Function at 0x1400010c0
Capabilities:
Accept command line arguments
Create process on windows
Resume thread
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r13
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x140011010]
xor rax, rsp
mov qword [rbp + 0xd8], rax
xor ebx, ebx
mov dword [rsp + 0x58], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r13, 0xffffffffffffffff
mov qword [rbp + 0x98], rbx
mov r8, r13
mov qword [rbp + 0xa8], rbx
mov qword [rbp + 0xb0], 7
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x140001120
mov rdx, rax
lea rcx, [rbp + 0x98]
call fcn.140003c00
cmp qword [rbp + 0xb0], 8
lea rcx, [rbp + 0x98]
lea rdx, [rsp + 0x58]
cmovae rcx, qword [rbp + 0x98]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
mov rsi, qword [rax + 8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi64]
lea rdx, [rbp + 0x20]
mov qword [rsp + 0x68], rbx
mov r15, rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x70], rax
lea rcx, [rsp + 0x68]
lea rax, [rbp - 0x70]
mov dword [rsp + 0x50], ebx
mov qword [rbp - 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rbp - 0x58], rax
lea rax, vtable.wistd::__function::__func_class__lambda_60224b657858a8d92fda711767ff594a___long_int____cdecl___wchar_t____ptr64__unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64__.0
movaps xmm0, xmmword [rbp - 0x60]
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x28]
mov qword [rbp + 0x90], rax
movups xmmword [rbp + 0x30], xmm0
call fcn.140001a10
test eax, eax
js 0x1400016f2
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14000170e
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0x102
je 0x1400016e0
test eax, eax
jne 0x140001720
mov qword [rsp + 0x210], r12
mov rbx, r13
mov qword [rsp + 0x218], r14
nop
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140001210
mov r8, qword [rbp + 0xb0]
lea r14, [rbp + 0x98]
mov rdx, qword [rbp + 0x98]
cmp r8, 8
mov r12, qword [rbp + 0xa8]
cmovae r14, rdx
cmp rbx, r12
ja 0x1400016c1
test rbx, rbx
jne 0x140001253
xor eax, eax
jmp 0x14000130b
movzx r11d, word [rsi]
mov rax, r12
sub rax, rbx
inc rax
lea r15, [r14 + rax*2]
mov rax, r14
nop word [rax + rax]
mov rcx, r15
mov edx, 0
sub rcx, rax
sar rcx, 1
je 0x14000129c
cmp word [rax], r11w
je 0x140001299
cmp rcx, 1
je 0x14000129c
add rax, 2
dec rcx
cmp word [rax], r11w
jne 0x140001286
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1400016c1
movzx edx, word [rdx]
mov r9, rbx
mov rcx, rsi
movzx r8d, r11w
cmp dx, r11w
jb 0x1400012e4
mov r10, rax
sub r10, rsi
cmp dx, r11w
ja 0x1400012e4
cmp r9, 1
je 0x1400012ea
movzx edx, word [rcx + r10 + 2]
add rcx, 2
dec r9
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x1400012c5
add rax, 2
jmp 0x140001270
sub rax, r14
sar rax, 1
cmp rax, r13
je 0x1400016c1
mov r15, qword [rbp - 0x68]
mov rdx, qword [rbp + 0x98]
mov r8, qword [rbp + 0xb0]
mov rcx, r13
nop
inc rcx
cmp word [rsi + rcx*2], 0
jne 0x140001310
add rcx, rax
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xd0], 7
cmp r12, rcx
jb 0x140001732
sub r12, rcx
lea rax, [rbp + 0x98]
cmp r12, r13
cmovb r13, r12
cmp r8, 8
mov r8, r13
cmovae rax, rdx
lea rdx, [rax + rcx*2]
lea rcx, [rbp + 0xb8]
call fcn.140003c00
cmp qword [rbp + 0xd0], 8
lea r9, [rbp + 0xb8]
mov rbx, qword [rsp + 0x68]
lea rdx, str.__s___s
cmovae r9, qword [rbp + 0xb8]
lea rcx, [rsp + 0x70]
mov r8, rbx
call fcn.1400017f0
xor r12d, r12d
lea r9, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x60], r12
xor ecx, ecx
lea edx, [r12 + 1]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x140001738
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140001757
mov rsi, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
je 0x140001769
lea r9, [rsp + 0x60]
xor r8d, r8d
lea edx, [r12 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x140001776
