Function at 0x140006978
Capabilities:
Accept command line arguments
Create process on windows
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x1a0
and qword [rsp + 0x60], 0
and dword [rsp + 0x68], 0
and dword [rsp + 0x6c], 0
mov rdi, rcx
mov rsi, rdx
lea rcx, [rsp + 0x60]
mov edx, 3
mov ebx, r8d
call fcn.140001114
and qword [rsp + 0x50], 0
and dword [rsp + 0x58], 0
and dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x50]
mov edx, 3
call fcn.140001114
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140006178
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0xe8]
mov dx, 0x22
add bx, 0x30
call fcn.140005da8
lea r8, [0x140021d28]
lea rcx, [rsp + 0xc8]
mov rdx, rax
call fcn.140005e0c
lea r8, str.sfxwaitall
lea rcx, [rsp + 0xb8]
mov rdx, rax
call fcn.140005e0c
lea rcx, [rsp + 0x118]
mov r8w, 0x3a
mov rdx, rax
call fcn.140005e78
lea rcx, [rsp + 0xd8]
movzx r8d, bx
mov rdx, rax
call fcn.140005e78
lea rcx, [rsp + 0xa8]
mov r8w, 0x20
mov rdx, rax
call fcn.140005e78
lea rcx, [rsp + 0x108]
mov r8w, 0x22
mov rdx, rax
call fcn.140005e78
lea rcx, [rsp + 0xf8]
mov r8, rdi
mov rdx, rax
call fcn.140005e0c
lea r8, [0x140021d04]
lea rcx, [rsp + 0x98]
mov rdx, rax
call fcn.140005e0c
lea rcx, [rsp + 0x88]
mov r8, rsi
mov rdx, rax
call fcn.140005e0c
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rbx, rax
je 0x140006b05
mov rcx, qword [rsp + 0x50]
and dword [rsp + 0x58], 0
and word [rcx], 0
mov edx, dword [rbx + 8]
lea rcx, [rsp + 0x50]
call fcn.140001114
mov rsi, qword [rsp + 0x50]
mov r11, qword [rbx]
mov rcx, rsi
movzx eax, word [r11]
add r11, 2
mov word [rcx], ax
add rcx, 2
test ax, ax
jne 0x140006aef
jmp 0x140006b0a
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x88]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x98]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xf8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x108]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xa8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xd8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x118]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xb8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xc8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0xe8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea rcx, [rsp + 0x130]
mov dword [rsp + 0x130], 0x68
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea r11, [rsp + 0x70]
lea rax, [rsp + 0x130]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov dword [rsp + 0x28], 0x1000004
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140006bfa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140006d26
xor edx, edx
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
test rax, rax
mov rdi, rax
je 0x140006cb0
mov rdx, qword [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x140006cb0
lea r8d, [rbx + 1]
xor r9d, r9d
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
mov rbx, rax
je 0x140006cb0
mov r9d, InitCommonControls
lea r8, [rsp + 0x88]
mov rcx, rdi
lea edx, [r9 - 9]
mov qword [rsp + 0x88], 1
mov qword [rsp + 0x90], rax
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140006c89
cmp dword [rsp + 0x1c0], 4
je 0x140006cc9
or dword [rsp + 0x20], 0xffffffff
lea r9, [rsp + 0x98]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x1c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
test eax, eax
jne 0x140006c7f
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x70]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x140006cf8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1c8], eax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140006d11
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x140006d1f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x1c8]
mov rcx, rsi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
lea r11, [rsp + 0x1a0]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret