Function at 0x1400026b4
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x228]
sub rsp, 0x300
mov rax, qword [0x14000f098]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
lea rax, [0x14000b164]
movsxd r15, ecx
mov rsi, rdx
xor ebx, ebx
mov edi, 0x106
mov byte [rsp + 0x30], bl
mov r8d, edi
lea rdx, [rbp - 0x20]
xor ecx, ecx
mov r14, rax
mov r12, rax
mov r13b, bl
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140002733
cmp eax, edi
je 0x140002733
lea rcx, [rbp - 0x20]
call fcn.14000463c
mov qword [0x1400158c0], rax
lea eax, [r15 - 2]
mov edi, 3
cmp eax, edi
ja 0x140002d72
mov rbx, qword [rsi + 8]
mov al, byte [rbx]
sub al, 0x2d
test al, 0xfd
jne 0x140002d70
inc rbx
lea rdx, str.NT60
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__stricmp]
lea rcx, [0x14000f038]
test eax, eax
je 0x1400027fc
lea rdx, [0x14000b314]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
je 0x1400027f5
lea rdx, str.NT52
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
je 0x1400027e0
lea rdx, [0x14000b320]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
je 0x1400027e0
lea rdx, str.HELP
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__stricmp]
xor ebx, ebx
test eax, eax
jne 0x140002d72
mov ecx, 0x1000
call fcn.140003208
mov edi, ebx
mov r15b, bl
jmp 0x140002d51
lea rax, str.NT52
mov qword [rsp + 0x40], rax
lea rax, [0x14000f060]
jmp 0x14000280b
lea rcx, [0x14000f038]
lea rax, str.NT60
mov qword [rsp + 0x40], rax
mov rax, rcx
xor ebx, ebx
mov qword [0x1400161b0], rax
cmp r15d, edi
jl 0x140002d72
mov rcx, qword [rsi + 0x10]
lea rdx, [0x14000b32c]
movzx r14d, bx
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x14000283f
lea r12, [0x14000b32c]
jmp 0x14000289c
mov rcx, qword [rsi + 0x10]
lea rdx, [0x14000b330]
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x140002860
lea ebx, [rax + 1]
lea r12, [0x14000b330]
jmp 0x14000289c
mov rax, qword [rsi + 0x10]
movzx ecx, byte [rax]
call qword [sym.imp.msvcrt.dll_isalpha]
test eax, eax
je 0x140002d72
mov rax, qword [rsi + 0x10]
cmp byte [rax + 1], 0x3a
jne 0x140002d72
cmp byte [rax + 2], bl
jne 0x140002d72
movsx r14d, byte [rax]
lea r12, str.Drive
mov ebx, 2
lea rax, [r15 - 4]
cmp rax, 1
ja 0x140002910
mov rcx, qword [rsi + rdi*8]
lea rdx, [0x14000b33c]
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
je 0x140002903
mov rcx, qword [rsi + rdi*8]
lea rdx, str._FORCE
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
je 0x140002903
mov rcx, qword [rsi + rdi*8]
lea rdx, [0x14000b34c]
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
je 0x1400028fe
mov rcx, qword [rsi + rdi*8]
lea rdx, str._MBR
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x140002d70
mov r13b, 1
jmp 0x140002908
mov byte [rsp + 0x30], 1
inc rdi
cmp rdi, r15
jl 0x1400028a6
lea rax, [0x1400161c0]
xor esi, esi
mov ecx, esi
mov qword [0x1400161c8], rax
mov qword [0x1400161c0], rax
lea rax, [0x14000f038]
cmp qword [0x1400161b0], rax
setne cl
add ecx, 0x100e
call fcn.140003208
mov ecx, 0x101d
call fcn.140003208
lea r15, [0x1400161d0]