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x5c]
mov qword [rsp + 0x28], r12
xor edx, edx
mov r8d, 0x20012
mov qword [rsp + 0x20], 4
mov rcx, r14
mov dword [rsp + 0x5c], 4
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x140001788
xorps xmm0, xmm0
mov dword [rbp - 0x50], 0x70
xor eax, eax
mov dword [rsp + 0x50], r12d
xor edx, edx
mov qword [rbp + 0x14], rax
lea rcx, [rsp + 0x50]
mov dword [rbp + 0x1c], eax
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentPackageFullName]
mov esi, eax
cmp eax, 0x3d54
je 0x1400014a2
cmp eax, 0x7a
je 0x1400014a2
mov al, 1
jmp 0x1400014a4
xor eax, eax
test esi, esi
jg 0x1400014ad
mov r9d, esi
jmp 0x1400014b8
movzx r9d, si
or r9d, 0x80070000
mov rcx, qword [rbp + 0x108]
lea rdx, str.GetCurrentPackageFullName_rc_d
mov dword [rsp + 0x30], esi
lea r8, str.D:_a_work1_sdevcommonAppModel.Identity.h
mov qword [rsp + 0x28], rdx
mov edx, 0xf
mov byte [rsp + 0x20], al
call fcn.140002610
mov rax, qword [rbp + 0x18]
xorps xmm0, xmm0
mov rdx, qword [rsp + 0x70]
cmp esi, 0x7a
mov rcx, rbx
cmove rax, r14
xor r9d, r9d
mov qword [rbp + 0x18], rax
xor r8d, r8d
xor eax, eax
mov qword [rbp - 0x78], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80004
mov dword [rsp + 0x20], r12d
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000179a
mov ecx, dword [rbp - 0x78]
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140001572
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1400017ac
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140001589
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1400017be
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400015b6
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rdx, qword [rbp + 0xd0]
cmp rdx, 8
jb 0x1400015fc
mov rcx, qword [rbp + 0xb8]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400015f7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000167d
call fcn.140006ac0
mov qword [rbp + 0xc8], r12
mov qword [rbp + 0xd0], 7
mov word [rbp + 0xb8], r12w
test rbx, rbx
je 0x140001624
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rax, [r15 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001637
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rbp + 0xb0]
cmp rdx, 8
jb 0x140001689
mov rcx, qword [rbp + 0x98]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001684
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001684
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006ac0
mov r12, qword [rsp + 0x210]
xor eax, eax
mov r14, qword [rsp + 0x218]
mov rcx, qword [rbp + 0xd8]
xor rcx, rsp
call fcn.140006aa0
mov rbx, qword [rsp + 0x220]
add rsp, 0x1e0
pop r15
pop r13
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rbp + 0x108]
lea r8, str.D:_a_work1_sdevRestartAgentmain.cpp
mov r9d, 0x80070057
mov edx, 0x20
call fcn.1400026b0
int3
mov rcx, qword [rbp + 0x108]
mov edx, 0x1d
call fcn.140003a10
int3
mov rcx, qword [rbp + 0x108]
lea r8, str.D:_a_work1_spackagesMicrosoft.Windows.ImplementationLibrary.1.0.210930.1includewilwin32_helpers.h
mov r9d, eax
mov edx, 0x1bd
call fcn.1400026b0
int3
mov rcx, qword [rbp + 0x108]
mov edx, 0x1c
call fcn.140003a10
int3
mov rcx, qword [rbp + 0x108]
mov edx, 0xa2a
call fcn.1400029c0
int3
call fcn.1400017d0
int3
mov rcx, qword [rbp + 0x108]
lea r8, str.D:_a_work1_sdevRestartAgentmain.cpp
mov r9d, 0x8000ffff
mov edx, 0x27
call fcn.1400026b0
int3
mov rcx, qword [rbp + 0x108]
mov edx, 0x28
call fcn.140003a10
int3
mov rcx, qword [rbp + 0x108]
call fcn.140002280
int3
mov rcx, qword [rbp + 0x108]
mov edx, 0x2d
call fcn.140003a10
int3
mov rcx, qword [rbp + 0x108]
mov edx, 0x31
call fcn.140003a10
int3
mov rcx, qword [rbp + 0x108]
mov edx, 0x3e
call fcn.140003a10
int3
mov rcx, qword [rbp + 0x108]
mov edx, 0x937
call fcn.140002330
int3
mov rcx, qword [rbp + 0x108]
mov edx, 0x937
call fcn.140002330
int3