Function at 0x140001d98
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov qword [rsp + 8], rdi
push rbp
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x140020208]
xor rax, rsp
mov qword [rbp + 0x210], rax
and qword [rsp + 0x68], 0
lea rcx, [rbp]
and dword [rsp + 0x60], 0
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
xor eax, eax
lea rcx, [rbp - 0x70]
xorps xmm0, xmm0
mov qword [rbp - 0x78], rax
xor edx, edx
movups xmmword [rsp + 0x78], xmm0
lea r8d, [rax + 0x68]
call sub.msvcrt.dll_memset
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
nop dword [rax + rax]
mov rcx, rax
lea rdx, [rsp + 0x64]
call qword [sym.imp.api_ms_win_shcore_obsolete_l1_1_0.dll_CommandLineToArgvW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140001e3e
lea r9, str.CommandLineToArgvW_failed
lea r8d, [rax + 0x47]
lea rdx, str.wWinMain
lea ecx, [rax + 1]
call fcn.14000c024
jmp 0x140002144
call fcn.14000297c
test al, al
je 0x140001e75
mov r8d, 0x4d
lea rax, [0x1400191b8]
mov qword [rsp + 0x20], rax
lea r9, str._hs_is_end_of_service._Exiting
lea ecx, [r8 - 0x4a]
lea rdx, str.wWinMain
call fcn.14000c024
jmp 0x140002144
mov ecx, 0x800
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SetDefaultDllDirectories]
nop dword [rax + rax]
test eax, eax
jne 0x140001ead
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r8d, 0x53
mov dword [rsp + 0x20], eax
lea r9, str.SetDefaultDllDirectories_failed___d_
lea ecx, [r8 - 0x52]
jmp 0x140001e64
mov eax, dword [rsp + 0x64]
lea r9, str.argc___d
mov r8d, 0x57
mov dword [rsp + 0x20], eax
lea rdx, str.wWinMain
lea ecx, [r8 - 0x54]
call fcn.14000c024
cmp dword [rsp + 0x64], 2
jne 0x140001f9d
mov rax, qword [rdi + 8]
lea r9, str.argv_1____ws
mov r8d, 0x5b
mov qword [rsp + 0x20], rax
lea rdx, str.wWinMain
lea ecx, [r8 - 0x58]
call fcn.14000c024
mov rcx, qword [rdi + 8]
lea rdx, str.UserCxt
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140001f2f
call qword [sym.imp.dcntel.dll_RunUserContextCensus]
nop dword [rax + rax]
jmp 0x14000210a
mov rcx, qword [rdi + 8]
lea rdx, str.SystemCxt
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140001f72
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0xfffffffe
call fcn.14000243c
call qword [sym.imp.dcntel.dll_RunSystemContextCensus]
nop dword [rax + rax]
call fcn.1400022cc
jmp 0x14000210a
mov rax, qword [rdi + 8]
lea r9, str.Bad_argument:___ws_
mov r8d, 0x71
mov qword [rsp + 0x20], rax
lea rdx, str.wWinMain
lea ecx, [r8 - 0x70]
call fcn.14000c024
jmp 0x14000210a
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0xfffffffe
call fcn.14000243c
call qword [sym.imp.dcntel.dll_RunSystemContextCensus]
nop dword [rax + rax]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.140002170
test eax, eax
js 0x1400020bb
cmp dword [rsp + 0x60], 0
je 0x1400020ec
mov r8d, 0x104
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
nop dword [rax + rax]
test eax, eax
je 0x1400020ec
lea r8, [0x14001924c]
mov edx, 0x104
lea rcx, [rbp]
call fcn.140001860
test eax, eax
js 0x1400020f1
lea r8, str.UserCxt
mov edx, 0x104
lea rcx, [rbp]
call fcn.140001860
test eax, eax
js 0x1400020f1
lea r9, str.Execute_in_user_context_after_having_executed_in_system_context
mov r8d, 0x8e
lea rdx, str.wWinMain
mov ecx, 3
call fcn.14000c024
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea r8, [rbp]
lea rax, [rbp - 0x70]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor edx, edx
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x8000000
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessAsUserW]
nop dword [rax + rax]
test eax, eax
je 0x1400020f1
mov rcx, qword [rsp + 0x78]
or edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
jmp 0x1400020ec
cmp dword [rsp + 0x60], 0
jne 0x1400020ec
lea r9, str.Execute_user_events_in_system_context_after_having_executed_system_events_in_system_context
mov r8d, 0xa0
lea rdx, str.wWinMain
mov ecx, 3
call fcn.14000c024
call qword [sym.imp.dcntel.dll_RunUserContextCensus]
nop dword [rax + rax]
call fcn.1400022cc
cmp qword [rsp + 0x68], 0
je 0x14000210a
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140002120
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140002135
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
xor eax, eax
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140015530
mov rdi, qword [rsp + 0x330]
add rsp, 0x320
pop rbp
ret