Function at 0x14000c9c0
Capabilities:
Accept command line arguments

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rbp
push r12
push r15
sub rsp, 0x98
mov rbx, rdx
mov rbp, rcx
call sym.ProcessHacker.exe_PhGetApplicationDirectory
mov qword [rsp + 0x70], rax
mov r15, rax
test rax, rax
jne 0x14000ca65
mov ecx, 0xc0000225
call sym.ProcessHacker.exe_PhGetNtMessage
lea r9, str.Unable_to_locate_the_application_directory.
mov rbx, rax
mov rcx, rbp
test rax, rax
je 0x14000ca45
mov rdx, qword [rax + 8]
mov r8d, 0xfffe
mov qword [rsp + 0x28], rdx
lea rax, [0x1401b439c]
lea edx, [r15 + 0x20]
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, ds:[rbx - 0x10]
lea r12d, [r15 - 1]
jmp 0x14000cf5d
lea r8, [0x1401c7ff8]
mov edx, 0x10
add rsp, 0x98
pop r15
pop r12
pop rbp
pop rbx
jmp sym.ProcessHacker.exe_PhShowMessage
mov qword [rsp + 0x90], rdi
mov rcx, rbx
mov qword [rsp + 0x88], r13
call sym.ProcessHacker.exe_PhGetStringSetting
mov rcx, rax
mov rbx, rax
call sym.ProcessHacker.exe_PhExpandEnvironmentStrings
mov rdi, rax
mov r13, rax
mov r12d, 0xffffffff
test rbx, rbx
je 0x14000caaf
lea rcx, [rbx - 0x10]
mov edx, r12d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14000caaf
call fcn.140106290
mov qword [rsp + 0xc8], rsi
mov edx, 0x3a
xor r8d, r8d
mov qword [rsp + 0x80], r14
mov rcx, rdi
call sym.ProcessHacker.exe_PhFindCharInStringRef
cmp rax, 0xffffffffffffffff
jne 0x14000cc8e
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r14, rax
test rax, rax
je 0x14000cc30
cmp dword [rsp + 0x50], 2
jne 0x14000cc30
mov rcx, qword [rax]
call sym.ProcessHacker.exe_PhCreateString
mov rcx, qword [r14 + 8]
mov rsi, rax
call sym.ProcessHacker.exe_PhCreateString
mov rcx, qword ds:[rsi + 8]
mov r13, rax
call qword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
mov r8, qword [rsi + 8]
lea rbx, [0x1401b4408]
mov rdx, rbx
cmp eax, 5
jne 0x14000cb66
mov r9, r8
mov qword [rsp + 0x20], rbx
mov r8, qword [r15 + 8]
lea ecx, [rax - 1]
call sym.ProcessHacker.exe_PhConcatStrings
mov r15, rax
test rsi, rsi
je 0x14000cb91
lea rcx, [rsi - 0x10]
mov edx, r12d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jmp 0x14000cb8a
mov r9, rbx
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov r15, rax
test rsi, rsi
je 0x14000cb91
lea rcx, [rsi - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000cb91
call fcn.140106290
mov r8, qword [r13 + 8]
mov r9, rbx
mov rdx, rbx
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov rbx, rax
lea rcx, [r13 - 0x10]
mov edx, r12d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14000cbbe
call fcn.140106290
mov r9, qword [rbx + 8]
lea r8, [0x1401b440c]
mov rdx, qword [r15 + 8]
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov r13, rax
lea rcx, [rdi - 0x10]
mov edx, r12d
lock xadd dword [rcx + 8], edx
cmp edx, 1
jne 0x14000cbf0
call fcn.140106290
lea rcx, ds:[rbx - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000cc0a
call fcn.140106290
lea rcx, [r15 - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000cc25
nop dword [rax + rax]
call fcn.140106290
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000cc8e
mov rcx, qword [rdi + 8]
call qword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
mov r8, qword [rdi + 8]
lea rbx, [0x1401b4408]
mov rdx, rbx
cmp eax, 5
jne 0x14000cc67
mov r9, r8
mov qword [rsp + 0x20], rbx
mov r8, qword [r15 + 8]
lea ecx, [rax - 1]
call sym.ProcessHacker.exe_PhConcatStrings
jmp 0x14000cc74
mov r9, rbx
mov ecx, 3
call sym.ProcessHacker.exe_PhConcatStrings
mov r13, rax
mov eax, r12d
lock xadd dword [rdi - 8], eax
cmp eax, 1
jne 0x14000cc8e
lea rcx, [rdi - 0x10]
call fcn.140106290
movups xmm0, xmmword [r13]
xor r8d, r8d
lea rdx, [0x14020d0f8]
mov rcx, r13
movups xmmword [rsp + 0x60], xmm0
call sym.ProcessHacker.exe_PhFindStringInStringRef
xor ecx, ecx
cmp rax, 0xffffffffffffffff
je 0x14000cdc0
mov rsi, qword [rsp + 0x68]
lea r14, [rax + rax]
mov rbp, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xd0]
sub rbp, r14
sub rbp, qword [0x14020d0f8]
lea r15, [r14 + rsi]
add r15, qword [0x14020d0f8]
call sym.ProcessHacker.exe_PhCreateString
mov rcx, rax
mov qword [rsp + 0x60], rax
call sym.ProcessHacker.exe_PhGetFileName
mov rdx, qword [0x140213b58]
mov qword [rsp + 0x58], rax
mov rbx, qword [rax]
add rbx, r14
add rbx, rbp
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
mov r8, r14
mov rdx, rsi
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rbx], ax
mov rbx, qword [rdi + 8]
mov rcx, rbx
call fcn.140165120
mov rsi, qword [rsp + 0x58]
add rbx, r14
mov rcx, rbx
mov r8, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140165120
add rbx, qword [rsi]
mov r8, rbp
mov rcx, rbx
mov rdx, r15
call fcn.140165120
mov rcx, r13
mov r13, rdi
test rcx, rcx
je 0x14000cd85
add rcx, 0xfffffffffffffff0
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000cd85
nop dword [rax + rax]
call fcn.140106290
lea rcx, [rsi - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000cd9b
call fcn.140106290
mov rcx, qword [rsp + 0x60]
mov eax, r12d
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000cdb6
call fcn.140106290
mov rbp, qword [rsp + 0xc0]
xor ecx, ecx
mov rdx, qword ds:[r13 + 8]
xor r8d, r8d
mov r14, qword [rsp + 0x80]
mov rsi, qword [rsp + 0xc8]
cmp byte [rsp + 0xd8], r8b
je 0x14000cdf7
mov rcx, rbp
call sym.ProcessHacker.exe_PhShellExecute
jmp 0x14000cf2e
mov qword [rsp + 0x48], rcx
xor r9d, r9d
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call sym.ProcessHacker.exe_PhCreateProcessWin32Ex
mov ebx, eax
test eax, eax
jns 0x14000cf2e
mov rdi, qword [rsp + 0xe0]
test rdi, rdi
je 0x14000ce8a
mov ecx, eax
call sym.ProcessHacker.exe_PhGetNtMessage
mov rbx, rax
test rax, rax
je 0x14000ce4b
mov rax, qword [rax + 8]
jmp 0x14000ce52
lea rax, [0x1401b4410]
mov qword ss:[rsp + 0x30], rdi
lea r9, str.Unable_to_execute_the_command.
mov qword [rsp + 0x28], rax
mov edx, 0x20
lea rax, str._s_n_s
mov r8d, 0xfffe
mov rcx, rbp
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
jmp 0x14000cf05
cmp ebx, 0xc0000022
je 0x14000ceac
cmp ebx, 0xc0000005
je 0x14000ceac
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14000ceb8
movzx eax, bx
jmp 0x14000ceb4
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x14000cec2
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
nop
jmp 0x14000cec9
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
lea r9, str.Unable_to_execute_the_command.
mov rbx, rax
mov rcx, rbp
test rax, rax
je 0x14000cf1d
mov rax, qword ds:[rax + 8]
mov edx, 0x20
mov qword [rsp + 0x28], rax
mov r8d, 0xfffe
lea rax, [0x1401b439c]
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhShowMessage2
lea rcx, [rbx - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000cf2e
call fcn.140106290
jmp 0x14000cf2e
lea r8, [0x1401c7ff8]
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [r13 - 0x10]
mov eax, r12d
lock xadd dword [rcx + 8], eax
mov r13, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
cmp eax, 1
jne 0x14000cf54
call fcn.140106290
mov rcx, qword [rsp + 0x70]
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], r12d
cmp r12d, 1
jne 0x14000cf6e
call fcn.140106290
add rsp, 0x98
pop r15
pop r12
pop rbp
pop rbx
ret