Function at 0x14000a560
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov byte [rax + 0x20], r9b
mov qword [rax + 8], rcx
sub rsp, 0x118
mov qword [rax - 8], rbp
mov qword [rax - 0x10], rsi
mov rsi, rcx
mov qword [rax - 0x18], rdi
mov rcx, rdx
mov qword [rax - 0x20], r12
mov r12, r8
mov qword [rax - 0x38], r15
call sym.ProcessJacker.exe_PhGetStringSetting
mov edx, 0x3a
xor r8d, r8d
mov rcx, rax
mov r15, rax
call sym.ProcessJacker.exe_PhFindCharInStringRef
or rbp, 0xffffffffffffffff
cmp rax, rbp
jne 0x14000a5df
mov rcx, qword [0x14015f350]
mov rdx, r15
call sym.ProcessJacker.exe_PhConcatStringRef2
mov rcx, r15
mov r15, rax
test rcx, rcx
je 0x14000a5df
add rcx, 0xfffffffffffffff0
mov eax, ebp
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000a5df
call fcn.1400ae900
movups xmm0, xmmword [r15]
xor r8d, r8d
mov qword [rsp + 0x128], rbx
lea rdx, [0x140152ba8]
mov rcx, r15
movups xmmword [rsp + 0x60], xmm0
call sym.ProcessJacker.exe_PhFindStringInStringRef
xor edi, edi
cmp rax, 0xffffffffffffffff
je 0x14000a712
mov rdx, qword [rsp + 0x68]
lea rcx, [rax + rax]
mov qword [rsp + 0xf0], r13
add rdx, rcx
add rdx, qword [0x140152ba8]
mov r13, qword [rsp + 0x60]
sub r13, rcx
mov qword [rsp + 0xe8], r14
sub r13, qword [0x140152ba8]
mov r14, rbp
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rcx
nop dword [rax]
inc r14
cmp word [r12 + r14*2], di
jne 0x14000a650
mov rbx, qword [0x14015e0c8]
add r14, r14
lea rdi, [r14 + r13]
add rdi, rcx
mov rcx, rbx
lea rdx, [rdi + 0x12]
call fcn.1400ae820
lock inc dword [rbx + 4]
mov r8, qword [rsp + 0x50]
lea rsi, [rax + 0x10]
mov rdx, qword [rsp + 0x68]
mov dword [rax + 8], 1
movzx ecx, byte [rbx + 2]
mov word [rax], cx
lea rax, [rsi + 0x10]
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rdi
mov word [rax + rdi], cx
mov rbx, qword [rsi + 8]
mov rcx, rbx
call fcn.1400e3970
add rbx, qword [rsp + 0x50]
mov r8, r14
mov rcx, rbx
mov rdx, r12
call fcn.1400e3970
mov rdx, qword [rsp + 0x58]
lea rcx, [r14 + rbx]
mov r8, r13
call fcn.1400e3970
mov r14, qword [rsp + 0xe8]
mov rcx, r15
mov r13, qword [rsp + 0xf0]
mov r15, rsi
test rcx, rcx
je 0x14000a708
add rcx, 0xfffffffffffffff0
mov eax, ebp
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000a708
call fcn.1400ae900
mov rsi, qword [rsp + 0x120]
xor edi, edi
cmp byte [rsp + 0x138], 0
mov r12, qword [rsp + 0xf8]
je 0x14000a770
mov rbx, qword [r15 + 8]
lea rcx, [rsp + 0x74]
xor edx, edx
mov dword [rsp + 0x70], 0x70
lea r8d, [rdx + 0x6c]
call fcn.1400e43c0
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0xa0], 5
mov qword [rsp + 0x78], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x14000a810
mov rdx, qword [r15 + 8]
xor r9d, r9d
mov qword [rsp + 0x48], rdi
xor r8d, r8d
mov qword [rsp + 0x40], rdi
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call sym.ProcessJacker.exe_PhCreateProcessWin32Ex
test eax, eax
jns 0x14000a810
mov rdi, qword [rsp + 0x140]
test rdi, rdi
je 0x14000a7fb
mov ecx, eax
call sym.ProcessJacker.exe_PhGetNtMessage
mov rbx, rax
test rax, rax
je 0x14000a7c4
mov r9, qword [rax + 8]
jmp 0x14000a7cb
lea r9, str.An_unknown_error_occurred.
lea r8, str.Unable_to_execute_the_command:__s_n_s
mov qword [rsp + 0x20], rdi
mov edx, 0x10
mov rcx, rsi
call sym.ProcessJacker.exe_PhShowMessage
lea rcx, [rbx - 0x10]
mov eax, ebp
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000a810
call fcn.1400ae900
jmp 0x14000a810
xor r9d, r9d
lea rdx, str.Unable_to_execute_the_command
mov r8d, eax
mov rcx, rsi
call sym.ProcessJacker.exe_PhShowStatus
lea rcx, [r15 - 0x10]
lock xadd dword [rcx + 8], ebp
mov r15, qword [rsp + 0xe0]
cmp ebp, 1
mov rbp, qword [rsp + 0x110]
mov rdi, qword [rsp + 0x100]
mov rsi, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x128]
jne 0x14000a84b
call fcn.1400ae900
add rsp, 0x118
ret