Function at 0x140006260
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, rcx
movzx ecx, word [rcx]
call qword [sym.imp.msvcrt.dll_iswspace]
xor r15d, r15d
jmp 0x140006291
add rdi, 2
movzx ecx, word [rdi]
call qword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
jne 0x140006284
mov rsi, rdi
cmp word [rdi], r15w
je 0x1400062b5
movzx ecx, word [rsi]
call qword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
jne 0x1400062b5
add rsi, 2
cmp word [rsi], r15w
jne 0x14000629e
movzx r14d, word [rsi]
mov word [rsi], r15w
test r14w, r14w
je 0x1400062e0
lea rbx, [rsi + 2]
jmp 0x1400062cd
add rbx, 2
movzx ecx, word [rbx]
call qword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
jne 0x1400062c9
cmp word [rbx], r15w
jne 0x1400062e3
mov rbx, r15
lea rdx, str..cls
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x140006301
call fcn.140002bc8
jmp 0x140006402
lea rdx, [0x140014128]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x140006371
mov rcx, qword [0x140026628]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileType]
cmp eax, 3
jne 0x14000633a
lea rdx, [0x140014b58]
lea rcx, str._s_is_running_under_remote.exe__s.__.hh_is_blocked_to_nprevent_remote_clients_from_starting_help_on_the_server_machine._nRun__start__dbgdir_debugger.chm__to_view_the_documentation._n
jmp 0x14000642b
test rbx, rbx
je 0x140006632
mov r8d, 6
lea rdx, str.dbgerr
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
mov rcx, rbx
test eax, eax
jne 0x140006365
lea edx, [rax + 1]
jmp 0x140006367
xor edx, edx
call fcn.14000d08c
jmp 0x140006402
lea rdx, str..idle_cmd
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x140006432
test rbx, rbx
je 0x140006409
movzx eax, word [rbx]
mov ecx, 0xfffd
sub ax, 0x2d
test cx, ax
jne 0x1400063d2
cmp word [rbx + 2], 0x64
jne 0x1400063d2
cmp dword [0x140021a08], 2
mov dword [0x140021a0c], r15d
jb 0x140006414
mov rax, qword [0x140021a00]
mov word [rax], r15w
mov eax, dword [0x140021a0c]
add eax, 2
mov dword [0x140021a0c], eax
jmp 0x14000640f
lea r9, [rsp + 0x50]
mov rdx, rbx
lea rcx, [0x140021a00]
call fcn.140003a30
mov rcx, qword [rsp + 0x50]
test eax, eax
cmovne rcx, r15
test rcx, rcx
jne 0x140006409
lea rcx, str.Out_of_memory_n
call fcn.140002b34
mov eax, 1
jmp 0x14000646f
mov eax, dword [0x140021a0c]
cmp eax, 4
jae 0x14000641d
lea rcx, str.No_idle_command_n
jmp 0x1400063fd
mov rdx, qword [0x140021a00]
lea rcx, str.Execute_when_idle:__s_n
call fcn.140002b34
jmp 0x140006402
lea rdx, str..remote
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x140006450
mov rcx, rbx
call fcn.140005c3c
jmp 0x140006402
lea rdx, str..server
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x140006483
call fcn.1400034e4
mov word [rsi], r14w
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
lea rdx, str..beep
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1400064b9
cmp dword [0x140028410], r15d
jne 0x140006402
mov edx, 0x12c
mov ecx, 0x2ee
call qword [sym.imp.api_ms_win_core_util_l1_1_0.dll_Beep]
jmp 0x140006402
mov eax, dword [0x140028410]
dec eax
cmp eax, 1
ja 0x140006519
mov r8d, 8
lea rdx, str..sympath
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x1400064fa
mov r8d, 8
lea rdx, str._sympath
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x140006519
lea r8, [0x140014b58]
lea rdx, [0x140014b58]
lea rcx, str.NOTE:_The_symbol_path_for_this__s_is_relative_to_where_n_s.exe_is_running__not_where_kd.exe_is_running._n
call fcn.140002b34
jmp 0x140006469
cmp word [rdi], 0x24
jne 0x140006594
cmp word [rdi + 2], 0x3c
jne 0x140006594
cmp dword [0x140026790], 0x20
mov word [rsi], r14w
jb 0x14000653f
lea rcx, str.Scripts_too_deeply_nested_n
jmp 0x1400063fd
lea rdx, [0x140011fa8]
lea rcx, [rdi + 4]
call qword [sym.imp.msvcrt.dll__wfopen]
mov r8, rax
test rax, rax
jne 0x140006568
lea rdx, [rdi + 4]
lea rcx, str.Unable_to_open__s_n
jmp 0x14000642b
mov edx, dword [0x140026790]
lea r9, [0x140026690]
mov rax, qword [0x1400267a0]
mov qword [0x1400267a0], r8
mov qword [r9 + rdx*8], rax
inc edx
mov dword [0x140026790], edx
jmp 0x140006402
lea rdx, str..remote_exit
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x140006615
cmp dword [0x140026794], r15d
jne 0x1400065bd
lea rcx, str.Not_a_remote_client_n
jmp 0x1400063fd
test rbx, rbx
je 0x1400065e6
mov rcx, qword [0x140026660]
mov r9d, 1
mov r8, rbx
mov rax, qword [rcx]
lea edx, [r9 + 1]
mov rax, qword [rax + 0x428]
call qword [0x140011380]
mov rcx, qword [0x140026638]
test rcx, rcx
je 0x140006607
mov rax, qword [rcx]
mov edx, 4
mov rax, qword [rax + 0xd0]
call qword [0x140011380]
call fcn.1400043c0
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]
lea rdx, str..wtitle
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x140006469
test rbx, rbx
jne 0x14000663c
call fcn.14000d030
jmp 0x140006402
mov rcx, rbx
call fcn.140002d30
jmp 0x140006402