mov qword [0x1400161d8], r15
mov qword [0x1400161d0], r15
call fcn.140001714
mov edi, eax
test eax, eax
jns 0x140002992
mov ecx, 0x1004
call fcn.140003208
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call fcn.140003280
mov r15b, byte [rsp + 0x30]
jmp 0x140002c77
lea rcx, str.__Global
mov r8, rcx
lea rdx, [0x140001800]
call fcn.140003ae4
mov edi, eax
test eax, eax
jns 0x1400029b5
mov ecx, 0x1010
jmp 0x140002974
lea eax, [rbx - 1]
cmp eax, 1
ja 0x1400029e0
xor r8d, r8d
lea rdx, [0x1400015a0]
lea rcx, str.Device
call fcn.140003ae4
mov edi, eax
test eax, eax
jns 0x1400029e0
mov ecx, 0x1005
jmp 0x140002974
test ebx, ebx
je 0x140002ade
sub ebx, 1
je 0x140002abc
cmp ebx, 1
jne 0x140002c3e
movzx eax, r14w
lea edx, [rbx + 0x60]
sub ax, dx
cmp ax, 0x19
jbe 0x140002a1a
movzx eax, r14w
lea edx, [rbx + 0x40]
sub ax, dx
cmp ax, 0x19
ja 0x140002a22
movzx ecx, r14w
sub ecx, edx
jmp 0x140002a25
or ecx, 0xffffffff
cmp ecx, 0xffffffff
jne 0x140002a3e
mov ecx, 0x1008
call fcn.140003208
mov edi, 0xc0000001
jmp 0x140002988
mov rax, qword [0x1400161d0]
mov edx, 1
shl edx, cl
mov rcx, rsi
cmp rax, r15
je 0x140002aa9
test rcx, rcx
jne 0x140002a63
test dword [rax + 0x10], edx
je 0x140002a63
mov rcx, rax
jmp 0x140002a66
mov dword [rax + 0x14], esi
mov rax, qword [rax]
cmp rax, r15
jne 0x140002a54
test rcx, rcx
je 0x140002aa9
cmp dword [rcx + 0x14], esi
jne 0x140002a95
mov r8, qword [rcx + 0x18]
test r8, r8
jne 0x140002a85
mov r8, qword [rcx + 0x20]
movzx edx, r14w
mov ecx, 0x100a
call fcn.140003208
jmp 0x140002a34
test r13b, r13b
je 0x140002c3e
mov rcx, qword [rcx + 0x20]
call fcn.14000119c
jmp 0x140002aca
movzx edx, r14w
mov ecx, 0x1009
call fcn.140003208
jmp 0x140002a34
test r13b, r13b
je 0x140002c3e
call fcn.140001640
mov edi, eax
test eax, eax
jns 0x140002c3e
mov ecx, 0x1082
jmp 0x140002974
lea r8, [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call fcn.140004f74
mov r14d, 0xc0000023
mov edi, eax
cmp eax, r14d
jne 0x140002b50
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, dword [rsp + 0x38]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
jne 0x140002b21
lea edi, [r14 + 0x77]
jmp 0x140002b59
mov edx, dword [rsp + 0x38]
lea r8, [rsp + 0x38]
mov rcx, rbx
call fcn.140004f74
mov edi, eax
test eax, eax
jns 0x140002b55
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x40]
test edi, edi
jns 0x140002b63
mov ecx, 0x1006
jmp 0x140002974
xor r8d, r8d
mov r9, rbx
or ecx, 0xffffffff
lea edx, [r8 + 1]
call fcn.140001320
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov edi, eax
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test edi, edi
jns 0x140002b9d
mov ecx, 0x1007
jmp 0x140002974
test r13b, r13b
je 0x140002c3e
lea r8, [rsp + 0x34]
xor edx, edx
xor ecx, ecx
call fcn.140004e74
mov edi, eax
cmp eax, r14d
jne 0x140002c13
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, dword [rsp + 0x34]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
jne 0x140002be4
mov edi, 0xc000009a
jmp 0x140002c1c
mov edx, dword [rsp + 0x34]
lea r8, [rsp + 0x34]
