Function at 0x1283ce90
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
sub rsp, 0x168
mov rax, qword [0x12a52ee0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov eax, dword [0x129adcc4]
mov dword [0x129abaf0], 1
cmp eax, 5
jne 0x1283cecc
lea rcx, [0x12a2b590]
call fcn.12885ac0
jmp 0x1283cef7
cmp eax, 9
jne 0x1283ceeb
lea rcx, [0x12a2b1d0]
call fcn.12885ac0
lea rcx, [0x12a2b3b0]
call fcn.12885ac0
jmp 0x1283cef7
lea rcx, [0x12a2b1d0]
call fcn.12885ac0
lea rdx, [rsp + 0x30]
lea rcx, [0x129bead0]
mov r8d, 0x80
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1283d918
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x178], rbp
call fcn.1295ab94
mov ebp, eax
test eax, eax
je 0x1283d910
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x160], rdi
mov qword [rsp + 0x158], r12
mov qword [rsp + 0x150], r13
lea rcx, str.NtClose
mov qword [rsp + 0x148], r14
mov qword [rsp + 0x140], r15
call fcn.12885ac0
lea rcx, str.NtDuplicateObject
call fcn.12885ac0
lea rcx, [0x12a2b950]
call fcn.12885ac0
lea rcx, [0x12a2b770]
call fcn.12885ac0
lea rcx, [0x12a2bb30]
call fcn.12885ac0
test eax, eax
je 0x1283cfbc
lea rcx, [0x12a2bd10]
call fcn.12885ac0
call fcn.12885bd0
test eax, eax
je 0x1283cfd1
lea rcx, [0x12a50610]
call fcn.12885ac0
bt ebp, 0x11
mov edi, 0x10
jae 0x1283cffb
lea rbx, [0x12a4e810]
mov rsi, rdi
mov rcx, rbx
call fcn.12885ac0
add rbx, 0x1e0
sub rsi, 1
jne 0x1283cfe6
test bpl, 2
je 0x1283d0cb
lea rcx, [0x12a28a70]
call fcn.12885ac0
lea rcx, [0x12a28e30]
call fcn.12885ac0
test eax, eax
jne 0x1283d02d
lea rcx, [0x12a28c50]
call fcn.12885ac0
lea rcx, [0x12a291f0]
call fcn.12885ac0
test eax, eax
jne 0x1283d049
lea rcx, [0x12a29010]
call fcn.12885ac0
lea rbx, [0x12a293d0]
mov rcx, rbx
call fcn.12885ac0
add rbx, 0x1e0
sub rdi, 1
jne 0x1283d050
lea rbx, [0x12a273f0]
mov edi, 0xc
mov rcx, rbx
call fcn.12885ac0
add rbx, 0x1e0
sub rdi, 1
jne 0x1283d071
mov rcx, qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
call fcn.12836c30
cmp qword [rax + 0x20], 8
jb 0x1283d09f
mov rcx, qword [rax + 8]
jmp 0x1283d0a3
lea rcx, [rax + 8]
lea rdx, str.services.exe
call fcn.1295a6e4
test eax, eax
jne 0x1283d0bf
lea rcx, str.WaitForMultipleObjectsEx
call fcn.12885ac0
lea rcx, str.AppHookKernelObject_Initialize_successed
call fcn.12805270
test bpl, 1
je 0x1283d0fa
lea rbx, [0x12a2cc10]
mov edi, 0x13
nop dword [rax]
mov rcx, rbx
call fcn.12885ac0
add rbx, 0x1e0
sub rdi, 1
jne 0x1283d0e0
call fcn.12821dc0
mov r12d, 9
test bpl, 0x10
je 0x1283d125
lea rbx, [0x12a2efb0]
mov rdi, r12
mov rcx, rbx
call fcn.12885ac0
add rbx, 0x1e0
sub rdi, 1
jne 0x1283d110
mov r13d, 8
lea rbx, [0x12a30090]
mov rdi, r13
mov rcx, rbx
call fcn.12885ac0
