Function at 0x140008570
Capabilities:
Accept command line arguments
Lock the desktop

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r13
push r14
push r15
mov eax, 0x2030
call fcn.14003c010
sub rsp, rax
mov rax, qword [0x140084060]
xor rax, rsp
mov qword [rsp + 0x2028], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r13, rax
mov edx, dword [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.140008490
nop
mov r8d, dword [rsp + 0x50]
xor edi, edi
cmp r8d, 1
jg 0x14000866b
lea rax, [0x140078eb8]
mov qword [rsp + 0x88], rax
lea rax, [0x14000ecb0]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], rdi
lea rcx, [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x1400088f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140008664
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000865f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008bcb
call fcn.14003ba0c
mov eax, ebx
jmp 0x140008938
mov rdx, qword [r13 + 8]
mov rcx, rdi
lea r9, str.logon
nop dword [rax]
movzx eax, word [r9 + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x140008802
cmp rcx, 6
jne 0x140008680
cmp r8d, 3
jl 0x1400087bd
mov r15, qword [r13 + 0x10]
mov rsi, 0xffffffffffffffff
nop
inc rsi
cmp word [r15 + rsi*2], di
jne 0x1400086b0
add rsi, rsi
cmp rsi, 0x1f40
ja 0x1400087bd
mov esi, edi
movzx eax, word [r15]
test ax, ax
je 0x140008714
mov r14, rdi
lea rbx, [rsp + 0xb8]
mov dword [rbx - 8], 1
mov word [rbx], di
mov qword [rbx + 4], 4
mov word [rbx + 2], ax
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov qword [rbx + 0x10], rax
inc esi
lea r14, [r14 + 1]
lea rbx, [rbx + 0x28]
movzx eax, word [r15 + r14*2]
test ax, ax
jne 0x1400086e0
movsxd rax, esi
lea rcx, [rax + rax*4]
lea rbx, [rcx*8]
mov dword [rsp + rbx + 0xb0], 1
mov qword [rsp + rbx + 0xb8], select
mov dword [rsp + rbx + 0xc0], edi
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov qword [rsp + rbx + 0xc8], rax
inc esi
movsxd rax, esi
lea rcx, [rax + rax*4]
lea rbx, [rcx*8]
mov dword [rsp + rbx + 0xb0], 1
mov dword [rsp + rbx + 0xb8], select
mov qword [rsp + rbx + 0xbc], 2
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov qword [rsp + rbx + 0xc8], rax
inc esi
test esi, esi
jle 0x1400087bd
lea rbx, [rsp + 0xb0]
mov edi, esi
mov r8d, 0x28
mov rdx, rbx
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
add rbx, 0x28
sub rdi, 1
jne 0x1400087a0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140008936
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008931
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008bcb
jmp 0x140008931
lea r9, str.userproc
mov rsi, 0xffffffffffffffff
mov rcx, rsi
movzx eax, word [r9 + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x140008839
add rcx, 2
cmp rcx, 9
je 0x1400088f3
movzx eax, word [r9 + rcx*2]
cmp ax, word [rdx + rcx*2]
je 0x140008813
lea r9, str.logonuser
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r9 + rcx*2]
cmp ax, word [rdx + rcx*2]
jne 0x140008966
movzx eax, word [r9 + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x140008966
add rcx, 2
cmp rcx, 0xa
jne 0x140008850
mov dword [rsp + 0xb0], 1
mov qword [rsp + 0xb8], select
mov dword [rsp + 0xc0], edi
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov qword [rsp + 0xc8], rax
mov dword [rsp + 0xd8], 1
mov dword [rsp + 0xe0], select
mov qword [rsp + 0xe4], 2
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov qword [rsp + 0xf0], rax
mov r8d, 0x28
lea rdx, [rsp + 0xb0]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
jmp 0x1400087bd
call fcn.140011750
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140008936
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008931
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008bcb
call fcn.14003ba0c
xor eax, eax
mov rcx, qword [rsp + 0x2028]
xor rcx, rsp
call fcn.14003b9b0
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov rcx, rdi
lea r9, str.lock
movzx eax, word [r9 + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x140008990
cmp rcx, 5
jne 0x140008970
call qword [sym.imp.USER32.dll_LockWorkStation]
jmp 0x1400087bd
mov rcx, rdi
lea r9, str.screen
nop word [rax + rax]
movzx eax, word [r9 + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x1400087bd
cmp rcx, 7
jne 0x1400089a0
cmp r8d, 4
jl 0x1400087bd
mov rdx, qword [r13 + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rcx
mov word [rsp + 0x30], di
mov r8, rsi
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400089e0
lea rcx, [rsp + 0x30]
call fcn.1400023b0
nop
call fcn.140041ebc
mov r14, rax
lea rbx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rbx, qword [rsp + 0x30]
mov dword [rax], edi
mov r8d, 0xa
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140042b64
mov r15d, eax
cmp rbx, qword [rsp + 0x58]
je 0x140008bd1
cmp dword [r14], 0x22
je 0x140008be4
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140008a7f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008a79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008bde
call fcn.14003ba0c
nop
call fcn.140007b90
test eax, eax
jne 0x140008acc
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140008ac5
inc rdx
mov rcx, qword [rsp + 0x60]
mov r8, rcx
cmp rdx, 0x1000
jb 0x140008ac0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x140008bf1
call fcn.14003ba0c
mov eax, esi
jmp 0x140008938
mov qword [rsp + 0x80], rdi
mov r9, qword [r13 + 0x10]
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp word [r9 + rax*2], 0
jne 0x140008ae0
mov qword [rsp + 0x20], rax
mov r8d, 0x32
lea rdx, [rsp + 0x1ff0]
lea rcx, [rsp + 0x80]
call fcn.140043f80
movzx edx, r15w
lea rcx, [rsp + 0x1ff0]
call fcn.140007d40
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140008b76
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140008b6c
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008b67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008bf1
call fcn.14003ba0c
mov eax, 0xfffffffd
jmp 0x140008938
call fcn.14000f310
mov rcx, rbx
call fcn.14000be00
jmp 0x1400087bd
call fcn.140042fc0
nop
lea rcx, str.invalid_stoi_argument
call fcn.140012f64
nop
call fcn.140042fc0
nop
lea rcx, str.stoi_argument_out_of_range
call fcn.140012fac
nop
call fcn.140042fc0
int3