Function at 0x1400038b0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
xor r12d, r12d
mov r15, rcx
mov qword [rbp + 0xc8], r12
xor eax, eax
mov r13, rdx
mov ecx, 5
lock cmpxchg qword [0x14018d8b0], rcx
je 0x1400038fa
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfAcquireQueuedLockShared
mov rsi, qword [0x140191a30]
lea rax, str.EnableWarnings
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x1b8], rbx
mov qword [rbp - 0x58], 0x1c
mov qword [rbp - 0x50], rax
call qword [rsi + 0x10]
mov edx, dword [rsi + 0x18]
mov r14d, eax
mov rcx, qword [rsi + 0x20]
dec edx
btr r14d, 0x1f
and edx, r14d
mov r8d, dword [rcx + rdx*4]
cmp r8d, 0xffffffff
je 0x14000397e
nop dword [rax]
nop word [rax + rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, r8d
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x140003974
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 0x60]
call qword [rsi + 8]
test al, al
jne 0x1400039b4
mov r8d, dword [rbx + 4]
cmp r8d, 0xffffffff
jne 0x140003950
mov ebx, dword [rbp + 0xc0]
mov rdi, r12
mov eax, 5
lock cmpxchg qword [0x14018d8b0], r12
je 0x1400039a3
lea rcx, [0x14018d8b0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfReleaseQueuedLockShared
test rdi, rdi
jne 0x1400039c3
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rdi, rdi
je 0x14000397e
cmp dword [rdi], 1
jne 0x14000397e
mov ebx, dword [rdi + 0x28]
jmp 0x140003987
test ebx, ebx
je 0x1400039f2
mov r8, qword [r13 + 0x30]
lea r9, str.The_process_will_be_restarted_with_the_same_command_line_and_working_directory__but_if_it_is_running_under_a_different_user_it_will_be_restarted_under_the_current_user.
lea rdx, str.restart
mov byte [rsp + 0x20], r12b
mov rcx, r15
mov r8, qword [r8 + 8]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhShowConfirmMessage
test al, al
je 0x140003db8
mov edi, dword [sym.4yUlCM3HuVsHzW5CaCX.exe_ProcessQueryAccess]
mov rax, qword [r13 + 0x20]
or edi, 0x10
cmp byte [0x1401910b4], r12b
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r12
je 0x140003a1d
mov eax, edi
and eax, 0x1410
cmp eax, edi
je 0x140003a65
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x30
lea r9, [rsp + 0x50]
mov qword [rsp + 0x78], r12
lea r8, [rsp + 0x70]
mov dword [rbp - 0x78], r12d
mov edx, edi
mov qword [rbp - 0x80], r12
lea rcx, [rbp + 0xc8]
movdqu xmmword [rbp - 0x70], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
cmp eax, 0xc0000022
jne 0x140003a7a
cmp byte [0x1401910b4], r12b
je 0x140003a7a
lea r8, [rsp + 0x50]
mov edx, edi
lea rcx, [rbp + 0xc8]
call fcn.1400ecc50
mov ebx, eax
test ebx, ebx
js 0x140003d8d
mov rcx, qword [rbp + 0xc8]
lea rdx, [rbp + 0xc0]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetProcessCommandLine
mov ebx, eax
test eax, eax
js 0x140003d8d
mov r14, qword [rbp + 0xc0]
mov rcx, r14
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhAutoDereferenceObject
mov rsi, qword [rbp + 0xc8]
lea r8, [rbp + 0x40]
mov rcx, rsi
mov qword [rsp + 0x20], r12
mov r9d, 0x30
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ebx, eax
test eax, eax
js 0x140003d8d
mov rdx, qword [rbp + 0x48]
lea r8, [rsp + 0x50]
add rdx, 0x20
mov qword [rsp + 0x20], r12
mov r9d, 8
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
mov ebx, eax
test eax, eax
js 0x140003d8d
mov rdx, qword [rsp + 0x50]
lea r8, [rsp + 0x70]
add rdx, 0x38
mov qword [rsp + 0x20], r12
mov r9d, 0x10
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
mov ebx, eax
test eax, eax
js 0x140003d8d
movzx ebx, word [rsp + 0x70]
mov rdx, qword [0x140191180]
lea rcx, [rbx + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov rcx, rsi
mov qword [rsp + 0x20], r12
mov rdi, rax
mov qword [rax], rbx
lea rdx, [rax + 0x10]
mov qword [rax + 8], rdx
mov word [rdx + rbx], r12w
mov r9, qword [rax]
mov r8, qword [rax + 8]
mov rdx, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
mov ebx, eax
test eax, eax
jns 0x140003b9b
lea rcx, [rdi - 0x10]
mov rdi, 0xffffffffffffffff
lock xadd dword [rcx + 8], edi
cmp edi, 1
jne 0x140003d8d
call fcn.1400d9400
jmp 0x140003d8d
mov rcx, rdi
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhAutoDereferenceObject
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [r13 + 0x20]
lea r9, [rsp + 0x60]
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
lea r8, [rbp - 0x60]
mov qword [rbp + 0xc8], r12
mov edx, 1
mov qword [rsp + 0x68], r12
lea rcx, [rbp + 0xc8]
mov dword [rbp - 0x60], 0x30
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x58], r12
mov dword [rbp - 0x48], r12d
mov qword [rbp - 0x50], r12
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
cmp eax, 0xc0000022
jne 0x140003c25
cmp byte [0x1401910b4], r12b
je 0x140003c25
lea r8, [rsp + 0x60]
mov edx, 1
lea rcx, [rbp + 0xc8]
call fcn.1400ecc50
mov ebx, eax
test ebx, ebx
js 0x140003d8d
mov rcx, qword [rbp + 0xc8]
mov edx, 1
call fcn.1400e45a0
mov ebx, eax
test eax, eax
js 0x140003d8d
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [r13 + 0x50]
mov qword [rbp + 0xc8], r12
test rax, rax
je 0x140003c6b
mov r15, qword [rax + 8]
jmp 0x140003c6e
mov r15, r12
mov r14, qword [r14 + 8]
xor ebx, ebx
mov r12, qword [rdi + 8]
mov esi, ebx
mov rdi, 0xffffffffffffffff
test r14, r14
je 0x140003cd2
mov rbx, rdi
nop dword [rax]
inc rbx
cmp word [r14 + rbx*2], si
jne 0x140003c90
mov rdx, qword [0x140191180]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov rsi, rax
mov r8, rbx
mov rdx, r14
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rbx], ax
mov rcx, qword [rsi + 8]
call fcn.1401317c0
xor ebx, ebx
xorps xmm0, xmm0
mov dword [rbp - 0x30], 0x68
xor eax, eax
mov dword [rbp + 0x34], eax
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
test rsi, rsi
je 0x140003d04
mov rdx, qword [rsi + 8]
jmp 0x140003d07
mov rdx, rbx
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp - 0x30]
mov rcx, r15
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140003d54
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140003d54
movzx ebx, ax
or ebx, 0xc0070000
test rsi, rsi
je 0x140003d6c
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], edi
cmp edi, 1
jne 0x140003d6c
call fcn.1400d9400
test ebx, ebx
js 0x140003d86
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtClose]
mov r15, qword [rbp + 0xb0]
mov rcx, qword [rbp + 0xc8]
test rcx, rcx
je 0x140003d9f
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x140003dbc
mov r9d, ebx
lea rdx, str.restart
mov r8, r13
mov rcx, r15
call fcn.140002ce0
xor al, al
jmp 0x140003dbe
mov al, 1
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret