Function at 0x7ff7bffcc9c0
Capabilities:
Accept command line arguments

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rbp
push r12
push r15
sub rsp, 0x98
mov rbx, rdx
mov rbp, rcx
call sym.ProcessHacker.exe_PhGetApplicationDirectory
mov qword [rsp + 0x70], rax
mov r15, rax
test rax, rax
jne 0x7ff7bffcca65
mov ecx, 0xc0000225
call sym.ProcessHacker.exe_PhGetNtMessage
lea r9, [0x7ff7c01743b0]
mov rbx, rax
mov rcx, rbp
test rax, rax
je 0x7ff7bffcca45
mov rdx, qword [rax + 8]
mov r8d, 0xfffe
mov qword [rsp + 0x28], rdx
lea rax, [0x7ff7c017439c]
lea edx, [r15 + 0x20]
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, ds:[rbx - 0x10]
lea r12d, [r15 - 1]
jmp 0x7ff7bffccf5d
lea r8, [0x7ff7c0187ff8]
mov edx, 0x10
add rsp, 0x98
pop r15
pop r12
pop rbp
pop rbx
jmp sym.ProcessHacker.exe_PhShowMessage
mov qword [rsp + 0x90], rdi
mov rcx, rbx
mov qword [rsp + 0x88], r13
call sym.ProcessHacker.exe_PhGetStringSetting
mov rcx, rax
mov rbx, rax
call sym.ProcessHacker.exe_PhExpandEnvironmentStrings
mov rdi, rax
mov r13, rax
mov r12d, 0xffffffff
test rbx, rbx
je 0x7ff7bffccaaf
lea rcx, [rbx - 0x10]
mov edx, r12d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x7ff7bffccaaf
call fcn.7ff7c00c6290
mov qword [rsp + 0xc8], rsi
mov edx, 0x3a
xor r8d, r8d
mov qword [rsp + 0x80], r14
mov rcx, rdi
call sym.ProcessHacker.exe_PhFindCharInStringRef
cmp rax, 0xffffffffffffffff
jne 0x7ff7bffccc8e
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r14, rax
test rax, rax
je 0x7ff7bffccc30
cmp dword [rsp + 0x50], 2
jne 0x7ff7bffccc30
mov rcx, qword [rax]
call sym.ProcessHacker.exe_PhCreateString
mov rcx, qword [r14 + 8]
mov rsi, rax
call sym.ProcessHacker.exe_PhCreateString
mov rcx, qword ds:[rsi + 8]
mov r13, rax
call qword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
mov r8, qword [rsi + 8]
lea rbx, [0x7ff7c0174408]
mov rdx, rbx
cmp eax, 5
jne 0x7ff7bffccb66
mov r9, r8
mov qword [rsp + 0x20], rbx
mov r8, qword [r15 + 8]
lea ecx, [rax - 1]
call sym.ProcessHacker.exe_PhConcatStrings
mov r15, rax
test rsi, rsi
je 0x7ff7bffccb91
lea rcx, [rsi - 0x10]
mov edx, r12d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jmp 0x7ff7bffccb8a
mov r9, rbx
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov r15, rax
test rsi, rsi
je 0x7ff7bffccb91
lea rcx, [rsi - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7bffccb91
call fcn.7ff7c00c6290
mov r8, qword [r13 + 8]
mov r9, rbx
mov rdx, rbx
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov rbx, rax
lea rcx, [r13 - 0x10]
mov edx, r12d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x7ff7bffccbbe
call fcn.7ff7c00c6290
mov r9, qword [rbx + 8]
lea r8, [0x7ff7c017440c]
mov rdx, qword [r15 + 8]
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov r13, rax
lea rcx, [rdi - 0x10]
mov edx, r12d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x7ff7bffccbf0
call fcn.7ff7c00c6290
lea rcx, ds:[rbx - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7bffccc0a
call fcn.7ff7c00c6290
lea rcx, [r15 - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7bffccc25
nop dword [rax + rax]
call fcn.7ff7c00c6290
mov rcx, r14
call qword [sym.imp.kernel32.dll_LocalFree]
jmp 0x7ff7bffccc8e
mov rcx, qword [rdi + 8]
call qword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
mov r8, qword [rdi + 8]
lea rbx, [0x7ff7c0174408]
mov rdx, rbx
cmp eax, 5
jne 0x7ff7bffccc67
mov r9, r8
mov qword [rsp + 0x20], rbx
mov r8, qword [r15 + 8]
lea ecx, [rax - 1]
call sym.ProcessHacker.exe_PhConcatStrings
jmp 0x7ff7bffccc74
mov r9, rbx
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov r13, rax
mov eax, r12d
