Function at 0x140008810
Capabilities:
Accept command line arguments
Check for time delay via queryperformancecounter
Create process on windows
Create process suspended
Terminate process

Disassembly:
push r15
mov eax, 0x2198
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14000f530
sub rsp, rax
mov r8d, 0x1000
xor edi, edi
lea rbx, [rsp + 0x190]
mov rsi, rcx
lea r12, [rsp + 0x120]
lea rcx, [rcx + 0x10]
mov rdx, rbx
call fcn.1400090e0
mov edx, 1
lea rcx, [0x140008250]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov rcx, r12
mov dword [rsp + 0x80], 0x18
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x90], 1
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
pxor xmm0, xmm0
mov eax, 1
xor ecx, ecx
movups xmmword [rsp + 0x128], xmm0
mov r13, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov qword [rsp + 0x138], 0
mov dword [rsp + 0x15c], 0x101
mov word [rsp + 0x160], ax
call r13
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__fileno
mov rbp, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
mov ecx, eax
call rbp
mov ecx, 1
cmp rax, 0xffffffffffffffff
cmove rax, rdi
mov qword [rsp + 0x170], rax
call r13
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__fileno
mov ecx, eax
call rbp
mov ecx, 2
cmp rax, 0xffffffffffffffff
cmove rax, rdi
mov qword [rsp + 0x178], rax
call r13
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll__fileno
mov ecx, eax
call rbp
cmp rax, 0xffffffffffffffff
cmove rax, rdi
mov qword [rsp + 0x180], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
mov qword [rsp + 0x40], r12
mov rcx, rbx
mov rdx, rax
lea rax, [rsi + 0x3040]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140008cc7
lea rax, str.PyInstallerOnefileHiddenWindow
pxor xmm0, xmm0
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0x110], rax
lea rax, [0x140008050]
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0x100], xmm0
mov qword [rsp + 0xd8], rax
call qword [sym.imp.USER32.dll_RegisterClassW]
mov qword [rsp + 0x58], rsi
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x50], 0
mov rdx, qword [rsp + 0x110]
lea r8, str.PyInstaller_Onefile_Hidden_Window
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x80000000
mov dword [rsp + 0x30], 0x80000000
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rsi + 0x3058], rax
test rax, rax
je 0x140008a4d
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov r13, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdi, qword [sym.imp.USER32.dll_PeekMessageW]
mov r12, qword [sym.imp.USER32.dll_TranslateMessage]
nop word cs:[rax + rax]
nop dword [rax]
mov edx, 0x64
mov rcx, qword [rsi + 0x3040]
call r13
movzx edx, byte [rsi + 0x3060]
test eax, eax
je 0x140008adb
test dl, dl
jne 0x140008c69
mov rbp, qword [sym.imp.USER32.dll_DispatchMessageW]
lea rbx, [rsp + 0xa0]
nop word cs:[rax + rax]
nop dword [rax]
mov rdx, qword [rsi + 0x3058]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x20], 1
call rdi
test eax, eax
jle 0x140008a70
mov rcx, rbx
call r12
mov rcx, rbx
call rbp
jmp 0x140008ab0
test dl, dl
jne 0x140008c69
movzx eax, byte [rsi + 0x3061]
lea r13, [rsp + 0x78]
test al, al
je 0x140008b8f
mov rdi, qword [sym.imp.USER32.dll_GetMessageW]
lea rbx, [rsp + 0xa0]
jmp 0x140008b2a
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call rdi
test eax, eax
jg 0x140008c8d
movzx eax, byte [rsi + 0x3061]
mov rdx, qword [rsi + 0x3058]
test al, al
jne 0x140008b10
test rdx, rdx
je 0x140008b4e
mov rcx, rdx
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [rsi + 0x3058], 0
mov rdx, r13
mov rcx, qword [rsi + 0x3040]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsi + 0x3040]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsi + 0x3048]
call rbx
mov eax, dword [rsp + 0x78]
add rsp, 0x2198
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x70]
lea rbx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov r15, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x68]
call r15
mov rdi, qword [sym.imp.USER32.dll_PeekMessageW]
mov r14, qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov r12, qword [sym.imp.USER32.dll_TranslateMessage]
mov rbp, qword [sym.imp.USER32.dll_DispatchMessageW]
nop dword [rax]
mov dword [rsp + 0x20], 0x4ff
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov r9d, 0x32
call r14
jmp 0x140008bfb
mov rcx, rbx
call r12
mov rcx, rbx
call rbp
mov rdx, qword [rsi + 0x3058]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x20], 1
call rdi
test eax, eax
jg 0x140008bf0
movzx eax, byte [rsi + 0x3061]
test al, al
jne 0x140008af7
mov rcx, r13
call r15
mov rax, qword [rsp + 0x78]
sub rax, qword [rsp + 0x68]
imul rax, rax, 0x3e8
cqo
idiv qword [rsp + 0x70]
cmp rax, 0xf9
jle 0x140008bd0
movzx eax, byte [rsi + 0x3061]
test al, al
jne 0x140008af7
mov rdx, qword [rsi + 0x3058]
jmp 0x140008b35
mov rcx, qword [rsi + 0x3040]
mov edx, 0x1f4
call r13
test eax, eax
jne 0x140008ca4
mov rdx, qword [rsi + 0x3058]
lea r13, [rsp + 0x78]
jmp 0x140008b35
mov rcx, rbx
call qword [sym.imp.USER32.dll_TranslateMessage]
mov rcx, rbx
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x140008b23
mov rcx, qword [rsi + 0x3040]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsi + 0x3040]
mov edx, 0xffffffff
call r13
jmp 0x140008c7c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Failed_to_create_child_process__n
lea rcx, str.CreateProcessW
mov edx, eax
call fcn.140003150
mov eax, 0xffffffff
jmp 0x140008b7b