Function at 0x1000211cc
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
xor r13d, r13d
mov qword [0x100036150], rcx
mov ebp, r13d
mov r12d, r13d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [0x100036150]
mov rdx, rax
call fcn.10002266c
lea esi, [r13 + 1]
lea r14, [0x100003740]
cmp eax, r13d
mov ebx, eax
jge 0x100021227
lea r8, [0x100003718]
mov edx, 0x75a
jmp 0x10002124f
cmp eax, esi
je 0x10002126a
mov rcx, qword [0x100036228]
cmp rcx, r13
je 0x10002125c
call fcn.100024e04
cmp eax, r13d
mov ebx, eax
jge 0x100021259
lea r8, [0x100003758]
mov edx, 0x765
mov rcx, r14
call fcn.100026818
jmp 0x10002126a
mov r12d, esi
call fcn.10002015c
mov ebx, eax
call fcn.1000203f4
mov ebp, eax
lea rcx, [0x100036138]
xor r8d, r8d
mov edx, 0xd60000
call sub.ntdll.dll_WinSqmStartSession
mov r8, qword [0x1000361f0]
mov rdi, rax
cmp r8, r13
jne 0x100021299
mov r8, qword [0x100036220]
cmp r8, r13
je 0x1000212a6
mov edx, 0x10be
mov rcx, rax
call sub.ntdll.dll_WinSqmSetString
mov r8d, ebx
mov edx, 0x10bf
mov rcx, rdi
call sub.ntdll.dll_WinSqmSetDWORD
mov r8d, dword [0x1000361c4]
mov edx, 0x10bd
mov rcx, rdi
call sub.ntdll.dll_WinSqmSetDWORD
mov rcx, rdi
call sub.ntdll.dll_WinSqmEndSession
cmp dword [0x1000361b0], r13d
jne 0x100021647
cmp ebx, r13d
jne 0x100021422
mov rdi, qword [0x100036208]
cmp dword [0x1000361ac], r13d
je 0x100021397
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
or r8, 0xffffffffffffffff
mov qword [rsp + 0x40], rdi
mov r11, rax
xor eax, eax
mov rcx, r8
repne scasw ax, word [rdi]
mov rdi, r11
lea r9, [rsp + 0x40]
not rcx
mov dword [rsp + 0x4c], r13d
mov qword [rsp + 0x50], r11
sub rcx, rsi
mov dword [rsp + 0x5c], r13d
lea edx, [rcx + rcx + 2]
mov rcx, r8
mov r8d, 2
repne scasw ax, word [rdi]
mov dword [rsp + 0x48], edx
lea rdx, [0x100001738]
not rcx
sub rcx, rsi
lea eax, [rcx + rcx + 2]
mov rcx, qword [0x100036a00]
mov dword [rsp + 0x58], eax
call qword [sym.imp.ADVAPI32.dll_EventWrite]
mov rdi, qword [0x100036208]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [0x100003778]
mov edx, 0x783
mov r9, rdi
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.100026818
jmp 0x100021687
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
or r8, 0xffffffffffffffff
mov qword [rsp + 0x40], rdi
mov r11, rax
xor eax, eax
mov rcx, r8
repne scasw ax, word [rdi]
mov rdi, r11
lea r9, [rsp + 0x40]
not rcx
mov dword [rsp + 0x4c], r13d
mov qword [rsp + 0x50], r11
sub rcx, rsi
mov dword [rsp + 0x5c], r13d
lea edx, [rcx + rcx + 2]
mov rcx, r8
mov r8d, 2
repne scasw ax, word [rdi]
mov dword [rsp + 0x48], edx
lea rdx, [0x1000016e8]
not rcx
sub rcx, rsi
lea eax, [rcx + rcx + 2]
mov rcx, qword [0x100036a00]
mov dword [rsp + 0x58], eax
call qword [sym.imp.ADVAPI32.dll_EventWrite]
mov rdi, qword [0x100036208]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [0x1000037b0]
mov edx, 0x788
jmp 0x100021382
cmp ebx, esi
je 0x100021647
cmp ebx, 0x80242017
jne 0x1000214a4
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
or rcx, 0xffffffffffffffff
lea r9, [rsp + 0x40]
mov rdi, rax
mov qword [rsp + 0x40], rax
xor eax, eax
repne scasw ax, word [rdi]
lea rdx, [0x100001728]
mov r8d, esi
not rcx
mov dword [rsp + 0x4c], r13d
sub rcx, rsi
lea eax, [rcx + rcx + 2]
mov rcx, qword [0x100036a00]
mov dword [rsp + 0x48], eax
call qword [sym.imp.ADVAPI32.dll_EventWrite]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [0x1000037f0]
mov r9d, ebx
mov edx, 0x79c
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.100026818
call fcn.100027778
jmp 0x100021639
lea rdx, [rsp + 0x90]
mov ecx, ebx
mov qword [rsp + 0x90], r13
call fcn.100021e1c
mov rdi, qword [0x100036208]
cmp eax, r13d
jl 0x100021591
cmp dword [0x1000361ac], r13d
je 0x10002150d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rsi, qword [rsp + 0x90]
mov edx, ebx
mov r8, rsi
mov r9, rax
mov rcx, rdi
call fcn.100026a68
mov rdi, qword [0x100036208]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [0x100003860]
mov edx, 0x7aa
jmp 0x100021544
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rsi, qword [rsp + 0x90]
mov edx, ebx
mov r8, rsi
mov r9, rax
mov rcx, rdi
call fcn.10002692c
mov rdi, qword [0x100036208]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [0x1000038b0]
mov edx, 0x7af
mov qword [rsp + 0x30], rax
mov r9, rdi
mov rcx, r14
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ebx
call fcn.100026818
xor r9d, r9d
mov edx, 0xea60
mov qword [rsp + 0x28], rsi
lea ecx, [rdx + 2]
lea r8d, [r9 + 0x10]
mov dword [rsp + 0x20], ebx
call fcn.100021be0
cmp rsi, r13
je 0x100021639
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x100021639
cmp dword [0x1000361ac], r13d
je 0x1000215d2
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rsi, [0x100003ad8]
mov edx, ebx
mov r9, rax
mov r8, rsi
mov rcx, rdi
call fcn.100026a68
mov rdi, qword [0x100036208]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [0x1000038f8]
mov edx, 0x7b9
jmp 0x100021608
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rsi, [0x100003ad8]
mov edx, ebx
mov r9, rax
mov r8, rsi
mov rcx, rdi
call fcn.10002692c
mov rdi, qword [0x100036208]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [0x100003938]
mov edx, 0x7be
mov qword [rsp + 0x28], rax
mov r9, rdi
mov rcx, r14
mov dword [rsp + 0x20], ebx
call fcn.100026818
xor r9d, r9d
mov edx, 0xea60
lea r8d, [r9 + 0x10]
mov qword [rsp + 0x28], rsi
lea ecx, [rdx + 2]
mov dword [rsp + 0x20], ebx
call fcn.100021be0
cmp dword [0x1000361b8], r13d
je 0x100021647
call fcn.100020bdc
cmp ebx, r13d
jge 0x100021687
lea rdx, [rsp + 0x90]
mov ecx, ebx
mov qword [rsp + 0x90], r13
call fcn.100021e1c
mov rdx, qword [rsp + 0x90]
lea r8, [0x100001b60]
mov qword [rsp + 0x20], rdx
mov r9d, ebx
mov rcx, r14
mov edx, 0x7ce
call fcn.100026818
cmp r12d, r13d
je 0x100021691
call fcn.100024f20
lea rcx, [0x100036150]
call fcn.100022b70
mov edx, ebx
and edx, 0x1fff0000
cmp edx, 0x70000
jne 0x1000216b0
movzx ebx, bx
cmp ebp, r13d
lea r11, [rsp + 0x60]
cmove ebp, ebx
mov rbx, qword [r11 + 0x38]
mov eax, ebp
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret