Function at 0x1400019d0
Capabilities:
Accept command line arguments
Connect pipe
Copy file
Create directory
Get disk information
Get token membership
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
xor edi, edi
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rdi + 8]
mov r8d, 0xff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140001a04
mov dword [rax], 0xe3
mov rbx, rax
cmp dword [rbx], 0x15e
jle 0x140001d7b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterClassW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CompareStringW]
call qword [sym.imp.KERNEL32.dll_GetOEMCP]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EncodePointer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMessageW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetTimer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_PeekMessageW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindow]
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov qword [rsp + 0x58], rdi
xor r9d, r9d
mov qword [rsp + 0x50], rdi
xor r8d, r8d
mov qword [rsp + 0x48], rdi
xor edx, edx
mov qword [rsp + 0x40], rdi
xor ecx, ecx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DefWindowProcW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_DeleteDC]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_DeleteObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetObjectW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x50], edi
xor r9d, r9d
mov dword [rsp + 0x48], edi
xor r8d, r8d
mov dword [rsp + 0x40], edi
xor edx, edx
mov dword [rsp + 0x38], edi
xor ecx, ecx
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.GDI32.dll_StretchBlt]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CLSIDFromProgID]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoCreateInstance]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov qword [rsp + 0x40], rdi
xor r9d, r9d
mov dword [rsp + 0x38], edi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
xor edx, edx
mov dword [rsp + 0x28], edi
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_StringFromGUID2]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoUninitialize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
retf
invalid
mov dword [rax - 0x6513e56e], eax
cld
sbb dword [rbp - 0x6f59c862], edi
clc
jrcxz 0x140004874
xchg dword [rsi - 0x7a], esi
in al, dx
mov dl, 0x6a
sbb al, 0x19
pop rcx
rcl ebx, 0x24
xchg byte [rdx + 0x19a3c874], dh
hlt
push 0x1c
sbb dword [rcx - 0x3f], ebx
shl dword [rsi + rax*4], cl
mov dl, 0x74
enter 0x19a3, 0xfffffffffffffff4
mov dr5, rdi
xchg ebx, eax
test byte [rax], cl
jg 0x1400048ba
invalid
jns 0x1400048df
mov ecx, 0xc1abde6f
fucompi st(6)
fisubr dword [rcx]
sub dword [rcx], ebp
xor byte [rdx - 0x77], al
add al, 0xd0
sar byte [rdi + 0x24e169d9], 1
sar byte [rdi + 0x24e169d9], 1
ficom dword [rdi - 0x1f616bd0]
pop rdx
xor byte [rcx], bl
or rcx, r14
lodsb al, byte [rsi]
ret
mov dh, byte [rcx - 0x35]
imul eax, ecx, 0xa6dd4754
movabs byte [0xd5e7a66b9a9409eb], al
popfq
invalid
frstor dword [rsi - 0x6bf6145e]
invalid
in eax, 0x1c
push rbx
pop rax
cli
xchg dword [0x1659e728f], edi
jrcxz 0x140004966
xchg ebx, eax
mov dl, 0x5a
not sil
mov ebp, ss
xor al, 0xa9
invalid
fnsave dword [rax + rcx - 0x41]
or bh, ch
add byte [rdx - 0xc9f5912], bl
int3
test eax, 0xa2d069f7
invalid
invalid
invalid
jo 0x1400049c1
invalid
or dword [rdx + 0x251980cd], 0x30
adc esp, esp
xchg esi, eax
stosd dword [rdi], eax
jmp 0x1ae971034
invalid
invalid
xchg esi, eax
outsb dx, byte [rsi]
jno 0x140004a18
cmpsd dword [rsi], dword [rdi]
or esp, dword [rsi - 0x2b]
cmc
out dx, eax
in eax, 0xca
insb byte [rdi], dx
invalid
pop rbx
invalid
invalid
jne str..kv0Eu
pushfq
xor al, 0xf9
and ah, byte [rdx]
push r12
mov bl, pe_nt_image_headers64
std
cmp dl, byte [rbx + 0x37457e0a]
or bh, byte [rsi + 0x45]
invalid
xlatb
sti
push 0x76638858
shl byte [rax - 0x77], cl
jge 0x140004a34
mov dword [rbp - 3], edi
invalid