eax, sil
jmp 0x14002c736
mov r14, qword [sym.ProcessHacker.exe_PhMainWndHandle]
cmp esi, 0xc0000022
je 0x14002c9e1
cmp esi, 0xc0000005
je 0x14002c9e1
mov eax, esi
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14002c9ed
movzx eax, si
jmp 0x14002c9e9
mov ecx, esi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x14002c9f6
mov ecx, esi
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x14002c9fd
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_execute_the_program.
mov rbx, rax
mov rcx, r14
test rax, rax
jne 0x14002ca20
lea r8, [0x1401689f8]
lea edx, [rax + 0x10]
call sym.ProcessHacker.exe_PhShowMessage
jmp 0x14002ca4c
mov rax, qword [rbx + 8]
mov edx, 0x20
mov r8d, 0xfffe
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
lock xadd dword [rcx + 8], edi
cmp edi, 1
jne 0x14002ca4c
call fcn.1400c8bc0
mov esi, 2
mov al, 1
mov qword [r12], rsi
jmp 0x14002c736
cmp eax, 0xfffffe01
jne 0x14002c734
lea rcx, str.wdc.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14002c8e8
lea rcx, str.WdcRunTaskAsInteractiveUser
mov dword [rbp - 0x80], 0x1c001b
mov qword [rbp - 0x78], rcx
lea r9, [rsp + 0x60]
mov rcx, rax
lea rdx, [rbp - 0x80]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
test eax, eax
js 0x14002cdab
cmp qword [rsp + 0x60], 0
je 0x14002cdab
mov rdi, qword [r13 + 0x18]
xor esi, esi
mov rcx, rdi
mov r12d, esi
call sym.ProcessHacker.exe_PhCountStringZ
mov rbx, rax
add rbx, rbx
jne 0x14002cae0
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov r13, rax
jmp 0x14002cb16
mov rdx, qword [0x140196800]
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r13, rax
mov qword [rax], rbx
add rax, 0x10
mov qword [r13 + 8], rax
mov word [rax + rbx], si
test rdi, rdi
je 0x14002cb16
mov rcx, qword [r13 + 8]
mov r8, rbx
mov rdx, rdi
call fcn.14010e700
mov rcx, qword [r13 + 8]
lea rdx, [rbp + 0x290]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14002cd43
mov r15, qword [rax]
mov rbx, rdi
nop
inc rbx
cmp word [r15 + rbx*2], si
jne 0x14002cb40
mov rdx, qword [0x140196800]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r14, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], si
test r15, r15
je 0x14002cb83
mov rcx, qword [rax + 8]
mov r8, rbx
mov rdx, r15
call fcn.14010e700
mov rcx, qword [r14 + 8]
mov r15, r14
call qword [sym.imp.ntdll.dll_RtlDoesFileExists_U]
test al, al
jne 0x14002cc03
mov rcx, qword [r14 + 8]
lea r8, [rbp + 0x30]
call fcn.1400c7af0
test al, al
je 0x14002cd3d
lea rax, [rbp + 0x30]
mov rbx, rdi
inc rbx
cmp word [rax + rbx*2], si
jne 0x14002cbb0
mov rdx, qword [0x140196800]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r8, rbx
lea rdx, [rbp + 0x30]
mov r15, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], si
mov rcx, qword [rax + 8]
call fcn.14010e700
lea rcx, [r14 - 0x10]
mov edx, edi
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14002cc03
call fcn.1400c8bc0
test r15, r15
je 0x14002cd23
mov r8, qword [r15 + 8]
lea r9, [0x140159074]
lea rdx, [0x140159074]
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov r12, rax
mov qword [rsp + 0x70], rax
lea rcx, [r15 - 0x10]
mov edx, edi
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14002cc45
call fcn.1400c8bc0
cmp dword [rbp + 0x290], 2
jne 0x14002cd09
mov r14, qword [rsp + 0x58]
mov rbx, rdi
mov r14, qword [r14 + 8]
nop
inc rbx
cmp word [r14 + rbx*2], si
jne 0x14002cc60
mov rdx, qword [0x140196800]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r15, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], si
test r14, r14
je 0x14002cca3
mov rcx, qword [rax + 8]
mov r8, rbx
mov rdx, r14
call fcn.14010e700
mov r8, qword [r15 + 8]
lea r9, [0x140159074]
lea rdx, [0x140159074]
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov rbx, rax
lea rcx, [r15 - 0x10]
mov edx, edi
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14002ccd7
call fcn.1400c8bc0
mov r9, qword [rbx + 8]
lea r8, [0x140159078]
mov rdx, qword [r12 + 8]
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov r12, rax
lea rcx, [rbx - 0x10]
mov edx, edi
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14002cd09
call fcn.1400c8bc0
mov rcx, qword [rsp + 0x70]
add rcx, 0xfffffffffffffff0
mov eax, edi
lock xadd dword [rcx + 8], eax
sub eax, 1
jne 0x14002cd23
call fcn.1400c8bc0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r12, r12
je 0x14002cd43
cmp qword [r12], rsi
je 0x14002cd43
xor al, al
jmp 0x14002cd45
lea rcx, [r14 - 0x10]
jmp 0x14002cd12
mov al, 1
test al, al
jne 0x14002cd6e
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.ProcessHacker.exe_PhDeleteCallback]
mov rcx, qword [r12 + 8]
xor r8d, r8d
xor edx, edx
call rbx
test eax, eax
setne sil
inc rsi
jmp 0x14002cd73
mov esi, 2
mov rax, qword [rbp + 0x298]
mov qword [rax], rsi
test r12, r12
je 0x14002cd98
lea rcx, [r12 - 0x10]
mov eax, edi
lock xadd dword [rcx + 8], eax
sub eax, 1
jne 0x14002cd98
call fcn.1400c8bc0
lea rcx, [r13 - 0x10]
lock xadd dword [rcx + 8], edi
cmp edi, 1
jne 0x14002cdab
call fcn.1400c8bc0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, 1
jmp 0x14002c736