Function at 0x1400f3ea0
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf8
xor ebx, ebx
mov r12, rdx
mov r13, rcx
mov edi, ebx
mov r14d, ebx
mov r15d, ebx
lea rbp, [rbx - 1]
test rdx, rdx
je 0x1400f3f1d
mov rsi, rbp
nop dword [rax]
inc rsi
cmp word [rdx + rsi*2], bx
jne 0x1400f3ee0
mov rdx, qword [0x1402418e8]
add rsi, rsi
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r14, rax
mov r8, rsi
mov rdx, r12
mov qword [rax], rsi
add rax, 0x10
mov qword [r14 + 8], rax
mov word [rax + rsi], bx
mov rcx, qword [r14 + 8]
call fcn.140188690
nop dword [rax]
test r13, r13
je 0x1400f3f71
mov rsi, rbp
nop dword [rax + rax]
inc rsi
cmp word [r13 + rsi*2], bx
jne 0x1400f3f30
mov rdx, qword [0x1402418e8]
add rsi, rsi
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
mov r8, rsi
mov rdx, r13
mov qword [rax], rsi
add rax, 0x10
mov qword [rdi + 8], rax
mov word [rax + rsi], bx
mov rcx, qword [rdi + 8]
call fcn.140188690
jmp 0x1400f3fea
test r14, r14
je 0x1400f3fea
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x140]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rsi, rax
test rax, rax
je 0x1400f3fea
mov rcx, qword [rax]
call sym.ProcessHacker.exe_PhCreateString
mov rcx, rsi
mov rdi, rax
mov r13, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r13, r13
je 0x1400f3fea
mov rcx, qword [r13 + 8]
call sym.ProcessHacker.exe_PhDoesFileExistsWin32
test al, al
jne 0x1400f3fea
mov rcx, qword ds:[r13 + 8]
call fcn.1400f8160
mov rdi, rax
lea rcx, [r13 - 0x10]
test rax, rax
mov eax, ebp
jne 0x1400f3fd6
mov rdi, rbx
lock xadd dword ds:[rcx + 8], eax
cmp eax, 1
jne 0x1400f3fea
call fcn.1400fbcc0
mov r12, qword [rsp + 0x158]
test r12, r12
je 0x1400f4042
mov rsi, rbp
nop word [rax + rax]
inc rsi
cmp word [r12 + rsi*2], bx
jne 0x1400f4000
mov rdx, qword [0x1402418e8]
add rsi, rsi
lea rcx, [rsi + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r15, rax
mov r8, rsi
mov rdx, r12
mov qword [rax], rsi
add rax, 0x10
mov qword [r15 + 8], rax
mov word [rax + rsi], bx
mov rcx, qword [r15 + 8]
call fcn.140188690
nop
jmp 0x1400f4057
test rdi, rdi
je 0x1400f4057
cmp qword [rdi], rbx
je 0x1400f4057
mov rcx, rdi
call sym.ProcessHacker.exe_PhGetBaseDirectory
mov r15, rax
mov r8d, dword [rsp + 0x168]
mov ecx, r8d
mov r11, qword [rsp + 0x160]
mov eax, r8d
shr ecx, 5
and ecx, 1
mov edx, ecx
or edx, 2
and al, 0x40
mov eax, r8d
cmove edx, ecx
mov ecx, edx
or ecx, 4
and al, 4
mov eax, r8d
cmove ecx, edx
mov edx, ecx
or edx, 0x10
and al, 0x10
mov eax, r8d
cmove edx, ecx
mov ecx, edx
bts ecx, 0xa
and al, 2
mov eax, r8d
cmove ecx, edx
mov edx, ecx
bts edx, 0x13
and al, 0x80
mov eax, r8d
cmove edx, ecx
mov ecx, edx
bts ecx, 0x18
and al, 8
mov eax, r8d
cmove ecx, edx
mov esi, ecx
bts esi, 0x1a
and eax, 0x100
cmove esi, ecx
test r11, r11
jne 0x1400f411e
xorps xmm0, xmm0
mov dword [rsp + 0x80], 0x68
xor eax, eax
movups xmmword [rsp + 0x84], xmm0
mov dword [rsp + 0xe4], eax
movups xmmword [rsp + 0x94], xmm0
movups xmmword [rsp + 0xa4], xmm0
movups xmmword [rsp + 0xb4], xmm0
movups xmmword [rsp + 0xc4], xmm0
movups xmmword [rsp + 0xd4], xmm0
mov r10, qword [rsp + 0x170]
test r10, r10
je 0x1400f41a8
test r15, r15
je 0x1400f4136
mov r9, qword [r15 + 8]
jmp 0x1400f4139
mov r9, rbx
test r14, r14
je 0x1400f4144
mov rcx, qword [r14 + 8]
jmp 0x1400f4147
mov rcx, rbx
test rdi, rdi
je 0x1400f4152
mov rdx, qword [rdi + 8]
jmp 0x1400f4155
mov rdx, rbx
test r11, r11
lea rax, [rsp + 0x80]
cmovne rax, r11
and r8d, 1
lea r11, [rsp + 0x60]
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x40], r9
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], r8d
mov r8, rcx
mov rcx, r10
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x1400f421c
test r15, r15
je 0x1400f41b3
mov r9, qword [r15 + 8]
jmp 0x1400f41b6
mov r9, rbx
test r14, r14
je 0x1400f41c2
mov rdx, qword ds:[r14 + 8]
jmp 0x1400f41c5
mov rdx, rbx
test rdi, rdi
je 0x1400f41d0
mov rcx, qword [rdi + 8]
jmp 0x1400f41d3
mov rcx, rbx
test r11, r11
lea r10, [rsp + 0x60]
mov qword [rsp + 0x48], r10
lea rax, [rsp + 0x80]
cmovne rax, r11
and r8d, 1
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x38], r9
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r8d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
nop dword [rax]
test eax, eax
jne 0x1400f423b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1400f4232
mov ebx, eax
jmp 0x1400f423b
movzx ebx, ax
or ebx, 0xc0070000
nop dword [rax + rax]
test rdi, rdi
je 0x1400f425a
lea rcx, [rdi - 0x10]
mov eax, ebp
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400f425a
call fcn.1400fbcc0
test r14, r14
je 0x1400f4274
lea rcx, [r14 - 0x10]
mov eax, ebp
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400f4274
call fcn.1400fbcc0
test r15, r15
je 0x1400f428c
lea rcx, [r15 - 0x10]
lock xadd dword [rcx + 8], ebp
cmp ebp, 1
jne 0x1400f428c
call fcn.1400fbcc0
test ebx, ebx
js 0x1400f42ea
mov rcx, qword [rsp + 0x178]
test rcx, rcx
je 0x1400f42ac
mov eax, dword [rsp + 0x70]
mov qword [rcx], rax
mov eax, dword [rsp + 0x74]
mov qword [rcx + 8], rax
mov rcx, qword [rsp + 0x180]
test rcx, rcx
je 0x1400f42c3
mov rax, qword [rsp + 0x60]
mov qword [rcx], rax
jmp 0x1400f42d3
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400f42d3
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x68]
test rax, rax
je 0x1400f42ff
mov qword [rax], rcx
jmp 0x1400f430b
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400f42fa
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x68]
nop
test rcx, rcx
je 0x1400f430b
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret