Function at 0x180006320
Capabilities:
Accept command line arguments
Get hostname
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x18003f390]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov dword [rsp + 0x60], r8d
mov r15, rcx
lea r14, [0x180031f94]
test dl, dl
je 0x18000636b
mov rdx, r14
call fcn.180003960
lea rdx, str.________________________________________________________________________________________________________________________________________________________________r_n
mov rcx, r15
call fcn.180003960
xor r13d, r13d
mov esi, 0x400
mov byte [rsp + 0x70], 0
lea rdi, [rsp + 0x70]
lea r8, [rsp + 0x70]
mov ecx, esi
mov r9d, r13d
mov edx, r13d
lea r10, [0x180000000]
lea rax, [rcx + 0x7ffffbfe]
test rax, rax
je 0x1800063c9
movzx eax, byte [rdx + r10 + 0x31ee0]
test al, al
je 0x1800063c9
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x1800063a0
jmp 0x1800063ce
test rcx, rcx
jne 0x1800063da
dec r8
mov r9d, 0x8007007a
dec rdx
mov rax, rsi
mov byte [r8], r13b
lea rcx, [rsp + rdx + 0x70]
sub rax, rdx
test r9d, r9d
jns 0x1800063f6
cmp r9d, 0x8007007a
jne 0x1800063fc
mov rdi, rcx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov r12d, 0x7ffffffe
test rdi, rdi
jne 0x180006416
test rsi, rsi
jne 0x1800064a8
cmp rsi, 0x7fffffff
ja 0x1800064a8
test rax, rax
lea r9, [0x180031722]
mov r8, rdi
cmovne r9, rax
mov rcx, rsi
test rsi, rsi
jne 0x180006448
cmp byte [r9], r13b
je 0x1800064a2
test rdi, rdi
je 0x1800064a8
jmp 0x1800064a2
mov r10, r12
mov r11d, r13d
mov rdx, r13
sub r10, rsi
lea rax, [rcx + r10]
test rax, rax
je 0x180006476
movzx eax, byte [rdx + r9]
test al, al
je 0x180006476
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x180006454
jmp 0x18000647b
test rcx, rcx
jne 0x180006487
dec r8
mov r11d, 0x8007007a
dec rdx
mov rcx, rsi
mov byte [r8], r13b
lea r8, [rdx + rdi]
sub rcx, rdx
test r11d, r11d
jns 0x1800064a2
cmp r11d, 0x8007007a
jne 0x1800064a8
mov rdi, r8
mov rsi, rcx
lea rbx, [rsp + 0x70]
cmp byte [rsp + 0x70], r13b
je 0x1800064f5
nop word [rax + rax]
lea rdx, str.password
mov r8d, 8
mov rcx, rbx
call fcn.180016088
test eax, eax
jne 0x1800064ed
add rbx, 8
cmp byte [rbx], r13b
je 0x1800064ed
mov byte [rbx], 0x2a
inc rbx
cmp byte [rbx], r13b
jne 0x1800064e2
inc rbx
cmp byte [rbx], r13b
jne 0x1800064c0
test rdi, rdi
jne 0x1800064ff
test rsi, rsi
jne 0x180006548
cmp rsi, 0x7fffffff
ja 0x180006548
test rsi, rsi
je 0x180006548
mov rcx, r12
mov rdx, r14
sub rcx, rsi
sub rdx, rdi
nop dword [rax]
lea rax, [rsi + rcx]
test rax, rax
je 0x18000653d
movzx eax, byte [rdi + rdx]
test al, al
je 0x18000653d
mov byte [rdi], al
inc rdi
dec rsi
jne 0x180006520
jmp 0x180006542
test rsi, rsi
jne 0x180006545
dec rdi
mov byte [rdi], r13b
lea rdx, [rsp + 0x70]
mov rcx, r15
call fcn.180003960
lea rax, [rsp + 0x70]
mov byte [rsp + 0x70], r13b
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], 0x400
mov ecx, 0x400
lea r8, [rsp + 0x70]
mov r9d, r13d
mov rdx, r13
lea rsi, [0x180000000]
lea rax, [rcx + 0x7ffffbfe]
test rax, rax
je 0x1800065ac
movzx eax, byte [rdx + rsi + 0x31ec0]
test al, al
je 0x1800065ac
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x180006584
jmp 0x1800065b1
test rcx, rcx
jne 0x1800065bd
dec r8
mov r9d, 0x8007007a
dec rdx
mov eax, 0x400
mov byte [r8], r13b
lea rcx, [rsp + rdx + 0x70]
sub rax, rdx
test r9d, r9d
jns 0x1800065db
cmp r9d, 0x8007007a
jne 0x1800065e5
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.180005ce0
mov rcx, qword [rsp + 0x58]
mov r11, qword [rsp + 0x50]
test rcx, rcx
jne 0x180006608
test r11, r11
jne 0x18000664b
cmp r11, 0x7fffffff
ja 0x18000664b
test r11, r11
je 0x18000664b
mov rdx, r12
mov r8, r14
sub rdx, r11
sub r8, rcx
lea rax, [r11 + rdx]
test rax, rax
je 0x180006640
movzx eax, byte [rcx + r8]
test al, al
je 0x180006640
mov byte [rcx], al
inc rcx
dec r11
jne 0x180006622
jmp 0x180006645
test r11, r11
jne 0x180006648
dec rcx
mov byte [rcx], r13b
lea rdx, [rsp + 0x70]
mov rcx, r15
call fcn.180003960
mov byte [rsp + 0x70], r13b
call fcn.180003b10
mov rbx, rax
call fcn.180003a60
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], eax
lea rax, str.Version:_24.1.4.51782____u_Bit__Session:__u__Elevation:__s_r_n
mov qword [rsp + 0x30], 0x40
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x58]
lea rcx, [rsp + 0x70]
mov edx, 0x400
mov dword [rsp + 0x20], 0x100
call fcn.180004b40
lea rdx, [rsp + 0x70]
mov rcx, r15
call fcn.180003960
mov edi, 0x400
mov byte [rsp + 0x70], r13b
mov ecx, edi
lea rbx, [rsp + 0x70]
lea r8, [rsp + 0x70]
mov r9d, r13d
mov rdx, r13
lea rax, [rcx + 0x7ffffbfe]
test rax, rax
je 0x1800066fa
movzx eax, byte [rdx + rsi + 0x31e70]
test al, al
je 0x1800066fa
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x1800066d2
jmp 0x1800066ff
test rcx, rcx
jne 0x18000670b
dec r8
mov r9d, 0x8007007a
dec rdx
mov rax, rdi
mov byte [r8], r13b
lea rcx, [rsp + rdx + 0x70]
sub rax, rdx
test r9d, r9d
jns 0x180006727
cmp r9d, 0x8007007a
jne 0x18000672d
mov rbx, rcx
mov rdi, rax
lea r8, [rsp + 0x50]
mov rdx, rbx
mov ecx, 7
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
sub rdi, rcx
add rbx, rcx
jne 0x180006760
test rdi, rdi
jne 0x1800067e8
cmp rdi, 0x7fffffff
ja 0x1800067e8
mov rcx, rbx
mov rax, rdi
test rdi, rdi
jne 0x18000677b
test rbx, rbx
je 0x1800067e8
jmp 0x1800067e2
mov r9, r12
mov rcx, rdi
mov r8, rbx
sub r9, rdi
mov rdx, r13
nop word [rax + rax]
lea rax, [rcx + r9]
test rax, rax
je 0x1800067b5
movzx eax, byte [rdx + rsi + 0x31e60]
test al, al
je 0x1800067b5
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x180006790
jmp 0x1800067ba
test rcx, rcx
jne 0x1800067c6
dec r8
mov r13d, 0x8007007a
dec rdx
mov rax, rdi
mov byte [r8], 0
lea rcx, [rdx + rbx]
sub rax, rdx
test r13d, r13d
jns 0x1800067e2
cmp r13d, 0x8007007a
jne 0x1800067e8
mov rbx, rcx
mov rdi, rax
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov dword [rsp + 0x50], edi
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