add rbx, 0x1e0
sub rdi, 1
jne 0x1283d135
bt ebp, 0xc
jae 0x1283d175
lea rbx, [0x12a33c90]
mov edi, 2
nop dword [rax]
mov rcx, rbx
call fcn.12885ac0
add rbx, 0x1e0
sub rdi, 1
jne 0x1283d160
bt ebp, 8
jae 0x1283d1b4
lea rbx, [0x12a30f90]
mov edi, 0x18
mov rcx, rbx
call fcn.12885ac0
add rbx, 0x1e0
sub rdi, 1
jne 0x1283d187
mov r8d, ebp
lea rcx, [0x129ad780]
xor edx, edx
not r8d
and r8d, 1
call fcn.12951ed0
bt ebp, 0xa
mov esi, 4
jae 0x1283d1e5
lea rbx, [0x12a34050]
mov rdi, rsi
nop dword [rax]
mov rcx, rbx
call fcn.12885ac0
add rbx, 0x1e0
sub rdi, 1
jne 0x1283d1d0
xor r15d, r15d
cmp byte [0x129adb84], r15b
jne 0x1283d229
lea r8, [0x129bf1e0]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov ecx, r15d
test rax, rax
setne cl
mov dword [0x129adb80], ecx
test rax, rax
je 0x1283d222
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x129adb84], 1
cmp dword [0x129adb80], r15d
jne 0x1283d2d5
test bpl, 0x40
je 0x1283d258
lea rbx, [0x12a39870]
mov rcx, rbx
call fcn.12885ac0
add rbx, 0x1e0
sub rsi, 1
jne 0x1283d243
bt ebp, 0xd
jae 0x1283d2d5
mov rcx, qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
call fcn.12836c30
cmp qword [rax + 0x20], r13
jb 0x1283d276
mov rcx, qword [rax + 8]
jmp 0x1283d27a
lea rcx, [rax + 8]
lea rdx, str.taskmgr.exe
call fcn.1295a6e4
test eax, eax
je 0x1283d2d5
mov eax, dword [0x129adcc4]
cmp eax, 7
je 0x1283d2a3
cmp eax, r13d
je 0x1283d2a3
mov dword [0x129abadc], r15d
jmp 0x1283d2ad
mov dword [0x129abadc], 1
lea rbx, [0x12a39ff0]
mov edi, 0x29
nop dword [rax]
mov rcx, rbx
call fcn.12885ac0
add rbx, 0x1e0
sub rdi, 1
jne 0x1283d2c0
cmp byte [0x129adb84], r15b
jne 0x1283d316
lea r8, [0x129bf1e0]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov ecx, r15d
test rax, rax
setne cl
mov dword [0x129adb80], ecx
test rax, rax
je 0x1283d30f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x129adb84], 1
cmp dword [0x129adb80], r15d
je 0x1283d35b
lea rcx, [0x12a4a670]
call fcn.12885ac0
lea rcx, [0x12a4a850]
call fcn.12885ac0
lea rcx, [0x12a4afd0]
call fcn.12885ac0
lea rcx, [0x12a4b1b0]
call fcn.12885ac0
lea rcx, [0x12a3eaf0]
call fcn.12885ac0
bt ebp, 0xe
jae 0x1283d43f
lea rbx, [0x12a347d0]
mov edi, 0xd
mov rcx, rbx
call fcn.12885ac0
add rbx, 0x1e0
sub rdi, 1
jne 0x1283d371
lea rcx, [0x12a36210]
call fcn.12885ac0
test eax, eax
jne 0x1283d3a2
lea rcx, [0x12a36030]
call fcn.12885ac0
lea rcx, [0x12a365d0]
call fcn.12885ac0
test eax, eax
jne 0x1283d3be
lea rcx, [0x12a363f0]
call fcn.12885ac0
mov dword [0x129abb90], r15d
lea rbx, [0x12a367b0]
mov edi, 0xf
mov rcx, rbx
call fcn.12885ac0
add rbx, 0x1e0
sub rdi, 1
jne 0x1283d3d1
lea rcx, [0x12a38970]
call fcn.12885ac0
test eax, eax
jne 0x1283d402
lea rcx, [0x12a38790]
call fcn.12885ac0
lea rcx, [0x12a38d30]
call fcn.12885ac0
test eax, eax
jne 0x1283d41e
lea rcx, [0x12a38b50]
call fcn.12885ac0
lea rcx, [0x12a390f0]
call fcn.12885ac0
test eax, eax
jne 0x1283d43a
lea rcx, [0x12a38f10]
call fcn.12885ac0
call fcn.12832a70
bt ebp, 0x12
mov esi, 5
jae 0x1283d469
lea rbx, [0x12a516f0]
mov rdi, rsi
mov rcx, rbx
call fcn.12885ac0
add rbx, 0x1e0
sub rdi, 1
jne 0x1283d454
lea rbx, [0x12a4a2b0]
mov edi, 2
mov rcx, rbx
call fcn.12885ac0
add rbx, 0x1e0
sub rdi, 1
jne 0x1283d475
lea rcx, [0x12a2bef0]
call fcn.12885ac0
lea rcx, [0x12a2c2b0]
call fcn.12885ac0
test eax, eax
jne 0x1283d4b2
lea rcx, [0x12a2c0d0]
call fcn.12885ac0
lea rcx, [0x12a2c850]
call fcn.12885ac0
test eax, eax
jne 0x1283d4ce
lea rcx, [0x12a2c490]
call fcn.12885ac0
lea rcx, [0x12a2ca30]
call fcn.12885ac0
test eax, eax
jne 0x1283d4ea
lea rcx, [0x12a2c670]
call fcn.12885ac0
lea rcx, [0x12a3ecd0]
call fcn.12885ac0
lea rcx, [0x12a3eeb0]
call fcn.12885ac0
lea rcx, [0x12a47f10]
call fcn.12885ac0
test eax, eax
jne 0x1283d51e
lea rcx, [0x12a47d30]
call fcn.12885ac0
bt ebp, 0xf
lea r14, str.NtSetDefaultHardErrorPort
jae 0x1283d5d4
cmp dword [0x129adcc4], r12d
jge 0x1283d55b
lea rbx, [0x12a3f090]
mov edi, 0x4b
mov rcx, rbx
call fcn.12885ac0
add rbx, 0x1e0
sub rdi, 1
jne 0x1283d544
jmp 0x1283d5af
mov rax, qword [0x129dc490]
lea rbx, [0x12a245c0]
lea rdi, [rbx + rax*8]
cmp rbx, rdi
je 0x1283d5a3
movsxd rcx, dword [rbx]
imul rcx, rcx, 0x1e0
add rcx, r14
call fcn.12885ac0
test eax, eax
jne 0x1283d59b
movsxd rcx, dword [rbx + 4]
imul rcx, rcx, 0x1e0
add rcx, r14
call fcn.12885ac0
add rbx, r13
cmp rbx, rdi
jne 0x1283d572
lea rcx, [0x12a47b50]
call fcn.12885ac0
cmp dword [0x12a477b0], r15d
jne 0x1283d5ca
cmp dword [0x12a43250], r15d
jne 0x1283d5ca
mov dword [0x129ae564], r15d
jmp 0x1283d5d4
mov dword [0x129ae564], 1
mov rcx, qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
call fcn.12836c30
cmp qword [rax + 0x20], r13
jb 0x1283d5ec
mov rcx, qword [rax + 8]
jmp 0x1283d5f0
lea rcx, [rax + 8]
lea rdx, str.svchost.exe
call fcn.1295a6e4
test eax, eax
jne 0x1283d660
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [rsp + 0x20], 3
mov rbx, rax
jl 0x1283d660
mov rcx, qword [rax + 8]
lea rdx, [0x129cab54]
mov r8d, 2
call fcn.1295a8a4
test eax, eax
jne 0x1283d660
mov rcx, qword [rbx + 0x10]
lea rdx, str.rpcss
mov r8, rsi
call fcn.1295a8a4
test eax, eax
jne 0x1283d660
lea rcx, str.NtQueryDirectoryObject
call fcn.12885ac0
lea rcx, str.NtQueryObject
call fcn.12885ac0
mov r15, qword [rsp + 0x140]
lea rbx, [0x12a480f0]
mov rdi, r12
nop
mov rcx, rbx
call fcn.12885ac0
add rbx, 0x1e0
sub rdi, 1
jne 0x1283d680
mov rdi, qword [rsp + 0x160]
lea rbx, [0x12a491d0]
