Function at 0x14000c7d0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov byte [rax + 0x20], r9b
mov qword [rax + 8], rcx
push rbp
lea rbp, [rax - 0x28]
sub rsp, 0x120
mov qword [rax + 0x10], rbx
mov rbx, rcx
mov qword [rax - 0x10], rsi
mov rcx, rdx
mov qword [rax - 0x20], r12
mov r12, r8
mov qword [rax - 0x28], r13
mov qword [rax - 0x30], r14
mov qword [rax - 0x38], r15
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetStringSetting
mov edx, 0x3a
xor r8d, r8d
mov rcx, rax
mov r13, rax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhFindCharInStringRef
mov r15, 0xffffffffffffffff
cmp rax, r15
jne 0x14000c85c
mov rcx, qword [0x140192450]
mov rdx, r13
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhConcatStringRef2
mov rcx, r13
mov r13, rax
test rcx, rcx
je 0x14000c85c
add rcx, 0xfffffffffffffff0
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000c85c
call fcn.1400d9400
movups xmm0, xmmword [r13]
xor r8d, r8d
mov qword [rsp + 0x110], rdi
lea rdx, [0x140188008]
mov rcx, r13
movups xmmword [rsp + 0x58], xmm0
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhFindStringInStringRef
xor esi, esi
cmp rax, r15
je 0x14000c96a
movups xmm1, xmmword [rsp + 0x58]
lea rdx, [rax + rax]
mov r14, r15
mov qword [rsp + 0x50], rdx
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
mov qword [rsp + 0x70], rax
lea rcx, [rdx + rax]
add rcx, qword [0x140188008]
mov qword [rsp + 0x58], rcx
movq rcx, xmm1
sub rcx, rdx
sub rcx, qword [0x140188008]
mov qword [rsp + 0x78], rcx
inc r14
cmp word [r12 + r14*2], si
jne 0x14000c8d3
add r14, r14
lea rbx, [r14 + rcx]
add rbx, rdx
mov rdx, qword [0x140191180]
lea rcx, [rbx + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov r8, qword [rsp + 0x50]
mov rdi, rax
mov rdx, qword [rsp + 0x70]
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], si
mov rbx, qword [rax + 8]
mov rcx, rbx
call fcn.1401317c0
add rbx, qword [rsp + 0x50]
mov r8, r14
mov rcx, rbx
mov rdx, r12
call fcn.1401317c0
mov r8, qword [rsp + 0x78]
lea rcx, [r14 + rbx]
mov rdx, qword [rsp + 0x58]
call fcn.1401317c0
mov rcx, r13
mov r13, rdi
test rcx, rcx
je 0x14000c966
add rcx, 0xfffffffffffffff0
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000c966
call fcn.1400d9400
mov rbx, qword [rbp + 0x30]
mov r14, qword [r13 + 8]
mov r12, qword [rsp + 0x108]
cmp byte [rbp + 0x48], sil
je 0x14000c9c9
xorps xmm0, xmm0
mov dword [rbp - 0x80], 0x70
xor eax, eax
lea rcx, [rbp - 0x80]
movups xmmword [rbp - 0x6c], xmm0
mov qword [rbp - 0x68], r14
movups xmmword [rbp - 0x5c], xmm0
mov qword [rbp - 0x60], rsi
movups xmmword [rbp - 0x7c], xmm0
mov dword [rbp - 0x50], 5
mov qword [rbp - 0x78], rbx
movups xmmword [rbp - 0x4c], xmm0
mov qword [rbp - 0x1c], rax
movups xmmword [rbp - 0x3c], xmm0
mov dword [rbp - 0x14], eax
movups xmmword [rbp - 0x2c], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x14000cba7
mov rdi, rsi
test r14, r14
je 0x14000ca12
mov rbx, r15
inc rbx
cmp word [r14 + rbx*2], si
jne 0x14000c9d4
mov rdx, qword [0x140191180]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov r8, rbx
mov rdx, r14
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], si
mov rcx, qword [rax + 8]
call fcn.1401317c0
xorps xmm0, xmm0
mov dword [rbp - 0x80], 0x68
xor eax, eax
mov dword [rbp - 0x1c], eax
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
test rdi, rdi
je 0x14000ca44
mov rdx, qword [rdi + 8]
jmp 0x14000ca47
mov rdx, rsi
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp - 0x80]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000ca92
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x14000ca90
movzx eax, ax
or eax, 0xc0070000
mov esi, eax
test rdi, rdi
je 0x14000caad
lea rcx, [rdi - 0x10]
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000caad
call fcn.1400d9400
test esi, esi
js 0x14000cacc
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14000cba7
mov rdi, qword [rbp + 0x50]
test rdi, rdi
je 0x14000cb0e
mov ecx, esi
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetNtMessage
mov rbx, rax
test rax, rax
je 0x14000caf9
mov r9, qword [rax + 8]
lea r8, str.Unable_to_execute_the_command:__s_n_s
mov qword [rsp + 0x20], rdi
jmp 0x14000cb83
lea r9, str.An_unknown_error_occurred.
mov qword [rsp + 0x20], rdi
lea r8, str.Unable_to_execute_the_command:__s_n_s
jmp 0x14000cb83
cmp esi, 0xc0000022
je 0x14000cb31
cmp esi, 0xc0000005
je 0x14000cb31
mov eax, esi
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14000cb3d
movzx eax, si
jmp 0x14000cb39
mov ecx, esi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x14000cb46
mov ecx, esi
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetNtMessage
jmp 0x14000cb4d
mov ecx, eax
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetWin32Message
lea r9, str.Unable_to_execute_the_command
mov rbx, rax
test rax, rax
jne 0x14000cb73
mov rcx, qword [rbp + 0x30]
lea r8, [0x140166310]
mov edx, 0x10
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
jmp 0x14000cba7
mov rax, qword [rbx + 8]
lea r8, str._s:__s
mov qword [rsp + 0x20], rax
mov rcx, qword [rbp + 0x30]
mov edx, 0x10
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowMessage
lea rcx, [rbx - 0x10]
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000cba7
call fcn.1400d9400
lea rcx, [r13 - 0x10]
lock xadd dword [rcx + 8], r15d
mov r14, qword [rsp + 0xf8]
cmp r15d, 1
mov r15, qword [rsp + 0xf0]
mov r13, qword [rsp + 0x100]
mov rdi, qword [rsp + 0x110]
mov rsi, qword [rsp + 0x118]
mov rbx, qword [rsp + 0x138]
jne 0x14000cbec
call fcn.1400d9400
add rsp, 0x120
pop rbp
ret