lock xadd dword [rdi - 8], eax
cmp eax, 1
jne 0x7ff7bffccc8e
lea rcx, [rdi - 0x10]
call fcn.7ff7c00c6290
movups xmm0, xmmword [r13]
xor r8d, r8d
lea rdx, [0x7ff7c01cd0f8]
mov rcx, r13
movups xmmword [rsp + 0x60], xmm0
call sym.ProcessHacker.exe_PhFindStringInStringRef
xor ecx, ecx
cmp rax, 0xffffffffffffffff
je 0x7ff7bffccdc0
mov rsi, qword [rsp + 0x68]
lea r14, [rax + rax]
mov rbp, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xd0]
sub rbp, r14
sub rbp, qword [0x7ff7c01cd0f8]
lea r15, [r14 + rsi]
add r15, qword [0x7ff7c01cd0f8]
call sym.ProcessHacker.exe_PhCreateString
mov rcx, rax
mov qword [rsp + 0x60], rax
call sym.ProcessHacker.exe_PhGetFileName
mov rdx, qword [0x7ff7c01d3b58]
mov qword [rsp + 0x58], rax
mov rbx, qword [rax]
add rbx, r14
add rbx, rbp
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
mov r8, r14
mov rdx, rsi
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rbx], ax
mov rbx, qword [rdi + 8]
mov rcx, rbx
call fcn.7ff7c0125120
mov rsi, qword [rsp + 0x58]
add rbx, r14
mov rcx, rbx
mov r8, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.7ff7c0125120
add rbx, qword [rsi]
mov r8, rbp
mov rcx, rbx
mov rdx, r15
call fcn.7ff7c0125120
mov rcx, r13
mov r13, rdi
test rcx, rcx
je 0x7ff7bffccd85
add rcx, 0xfffffffffffffff0
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7bffccd85
nop dword [rax + rax]
call fcn.7ff7c00c6290
lea rcx, [rsi - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7bffccd9b
call fcn.7ff7c00c6290
mov rcx, qword [rsp + 0x60]
mov eax, r12d
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7bffccdb6
call fcn.7ff7c00c6290
mov rbp, qword [rsp + 0xc0]
xor ecx, ecx
mov rdx, qword ds:[r13 + 8]
xor r8d, r8d
mov r14, qword [rsp + 0x80]
mov rsi, qword [rsp + 0xc8]
cmp byte [rsp + 0xd8], r8b
je 0x7ff7bffccdf7
mov rcx, rbp
call sym.ProcessHacker.exe_PhShellExecute
jmp 0x7ff7bffccf2e
mov qword [rsp + 0x48], rcx
xor r9d, r9d
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call sym.ProcessHacker.exe_PhCreateProcessWin32Ex
mov ebx, eax
test eax, eax
jns 0x7ff7bffccf2e
mov rdi, qword [rsp + 0xe0]
test rdi, rdi
je 0x7ff7bffcce8a
mov ecx, eax
call sym.ProcessHacker.exe_PhGetNtMessage
mov rbx, rax
test rax, rax
je 0x7ff7bffcce4b
mov rax, qword [rax + 8]
jmp 0x7ff7bffcce52
lea rax, [0x7ff7c0174410]
mov qword ss:[rsp + 0x30], rdi
lea r9, [0x7ff7c0174458]
mov qword [rsp + 0x28], rax
mov edx, 0x20
lea rax, [0x7ff7c0174448]
mov r8d, 0xfffe
mov rcx, rbp
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
jmp 0x7ff7bffccf05
cmp ebx, 0xc0000022
je 0x7ff7bffcceac
cmp ebx, 0xc0000005
je 0x7ff7bffcceac
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x7ff7bffcceb8
movzx eax, bx
jmp 0x7ff7bffcceb4
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x7ff7bffccec2
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
nop
jmp 0x7ff7bffccec9
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, [0x7ff7c0174458]
mov rbx, rax
mov rcx, rbp
test rax, rax
je 0x7ff7bffccf1d
mov rax, qword ds:[rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov r8d, 0xfffe
lea rax, [0x7ff7c017439c]
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7bffccf2e
call fcn.7ff7c00c6290
jmp 0x7ff7bffccf2e
lea r8, [0x7ff7c0187ff8]
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [r13 - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
mov r13, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
cmp eax, 1
jne 0x7ff7bffccf54
call fcn.7ff7c00c6290
mov rcx, qword [rsp + 0x70]
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], r12d
cmp r12d, 1
jne 0x7ff7bffccf6e
call fcn.7ff7c00c6290
add rsp, 0x98
pop r15
pop r12
pop rbp
pop rbx
ret