sub rdi, rcx
add rbx, rcx
jne 0x180006812
test rdi, rdi
jne 0x180006858
cmp rdi, 0x7fffffff
ja 0x180006858
test rdi, rdi
je 0x180006858
mov rcx, r12
mov rdx, r14
sub rcx, rdi
sub rdx, rbx
nop dword [rax]
lea rax, [rdi + rcx]
test rax, rax
je 0x18000684d
movzx eax, byte [rbx + rdx]
test al, al
je 0x18000684d
mov byte [rbx], al
inc rbx
dec rdi
jne 0x180006830
jmp 0x180006852
test rdi, rdi
jne 0x180006855
dec rbx
mov byte [rbx], 0
lea rdx, [rsp + 0x70]
mov rcx, r15
call fcn.180003960
mov ecx, dword [rsp + 0x60]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x38], ecx
mov eax, ecx
and eax, 7
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x58]
mov rax, qword [rsi + rax*8 + 0x31ae0]
lea rcx, [rsp + 0x70]
mov edx, 0x400
mov qword [rsp + 0x30], rax
lea rax, str.LogLevel:__hs___i_
mov byte [rsp + 0x70], 0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
mov qword [rsp + 0x50], 0x400
call fcn.180004b40
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov r11, qword [rsp + 0x68]
movabs rax, 0xd6bf94d5e57a42bd
sub r11, qword [rsp + 0x60]
movabs r8, 0x8888888888888889
imul r11
lea rcx, [r11 + rdx]
sar rcx, 0x17
mov rax, rcx
shr rax, 0x3f
add rcx, rax
mov rax, r8
imul rcx
lea rbx, [rcx + rdx]
sar rbx, 5
mov rcx, rbx
shr rcx, 0x3f
add rbx, rcx
sets cl
test cl, cl
je 0x180006934
neg rbx
mov rax, r8
imul rbx
add rdx, rbx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov eax, edx
test cl, cl
je 0x180006953
neg eax
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x30], eax
imul edx, edx, 0x3c
lea rax, str.__Timezone:_UTC_i
sub ebx, edx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x58]
mov dword [rsp + 0x20], 0x100
call fcn.180004b40
test ebx, ebx
je 0x1800069be
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
lea rax, str.:_02i
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x58]
mov dword [rsp + 0x20], 0x100
call fcn.180004b40
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
test rcx, rcx
jne 0x1800069d2
test rdx, rdx
jne 0x180006a0f
cmp rdx, 0x7fffffff
ja 0x180006a0f
test rdx, rdx
je 0x180006a0f
sub r12, rdx
sub r14, rcx
lea rax, [rdx + r12]
test rax, rax
je 0x180006a04
movzx eax, byte [rcx + r14]
test al, al
je 0x180006a04
mov byte [rcx], al
inc rcx
dec rdx
jne 0x1800069e6
jmp 0x180006a09
test rdx, rdx
jne 0x180006a0c
dec rcx
mov byte [rcx], 0
lea rdx, [rsp + 0x70]
mov rcx, r15
call fcn.180003960
lea rdx, str.________________________________________________________________________________________________________________________________________________________________r_n
mov rcx, r15
call fcn.180003960
lea rdx, str.local_DateTime_____________PID___TID___Lvl_Type__ExitCode___Message_Sourcefile_Line_r_n
mov rcx, r15
call fcn.180003960
lea rdx, str._______r_n
mov rcx, r15
call fcn.180003960
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.180014930
mov rbx, qword [rsp + 0x4c8]
add rsp, 0x480
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret