Function at 0x1400022d0
Capabilities:
Set current directory
Set environment variable
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
movzx ecx, word [rcx]
mov edx, 0xfffd
mov r14, r9
mov r15, r8
lea eax, [rcx - 0x2d]
test dx, ax
je 0x140002334
mov ebp, 1
test cx, cx
je 0x140002bfd
nop dword [rax]
movzx ecx, word [rbx]
call fcn.140009368
test eax, eax
je 0x14000232b
add rbx, 2
cmp word [rbx], 0
jne 0x140002310
jmp 0x140002bfd
xor edi, edi
mov ebp, edi
jmp 0x140002bfd
lea rdx, str.REALTIME
mov qword [rsp + 0x50], rsi
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebp, 1
test eax, eax
jne 0x14000235f
mov dword [r14], 0x100
jmp 0x140002bf8
lea rdx, str.HIGH
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140002380
mov dword [r14], 0x80
jmp 0x140002bf8
lea rdx, str.ABOVENORMAL
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400023a1
mov dword [r14], 0x8000
jmp 0x140002bf8
lea rdx, str.NORMAL
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400023c2
mov dword [r14], 0x20
jmp 0x140002bf8
lea rdx, str.BELOWNORMAL
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400023e3
mov dword [r14], 0x4000
jmp 0x140002bf8
lea rdx, str.IDLE
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140002404
mov dword [r14], 0x40
jmp 0x140002bf8
lea rdx, str.NOCONSOLE
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002bf1
lea rdx, str.NOWINDOW
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002bf1
lea rdx, str.HIDE
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002bf1
lea rdx, str.HIDDEN
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002bf1
lea rdx, str.WAITINPUT
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002bdc
lea rdx, str.WAITIDLE
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002bdc
lea rdx, [0x14001a738]
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002be9
lea rdx, str.MINIMIZED
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002be9
lea rdx, [0x14001a758]
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002be1
lea rdx, str.MAXIMIZED
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002be1
lea rdx, str.TEST
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000251b
or dword [rdi], 2
jmp 0x140002bf8
lea rdx, str.SILENT
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140002538
or dword [rdi], 4
jmp 0x140002bf8
lea rdx, str.WAIT
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140002555
or dword [rdi], 0x10
jmp 0x140002bf8
lea rdx, str.WAITINPUT
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002bdc
lea rdx, str.WAITIDLE
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002bdc
lea rdx, str.SHELL
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400025a4
or dword [rdi], 0x40
jmp 0x140002bf8
lea rdx, [0x14001a7b8]
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400025c4
or dword [rdi], 0x200
jmp 0x140002bf8
lea rdx, str.UAC2
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400025e4
or dword [rdi], 0x400
jmp 0x140002bf8
lea rdx, str.RUNAS
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002bd4
lea rdx, str.ELEVATE
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002bd4
lea rdx, str.ELEVATED
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002bd4
lea rdx, str.NONELEVATED
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002bcc
lea rdx, str.NOELEVATE
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002bcc
lea rdx, str.NOELEVATED
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002bcc
lea rdx, str.NOUAC
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000269a
or dword [rdi], 0x2000
jmp 0x140002bf8
lea rdx, str.UACTASK
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400026ba
or dword [rdi], 0x4000
jmp 0x140002bf8
lea rdx, str.REGTASK
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400026da
or dword [rdi], 0x8000
jmp 0x140002bf8
lea rdx, str.UNREGTASK
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400026fa
or dword [rdi], 0x10000
jmp 0x140002bf8
lea rdx, [0x14001a894]
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002bc7
lea rdx, str.NOQUOTES
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002bc7
lea rdx, [0x14001a8b4]
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002bc3
lea rdx, [0x14001a8b8]
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002bc3
lea rdx, [0x14001a8c4]
lea rcx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002bc3
lea rax, [0x14001a8c8]
mov dword [rsp + 0x28], 6
mov r9d, 6
mov qword [rsp + 0x20], rax
lea r8, [rbx + 2]
mov edx, ebp
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x1400027e2
movzx eax, word [rbx + 0xe]
add rbx, 0xe
xor edi, edi
cmp ax, 0x30
jb 0x1400027d6
cmp ax, 0x39
ja 0x1400027d6
movzx eax, ax
lea edi, [rdi + rdi*4]
add rbx, 2
lea edi, [rdi - 0x18]
lea edi, [rax + rdi*2]
movzx eax, word [rbx]
cmp ax, 0x30
jae 0x1400027b7
mov rax, qword [rsp + 0x70]
mov dword [rax], edi
jmp 0x140002bf8
lea rax, [0x14001a8d8]
mov dword [rsp + 0x28], 2
mov r9d, 2
mov qword [rsp + 0x20], rax
lea r8, [rbx + 2]
mov edx, ebp
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x140002851
cmp word [rbx + 6], 0x22
lea rax, [rbx + 6]
jne 0x14000283b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cdqe
cmp word [rbx + rax*2], 0x22
jne 0x140002837
xor edi, edi
mov word [rbx + rax*2], di
lea rax, [rbx + 8]
mov rcx, qword [rsp + 0x78]
mov qword [rcx], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x140002bf8
lea rax, str.MSG
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbx + 2]
mov edx, ebp
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x1400028b6
cmp word [rbx + 0xa], 0x22
lea rax, [rbx + 0xa]
jne 0x1400028aa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cdqe
cmp word [rbx + rax*2], 0x22
jne 0x1400028a6
xor edi, edi
mov word [rbx + rax*2], di
lea rax, [rbx + 0xc]
mov qword [0x140025d18], rax
jmp 0x140002bf8
lea rax, str.TITLE
mov dword [rsp + 0x28], 6
mov r9d, 6
mov qword [rsp + 0x20], rax
lea r8, [rbx + 2]
mov edx, ebp
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x14000291b
cmp word [rbx + 0xe], 0x22
lea rax, [rbx + 0xe]
jne 0x14000290f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cdqe
cmp word [rbx + rax*2], 0x22
jne 0x14000290b
xor edi, edi
mov word [rbx + rax*2], di
lea rax, [rbx + 0x10]
mov qword [0x140025d38], rax
jmp 0x140002bf8
lea rax, str.MSGTITLE
mov dword [rsp + 0x28], 9
mov r9d, 9
mov qword [rsp + 0x20], rax
lea r8, [rbx + 2]
mov edx, ebp
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x140002980
cmp word [rbx + 0x14], 0x22
lea rax, [rbx + 0x14]
jne 0x14000290f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cdqe
cmp word [rbx + rax*2], 0x22
jne 0x140002970
xor edi, edi
mov word [rbx + rax*2], di
lea rax, [rbx + 0x16]
mov qword [0x140025d38], rax
jmp 0x140002bf8
lea rax, str.ERR
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbx + 2]
mov edx, ebp
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x1400029e5
cmp word [rbx + 0xa], 0x22
lea rax, [rbx + 0xa]
jne 0x1400029d9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cdqe
cmp word [rbx + rax*2], 0x22
jne 0x1400029d5
xor edi, edi
mov word [rbx + rax*2], di
lea rax, [rbx + 0xc]
mov qword [0x140025d10], rax
jmp 0x140002bf8
lea rax, str.ERRMSG
mov dword [rsp + 0x28], 7
mov r9d, 7
mov qword [rsp + 0x20], rax
lea r8, [rbx + 2]
mov edx, ebp
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x140002a4a
cmp word [rbx + 0x10], 0x22
lea rax, [rbx + 0x10]
jne 0x1400029d9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cdqe
cmp word [rbx + rax*2], 0x22
jne 0x140002a3a
xor edi, edi
mov word [rbx + rax*2], di
lea rax, [rbx + 0x12]
mov qword [0x140025d10], rax
jmp 0x140002bf8
lea rax, str.ERRTITLE
mov dword [rsp + 0x28], 9
mov r9d, 9
mov qword [rsp + 0x20], rax
lea r8, [rbx + 2]
mov edx, ebp
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x140002aaf
cmp word [rbx + 0x14], 0x22
lea rax, [rbx + 0x14]
jne 0x140002aa3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cdqe
cmp word [rbx + rax*2], 0x22
jne 0x140002a9f
xor edi, edi
mov word [rbx + rax*2], di
lea rax, [rbx + 0x16]
mov qword [0x140025d08], rax
jmp 0x140002bf8
lea rax, str.ENV
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbx + 2]
mov edx, ebp
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x140002b34
lea rsi, [rbx + 0xa]
xor edi, edi
cmp word [rsi], 0x22
jne 0x140002b07
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cdqe
cmp word [rbx + rax*2], 0x22
jne 0x140002b03
mov word [rbx + rax*2], di
add rsi, 2
cmp word [rsi], 0x3d
mov rdx, rsi
je 0x140002b1f
cmp word [rdx], di
je 0x140002b1f
add rdx, 2
cmp word [rdx], 0x3d
jne 0x140002b10
mov word [rdx], di
mov rcx, rsi
add rdx, 2
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x140002bf8
lea rax, str.REGNAME
mov dword [rsp + 0x28], 8
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rbx + 2]
mov edx, ebp
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x140002bf8
lea rax, str.REGCODE
mov dword [rsp + 0x28], 8
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rbx + 2]
mov edx, ebp
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x140002bf8
test byte [rdi], 4
jne 0x140002bf8
mov r9d, dword [0x140025d20]
lea r8, str.Unknown_parameter___Hstart
or r9d, 0x10
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_ExitProcess]
or dword [rdi], ebp
jmp 0x140002bf8
or dword [rdi], 8
jmp 0x140002bf8
or dword [rdi], 0x1000
jmp 0x140002bf8
or dword [rdi], 0x100
jmp 0x140002bf8
or dword [rdi], 0x20
jmp 0x140002bf8
or dword [rdi], 0x200000
jmp 0x140002bf8
or dword [rdi], 0x100000
jmp 0x140002bf8
or dword [r15], 0x8000000
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov eax, ebp
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret