Function at 0x140003f70
Capabilities:
Accept command line arguments
Check if file exists
Compare security identifiers
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0xc58]
sub rsp, 0xd40
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14006a080]
xor rax, rsp
mov qword [rbp + 0xc30], rax
movzx r14d, r8b
mov rdi, rdx
xor r15d, r15d
mov esi, r15d
mov dword [rbp - 0x58], r15d
movdqa xmm0, xmmword [0x14005f130]
movdqu xmmword [0x14006e6a0], xmm0
mov dword [0x14006e6b0], r15d
mov dword [0x14006e6b4], 2
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x810]
call fcn.1400220d0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3f0]
call fcn.1400220d0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
test rax, rax
je 0x1400040c3
lea rdx, str._logAnthorFile
mov rcx, rax
call fcn.1400213f0
mov rbx, rax
test rax, rax
je 0x1400040c3
lea rcx, str._logAnthorFile
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0xffffffff
mov r9d, ecx
cmp word [rbx], 0x20
jne 0x1400040c3
mov r8d, 1
movsxd r10, eax
cmp r10, r8
jle 0x1400040c3
mov edx, r8d
nop dword [rax]
cmp word [rbx + rdx*2], 0x20
jne 0x140004148
cmp ecx, r9d
je 0x14000414f
lea r9d, [r8 - 1]
cmp ecx, 0xffffffff
je 0x1400040c3
cmp r9d, 0xffffffff
jne 0x1400040a2
lea r9d, [rax - 1]
cmp r9d, ecx
jle 0x1400040c3
cmp r9d, 0xffffffff
je 0x1400040c3
sub r9d, ecx
inc r9d
movsxd r9, r9d
movsxd rax, ecx
lea r8, [rbx + rax*2]
mov edx, 0x104
lea rcx, [rbp + 0x3f0]
call fcn.14002a86c
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x30]
call fcn.1400220d0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x600]
call fcn.1400220d0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1e0]
call fcn.1400220d0
mov dword [rbp - 0x58], 0x104
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0xa20]
call qword [sym.imp.USERENV.dll_GetAllUsersProfileDirectoryW]
test eax, eax
jne 0x140004163
xor edx, edx
xor ecx, ecx
call fcn.140003ed0
mov rcx, rax
lea rdx, str.error_dont_read_slog_config
call fcn.140005b00
lea rdx, str.error_dont_read_log_config
lea rcx, [0x14006e6a0]
call fcn.140005810
jmp 0x140004245
cmp ecx, r9d
cmove ecx, r8d
inc r8d
inc rdx
cmp rdx, r10
jge 0x140004088
jmp 0x140004070
lea r9, [rbp + 0xa20]
mov edx, 0x104
lea rcx, [rbp - 0x30]
test rdi, rdi
je 0x140004186
mov qword [rsp + 0x20], rdi
lea r8, str._lsASUS_ls
jmp 0x140004199
lea rax, [0x14005bc10]
mov qword [rsp + 0x20], rax
lea r8, str._sASUS_s
call fcn.1400011b0
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400041b1
test al, 0x10
jne 0x1400041ba
lea rcx, [rbp - 0x30]
call fcn.140014be0
lea rcx, [rbp + 0x1e0]
call fcn.140014b30
lea rcx, [rbp + 0x3f0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x1400041eb
lea rdx, [rbp + 0x3f0]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r8, [rbp - 0x30]
lea rdx, str._s_asus.txt
lea rcx, [rbp + 0x600]
call fcn.140001d30
lea r8, [rbp - 0x30]
cmp dword [0x14006e6b0], r15d
je 0x14000422b
lea r9, [rbp + 0x810]
lea rdx, [rbp + 0x1e0]
lea rcx, [0x14006e6a0]
call fcn.1400047f0
jmp 0x140004245
lea r9, [rbp + 0x1e0]
lea rdx, str._s_s.log
lea rcx, [rbp + 0x810]
call fcn.140001d30
lea rcx, [rbp + 0x600]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140004369
test al, 0x10
jne 0x140004369
mov qword [rbp - 0x78], r15
mov dword [rbp - 0x58], r15d
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x600]
call fcn.1400013b0
mov rdx, qword [rbp - 0x78]
cmp dword [rbp - 0x58], r15d
jbe 0x14000435c
mov rcx, r15
lea r8, str.debug
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x1400042c3
cmp rcx, 6
jne 0x1400042a0
mov dword [0x14006e6b4], 1
jmp 0x14000435c
mov rcx, r15
lea r8, str.file
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x1400042f0
cmp rcx, 5
jne 0x1400042d0
mov dword [0x14006e6b4], 2
jmp 0x14000435c
mov rcx, r15
lea r8, [0x1400598ac]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140004320
cmp rcx, 4
jne 0x140004300
mov dword [0x14006e6b4], 3
jmp 0x14000435c
movzx ecx, byte [rdx]
movzx eax, byte [0x1400598b0]
sub ecx, eax
jne 0x14000434a
movzx ecx, byte [rdx + 1]
movzx eax, byte [0x1400598b1]
sub ecx, eax
jne 0x14000434a
movzx ecx, byte [rdx + 2]
movzx eax, byte [0x1400598b2]
sub ecx, eax
mov eax, dword [0x14006e6b4]
test ecx, ecx
cmove eax, r15d
mov dword [0x14006e6b4], eax
test rdx, rdx
je 0x140004369
mov rcx, rdx
call fcn.14001f574
test r14b, r14b
je 0x14000440d
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x68]
call fcn.140007380
nop
mov esi, 1
mov dword [rbp - 0x58], esi
lea rcx, [rsp + 0x68]
call fcn.140003a40
test al, al
je 0x14000440d
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.140007380
mov esi, 3
lea r8, [0x14006d848]
lea rdx, [0x140007cb0]
lea rcx, [0x14006d868]
call fcn.14001d7fc
test eax, eax
je 0x1400047d9
lea r8, [0x14006d848]
lea rdx, [0x140007cb0]
lea rcx, [0x14006d868]
call fcn.14001d7fc
test eax, eax
je 0x1400047df
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
lea rdx, [rbp - 0x58]
call fcn.14001d9d4
cmp eax, 2
jne 0x14000440d
mov bl, 1
jmp 0x14000440f
xor bl, bl
test sil, 2
je 0x14000446a
and esi, 0xfffffffd
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140004458
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004453
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400047e5
call fcn.14001f574
movdqa xmm0, xmmword [0x14005f110]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r15w
test sil, 1
je 0x1400044b1
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400044b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400044ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400047d3
call fcn.14001f574
test bl, bl
je 0x14000474e
mov ebx, r15d
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400045e9
test al, 0x10
je 0x1400045e9
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x60], r15
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x70]
mov edx, 1
mov r8d, edx
lea rcx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
jne 0x1400045e9
mov dword [rbp - 0x58], ebx
mov word [rbp - 0x54], 0x500
mov qword [rbp - 0x68], r15
lea rax, [rbp - 0x68]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14000457f
mov rdx, qword [rbp - 0x68]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov ebx, eax
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov qword [rbp - 0x78], r15
lea rax, [rbp - 0x78]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov dl, 1
lea rcx, [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1400045db
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
or ebx, eax
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
jne 0x1400045f2
lea rdx, [rbp - 0x30]
call fcn.1400051d0
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000474e
test al, 0x10
je 0x14000474e
mov qword [rbp - 0x68], r15
mov dword [rbp - 0x58], 0
mov word [rbp - 0x54], 0x100
lea rax, [rbp - 0x68]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14000474e
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_BuildTrusteeWithSidW]
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x78], r15
lea rax, [rbp - 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
lea rcx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
jne 0x140004744
mov ebx, r15d
mov rcx, qword [rbp - 0x70]
cmp r15w, word [rcx + 4]
jae 0x140004714
nop
mov qword [rbp - 0x60], r15
lea r8, [rbp - 0x60]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x140004706
mov rdx, qword [rbp - 0x60]
add rdx, 8
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x140004706
mov edx, ebx
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_DeleteAce]
inc ebx
mov rcx, qword [rbp - 0x70]
movzx eax, word [rcx + 4]
cmp ebx, eax
jl 0x1400046d0
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea edx, [r9 + 1]
mov r8d, 0x80000004
lea rcx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [0x14006e6b4]
add eax, 0xfffffffe
cmp eax, 1
ja 0x1400047a0
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 7]
lea rcx, [rbp + 0x810]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14006e6a0], rax
cmp rax, 0xffffffffffffffff
jne 0x1400047a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [0x14006e6a0]
mov rcx, qword [rbp + 0xc30]
xor rcx, rsp
call fcn.14001f550
lea r11, [rsp + 0xd40]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140028ec4
nop
call fcn.140029ca0
nop
call fcn.140029ca0
int3
call fcn.140028ec4
int3