Function at 0x14000b220
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
mov byte [rax + 0x20], r9b
mov qword [rax + 8], rcx
sub rsp, 0xa8
mov qword [rax + 0x10], rbx
mov rcx, rdx
mov qword [rax - 8], rbp
mov qword [rax - 0x10], rsi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x20], r12
mov r12, r8
mov qword [rax - 0x38], r15
call sym.ProcessHacker.exe_PhGetStringSetting
mov rcx, rax
mov rbx, rax
call sym.ProcessHacker.exe_PhExpandEnvironmentStrings
or rsi, 0xffffffffffffffff
mov r15, rax
mov rbp, rax
test rbx, rbx
je 0x14000b284
lea rcx, [rbx - 0x10]
mov edx, esi
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14000b284
call fcn.1400c8bc0
mov qword [rsp + 0x80], r13
mov edx, 0x3a
xor r8d, r8d
mov qword [rsp + 0x78], r14
mov rcx, r15
call sym.ProcessHacker.exe_PhFindCharInStringRef
xor edi, edi
cmp rax, 0xffffffffffffffff
jne 0x14000b4d7
mov rcx, qword [r15 + 8]
lea rdx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r13, rax
test rax, rax
je 0x14000b477
cmp dword [rsp + 0x50], 2
jne 0x14000b477
mov rdi, qword [rax]
mov rbx, rsi
nop dword [rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x14000b2e0
mov rdx, qword [0x140196800]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r14, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rbx], ax
test rdi, rdi
je 0x14000b325
mov rcx, qword [r14 + 8]
mov r8, rbx
mov rdx, rdi
call fcn.14010e700
mov rdi, qword [r13 + 8]
mov rbx, rsi
nop dword [rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x14000b330
mov rdx, qword [0x140196800]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rbp, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rbx], ax
test rdi, rdi
je 0x14000b375
mov rcx, qword [rbp + 8]
mov r8, rbx
mov rdx, rdi
call fcn.14010e700
mov rcx, qword [r14 + 8]
call qword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
mov r8, qword [r14 + 8]
lea rbx, [0x140159074]
mov rdx, rbx
cmp eax, 5
jne 0x14000b3bd
mov r9, r8
mov qword [rsp + 0x20], rbx
mov r8, qword [0x140192528]
lea ecx, [rax - 1]
mov r8, qword [r8 + 8]
call sym.ProcessHacker.exe_PhConcatStrings
mov rdi, rax
mov ecx, esi
lock xadd dword [r14 - 8], ecx
cmp ecx, 1
jmp 0x14000b3d8
mov r9, rbx
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov rdi, rax
mov eax, esi
lock xadd dword [r14 - 8], eax
cmp eax, 1
jne 0x14000b3e3
lea rcx, [r14 - 0x10]
call fcn.1400c8bc0
mov r8, qword [rbp + 8]
mov r9, rbx
mov rdx, rbx
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov rbx, rax
lea rcx, [rbp - 0x10]
mov edx, esi
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14000b40f
call fcn.1400c8bc0
mov r9, qword [rbx + 8]
lea r8, [0x140159078]
mov rdx, qword [rdi + 8]
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov rbp, rax
lea rcx, [r15 - 0x10]
mov edx, esi
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14000b440
call fcn.1400c8bc0
lea rcx, [rbx - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000b455
call fcn.1400c8bc0
lea rcx, [rdi - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000b46a
call fcn.1400c8bc0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
jmp 0x14000b4d7
mov rcx, qword [r15 + 8]
call qword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
mov r8, qword [r15 + 8]
lea rbx, [0x140159074]
mov rdx, rbx
cmp eax, 5
jne 0x14000b4b1
mov r9, r8
mov qword [rsp + 0x20], rbx
mov r8, qword [0x140192528]
lea ecx, [rax - 1]
mov r8, qword [r8 + 8]
call sym.ProcessHacker.exe_PhConcatStrings
jmp 0x14000b4be
mov r9, rbx
