Function at 0x140001000
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x10020
call fcn.140002570
sub rsp, rax
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_FreeConsole]
call fcn.140001900
mov dword [rsp + 0x10070], r14d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x10070]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r12, rax
call fcn.140001a90
mov ebp, dword [rsp + 0x10070]
lea esi, [r14 + 8]
mov r15d, eax
mov ebx, r14d
test ebp, ebp
jle 0x1400010cc
mov qword [rsp + 0x10060], r13
mov rdi, r12
lea r13, str.SOMECMD
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rdi]
mov rcx, r14
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r13 + rcx*2 - 2]
jne 0x1400010bb
cmp rcx, rsi
jne 0x140001090
lea eax, [rbx + 1]
cmp ebp, eax
jle 0x1400010bb
mov rcx, qword [rdi + 8]
call fcn.1400046e4
mov ebp, dword [rsp + 0x10070]
inc ebx
add rdi, rsi
cmp ebx, ebp
jl 0x140001080
mov r13, qword [rsp + 0x10060]
mov r8d, r14d
test ebp, ebp
jle 0x140001154
mov r9, r12
lea r10, str.GISMWIV
mov rdx, qword [r9]
mov rcx, r14
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r10 + rcx*2 - 2]
jne 0x140001149
cmp rcx, rsi
jne 0x1400010f0
call fcn.1400020b0
cmp eax, 1
je 0x140001125
nop
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400020b0
cmp eax, 1
jne 0x140001110
test r15d, r15d
je 0x1400011a2
mov ebx, 0x10
nop
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
sub rbx, 1
jne 0x140001130
lea eax, [rbx - 1]
jmp 0x14000156f
inc r8d
add r9, rsi
cmp r8d, ebp
jl 0x1400010e1
lea eax, [rbp - 1]
mov ebx, 1
cmp eax, ebx
ja 0x14000122c
cmp ebp, 2
lea r8, str.ISMWIV
mov rax, r14
mov rcx, r14
cmove rax, rbx
mov rdx, qword [r12 + rax*8]
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x1400011ac
cmp rcx, 7
jne 0x140001180
call fcn.1400020b0
cmp eax, ebx
jne 0x1400014e3
mov eax, 0xffffffff
jmp 0x14000156f
mov rcx, r14
lea r8, str.CMWIV
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x1400011f1
cmp rcx, 6
jne 0x1400011c0
call fcn.1400020b0
cmp eax, ebx
jne 0x1400014e3
call fcn.140002230
mov eax, 0xffffffff
jmp 0x14000156f
mov rcx, r14
lea r8, str.CMPW
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14000122c
cmp rcx, 5
jne 0x140001200
call fcn.140002230
cmp eax, ebx
je 0x1400014e3
mov eax, 0xfffffffe
jmp 0x14000156f
cmp ebp, ebx
jle 0x1400013c7
mov rdx, qword [r12]
lea r8, str.CKFEWPELP
mov rcx, r14
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
jne 0x140001266
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x140001266
add rcx, 2
cmp rcx, 0xa
jne 0x140001242
jmp 0x14000129a
mov rdx, qword [r12 + 8]
mov rcx, r14
nop
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
jne 0x1400013c7
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x1400013c7
add rcx, 2
cmp rcx, 0xa
jne 0x140001270
mov rdx, qword [r12 + 8]
mov rcx, r14
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
jne 0x1400012c6
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x1400012c6
add rcx, 2
cmp rcx, 0xa
jne 0x1400012a2
jmp 0x1400012cc
sbb r14d, r14d
or r14d, ebx
neg r14d
lea rcx, [rsp + 0x20]
mov r8d, 0x10000
sbb ebx, ebx
xor edx, edx
add ebx, 2
call fcn.140003080
lea rcx, [rsp + 0x20]
sub rcx, 2
nop
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1400012f0
lea rdi, str.MpCmdRun.exe
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rdi + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140001310
lea rcx, [rsp + 0x20]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140001330
mov eax, dword [0x14000e45c]
mov dword [rcx], eax
cmp ebx, ebp
jge 0x1400013a6
sub ebp, ebx
lea r10, [r12 + rbx*8]
mov r11d, ebp
lea rdx, [rsp + 0x20]
sub rdx, 2
nop dword [rax]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140001360
mov r9, qword [r10]
xor r8d, r8d
movzx ecx, word [r9 + r8*2]
mov word [rdx + r8*2], cx
lea r8, [r8 + 1]
test cx, cx
jne 0x140001371
lea rdx, [rsp + 0x20]
sub rdx, 2
nop dword [rax]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140001390
add r10, rsi
mov dword [rdx], eax
sub r11, 1
jne 0x140001350
call fcn.140001cb0
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140001f60
mov ebx, eax
call fcn.140001c00
jmp 0x14000156d
mov dword [rsp + 0x10078], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x10078]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x140001414
cmp dword [rsp + 0x10078], r14d
je 0x140001414
mov edx, 0x410
lea rcx, [0x140019180]
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x140001434
mov eax, 0xfe
jmp 0x14000156f
mov edx, 0x410
lea rcx, [0x140019180]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140001434
mov eax, 0xff
jmp 0x14000156f
lea rcx, [0x140019180]
sub rcx, 2
nop
cmp word [rcx + 2], r14w
lea rcx, [rcx + 2]
jne 0x140001440
mov eax, dword [0x14000e460]
mov dword [rcx], eax
lea rcx, [0x140019180]
sub rcx, 2
nop
cmp word [rcx + 2], r14w
lea rcx, [rcx + 2]
jne 0x140001460
mov r8, qword [section..data]
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140001480
test r12, r12
jne 0x1400014a1
lea eax, [r12 + 3]
jmp 0x14000156f
mov eax, dword [rsp + 0x10070]
cmp eax, ebx
je 0x1400014bb
cmp eax, 2
je 0x1400014be
mov ebx, 3
jmp 0x140001564
mov rsi, r14
mov rcx, qword [rsi + r12]
call fcn.1400046e4
mov edi, eax
test eax, eax
je 0x140001564
mov rdx, qword [section..data]
mov ecx, eax
call fcn.140001750
cmp eax, ebx
jne 0x1400014ea
xor eax, eax
jmp 0x14000156f
lea rdx, [0x140019180]
mov ecx, edi
call fcn.140001710
mov esi, eax
cmp eax, 2
jne 0x14000150a
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [section..data]
mov ecx, edi
mov ebx, 0x40
call fcn.140001750
cmp eax, 1
je 0x140001556
test ebx, ebx
je 0x140001556
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140019180]
mov ecx, edi
call fcn.140001710
mov rdx, qword [section..data]
mov ecx, edi
mov esi, eax
dec ebx
call fcn.140001750
cmp eax, 1
jne 0x140001522
test esi, esi
mov eax, 2
cmovne r14d, eax
mov ebx, r14d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
add rsp, 0x10020
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret