Function at 0x1400027f0
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Create thread
Inject thread
Query environment variable
Resume thread
Use process replacement

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2f8
call fcn.140001600
lea rbx, [rsp + 0xe8]
xor ecx, ecx
mov r8d, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [0x14000406a]
call sub.msvcrt.dll_getenv
test rax, rax
jne 0x140002845
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, str.synthv_studio.exe
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x14000285d
lea rcx, str.SYNTHV_STUDIO_EXE
call qword [sym.imp.msvcrt.dll__wgetenv]
mov rcx, rbx
mov rdx, rax
call sub.msvcrt.dll_wcscpy
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
mov qword [rsp + 0x58], rax
call sub.msvcrt.dll_wcslen
lea rdi, [rax + 1]
lea rcx, [rdi + rdi]
call sub.msvcrt.dll_malloc
mov rdx, rdi
mov r8, qword [rsp + 0x58]
mov rsi, rax
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcscpy_s]
xor eax, eax
mov ecx, 0x19
xor r9d, r9d
lea rdx, [rsp + 0x84]
xor r10d, r10d
lea r8, [rsp + 0x80]
mov dword [rsp + 0x80], 0x68
mov rdi, rdx
lea rdx, [rsp + 0x68]
rep stosd dword [rdi], eax
mov rdi, rdx
mov ecx, 6
rep stosd dword [rdi], eax
mov qword [rsp + 0x48], rdx
mov rcx, rbx
mov rdx, rsi
mov qword [rsp + 0x40], r8
xor r8d, r8d
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r9
xor r9d, r9d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r10d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, eax
mov eax, 1
test edx, edx
je 0x140002a26
lea rcx, [0x1400040c4]
lea rbx, str.obsidian.dll
call sub.msvcrt.dll_getenv
test rax, rax
je 0x140002937
lea rcx, str.OBSIDIAN_DLL
call qword [sym.imp.msvcrt.dll__wgetenv]
mov rbx, rax
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov r9d, 0x1000
xor edx, edx
mov rcx, qword [rsp + 0x68]
lea r8, [rax + rax + 1]
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rcx, rbx
mov rdi, rax
call sub.msvcrt.dll_wcslen
xor edx, edx
mov r8, rbx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rdx
lea r9, [rax + rax + 1]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor ecx, ecx
xor r8d, r8d
xor edx, edx
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], r8d
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
or edx, 0xffffffff
mov rbp, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, rax
mov rcx, rax
call rbp
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x68]
or edx, 0xffffffff
call rbp
lea rdx, [rsp + 0x64]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, rbx
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x68]
call rbx
mov rcx, qword [rsp + 0x70]
call rbx
mov rcx, qword [rsp + 0x68]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rsi
call sub.msvcrt.dll_free
mov eax, dword [rsp + 0x64]
add rsp, 0x2f8
pop rbx
pop rsi
pop rdi
pop rbp
ret