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov rbp, rax
mov eax, esi
lock xadd dword [r15 - 8], eax
cmp eax, 1
jne 0x14000b4d7
lea rcx, [r15 - 0x10]
call fcn.1400c8bc0
movups xmm0, xmmword [rbp]
xor r8d, r8d
lea rdx, [0x14018abb0]
mov rcx, rbp
movups xmmword [rsp + 0x60], xmm0
call sym.ProcessHacker.exe_PhFindStringInStringRef
cmp rax, 0xffffffffffffffff
je 0x14000b633
mov rcx, qword [rsp + 0x68]
lea r13, [rax + rax]
mov r15, qword [rsp + 0x60]
add rcx, r13
add rcx, qword [0x14018abb0]
sub r15, r13
sub r15, qword [0x14018abb0]
mov rbx, rsi
mov qword [rsp + 0x58], rcx
nop word [rax + rax]
inc rbx
cmp word [r12 + rbx*2], 0
jne 0x14000b530
mov rdx, qword [0x140196800]
add rbx, rbx
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov r14, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], di
test r12, r12
je 0x14000b574
mov rcx, qword [rax + 8]
mov r8, rbx
mov rdx, r12
call fcn.14010e700
mov rcx, r14
call sym.ProcessHacker.exe_PhGetFileName
mov rdx, qword [0x140196800]
mov r12, rax
mov rbx, qword [rax]
add rbx, r15
add rbx, r13
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, qword [rsp + 0x68]
mov rdi, rax
mov r8, r13
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rbx], ax
mov rbx, qword [rdi + 8]
mov rcx, rbx
call fcn.14010e700
mov r8, qword [r12]
add rbx, r13
mov rdx, qword [r12 + 8]
mov rcx, rbx
call fcn.14010e700
add rbx, qword [r12]
mov r8, r15
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.14010e700
mov rcx, rbp
mov rbp, rdi
test rcx, rcx
je 0x14000b608
add rcx, 0xfffffffffffffff0
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000b608
call fcn.1400c8bc0
lea rcx, [r12 - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000b61e
call fcn.1400c8bc0
lea rcx, [r14 - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000b633
call fcn.1400c8bc0
mov rdx, qword [rbp + 8]
xor r8d, r8d
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov r13, qword [rsp + 0x80]
mov r12, qword [rsp + 0x88]
cmp byte [rsp + 0xc8], r8b
je 0x14000b670
mov rcx, qword [rsp + 0xb0]
call sym.ProcessHacker.exe_PhShellExecute
jmp 0x14000b77f
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhCreateProcessWin32Ex
mov ebx, eax
test eax, eax
jns 0x14000b77f
mov rdi, qword [rsp + 0xd0]
test rdi, rdi
je 0x14000b6ec
mov ecx, eax
call sym.ProcessHacker.exe_PhGetNtMessage
mov rbx, rax
test rax, rax
je 0x14000b6c5
mov r9, qword [rax + 8]
jmp 0x14000b6cc
lea r9, str.An_unknown_error_occurred.
mov rcx, qword [rsp + 0xb0]
lea r8, str.Unable_to_execute_the_command:__s_n_s
mov edx, 0x10
mov qword [rsp + 0x20], rdi
call sym.ProcessHacker.exe_PhShowMessage
jmp 0x14000b76a
cmp ebx, 0xc0000022
je 0x14000b70d
cmp ebx, 0xc0000005
je 0x14000b70d
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14000b719
movzx eax, bx
jmp 0x14000b715
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x14000b722
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x14000b729
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov rcx, qword [rsp + 0xb0]
mov rbx, rax
lea r9, str.Unable_to_execute_the_command
test rax, rax
jne 0x14000b751
lea r8, [0x1401689f8]
lea edx, [rax + 0x10]
call sym.ProcessHacker.exe_PhShowMessage
jmp 0x14000b77f
mov rax, qword [rbx + 8]
mov edx, 0x20
mov r8d, 0xfffe
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000b77f
call fcn.1400c8bc0
lea rcx, [rbp - 0x10]
lock xadd dword [rcx + 8], esi
mov rdi, qword [rsp + 0x90]
cmp esi, 1
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xb8]
jne 0x14000b7b2
call fcn.1400c8bc0
add rsp, 0xa8
ret