mov rcx, rbx
call fcn.12885ac0
add rbx, 0x1e0
sub r12, 1
jne 0x1283d6a4
mov r12, qword [rsp + 0x158]
lea rbx, [0x12a4cbf0]
mov rcx, rbx
call fcn.12885ac0
add rbx, 0x1e0
sub rsi, 1
jne 0x1283d6c8
mov rcx, qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
call fcn.12836c30
mov rsi, qword [rsp + 0x180]
cmp qword [rax + 0x20], r13
jb 0x1283d6fd
mov rcx, qword [rax + 8]
jmp 0x1283d701
lea rcx, [rax + 8]
lea rdx, [0x129bfc10]
call fcn.1295a6e4
test eax, eax
je 0x1283d71d
lea rcx, str.CsrClientCallServer
call fcn.12885ac0
lea rcx, str.SE_IsShimDll
call fcn.12885ac0
lea rcx, str.SE_InstallBeforeInit
call fcn.12885ac0
lea rcx, str.SdbGetPermLayerKeys
call fcn.12885ac0
lea rcx, str.RtlCreateProcessParametersEx
call fcn.12885ac0
test eax, eax
jne 0x1283d76d
lea rcx, str.RtlCreateProcessParameters
call fcn.12885ac0
test eax, eax
je 0x1283d777
mov dword [0x129abb8c], 1
jmp 0x1283d777
mov dword [0x129abb8c], 1
mov rcx, qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
call fcn.12836c30
cmp qword [rax + 0x20], r13
jb 0x1283d78f
mov rcx, qword [rax + 8]
jmp 0x1283d793
lea rcx, [rax + 8]
lea rdx, [0x129bfc10]
call fcn.1295a6e4
test eax, eax
jne 0x1283d7db
mov rcx, r14
call fcn.12885ac0
lea rcx, str.NtRaiseHardError
call fcn.12885ac0
lea rcx, str.NtReadVirtualMemory
call fcn.12885ac0
lea rcx, str.NtFreeVirtualMemory
call fcn.12885ac0
lea rcx, str.NtMapViewOfSection
call fcn.12885ac0
lea rcx, str.NtSetInformationThread
call fcn.12885ac0
lea rcx, str.NtSetInformationProcess
call fcn.12885ac0
lea rcx, str.NtSetInformationToken
call fcn.12885ac0
lea rcx, str.NtWriteVirtualMemory
call fcn.12885ac0
lea rcx, [0x12a27210]
call fcn.12885ac0
mov r14, qword [rsp + 0x148]
test eax, eax
jne 0x1283d82f
lea rcx, [0x12a27030]
call fcn.12885ac0
lea rcx, str.RtlFreeHeap
call fcn.12885ac0
lea rcx, [0x12a4c830]
call fcn.12885ac0
lea rcx, [0x12a4ca10]
call fcn.12885ac0
lea rbx, [0x12a4d910]
nop word [rax + rax]
mov rcx, rbx
call fcn.12885ac0
add rbx, 0x1e0
sub r13, 1
jne 0x1283d860
lea rcx, [0x12a4d550]
call fcn.12885ac0
cmp byte [0x129ac44b], 0
mov r13, qword [rsp + 0x150]
mov rbx, qword [rsp + 0x170]
je 0x1283d8b2
lea rcx, [0x12a507f0]
call fcn.12885ac0
lea rcx, [0x12a509d0]
call fcn.12885ac0
lea rcx, [0x12a51150]
call fcn.12885ac0
test eax, eax
jne 0x1283d8ce
lea rcx, [0x12a50bb0]
call fcn.12885ac0
lea rcx, [0x12a51330]
call fcn.12885ac0
test eax, eax
jne 0x1283d8ea
lea rcx, [0x12a50d90]
call fcn.12885ac0
lea rcx, [0x12a51510]
call fcn.12885ac0
test eax, eax
jne 0x1283d906
lea rcx, [0x12a50f70]
call fcn.12885ac0
call fcn.128890e0
call fcn.128868f0
mov rbp, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.12959850
add rsp, 0x168
ret