mov rcx, rbx
call fcn.140004e74
mov edi, eax
test eax, eax
jns 0x140002c18
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x40]
test edi, edi
jns 0x140002c26
mov ecx, 0x1080
jmp 0x140002974
mov rcx, rbx
call fcn.14000109c
mov edi, eax
test eax, eax
jns 0x140002c3e
mov ecx, 0x1081
jmp 0x140002974
mov r15b, byte [rsp + 0x30]
mov cl, r15b
call fcn.1400025f8
mov edi, eax
test eax, eax
js 0x140002c58
mov ecx, 0x100d
jmp 0x140002c64
cmp eax, 0x8000000d
jne 0x140002c6d
mov ecx, 0x100c
call fcn.140003208
mov edi, esi
jmp 0x140002c77
mov ecx, 0x100b
call fcn.140003208
mov rsi, qword [0x1400161d0]
lea r14, [0x1400161d0]
cmp rsi, r14
je 0x140002cdf
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rsi + 0x20]
mov rbx, qword [rsi]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rsi + 0x18]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rsi, rbx
cmp rbx, r14
jne 0x140002c8a
mov rsi, qword [0x1400161c0]
mov qword [0x1400161d8], r14
mov qword [0x1400161d0], r14
lea r14, [0x1400161c0]
cmp rsi, r14
je 0x140002d3c
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rsi + 0x10]
mov rbx, qword [rsi]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rsi, rbx
cmp rbx, r14
jne 0x140002d00
mov qword [0x1400161c8], r14
xor ebx, ebx
mov qword [0x1400161c0], r14
mov r14, qword [rsp + 0x40]
mov rcx, qword [0x1400158c0]
test rcx, rcx
je 0x140002d6a
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1400158c0], rbx
test edi, edi
jns 0x140002da6
jmp 0x140002da1
xor ebx, ebx
mov ecx, 0x1021
call fcn.140003208
mov rcx, qword [0x1400158c0]
test rcx, rcx
je 0x140002d95
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1400158c0], rbx
mov r15b, byte [rsp + 0x30]
lea r14, str.Usage
mov edi, 1
mov rax, qword [0x14000f008]
lea r9, [0x14000f020]
xorps xmm1, xmm1
lea r8, [section..data]
lea rdx, [0x140001010]
lea rcx, [rsp + 0x68]
movups xmm0, xmmword [rax - 0x10]
movdqu xmmword [0x14000f028], xmm1
movdqu xmmword [rsp + 0x68], xmm0
call qword [sym.imp.ADVAPI32.dll_EventRegister]
test eax, eax
jne 0x140002e5d
mov rbx, qword [0x14000f008]
lea r8, [rsp + 0x50]
lea rdx, str.api_ms_win_eventing_provider_l1_1_0
xor ecx, ecx
movzx esi, word [rbx]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
xor ecx, ecx
test eax, eax
jne 0x140002e20
lea r8, [rsp + 0x50]
lea rdx, str.advapi32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x140002e5b
mov rcx, qword [rsp + 0x50]
lea rdx, str.EventSetInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140002e50
mov rcx, qword [0x14000f020]
mov r8, rbx
movzx r9d, si
mov edx, 2
call qword [0x14000b0d8]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebx, ebx
mov r8d, 4
cmp dword [section..data], r8d
jbe 0x140002f96
movabs rdx, 0x200000000000
test qword [0x14000f010], rdx
je 0x140002f96
mov rax, qword [0x14000f018]
and rax, rdx
cmp rax, qword [0x14000f018]
jne 0x140002f96
movzx eax, r15b
or r9, 0xffffffffffffffff
mov dword [rsp + 0x48], eax
movzx eax, r13b
mov dword [rsp + 0x4c], eax
mov rax, r9
inc rax
cmp byte [r14 + rax], bl
jne 0x140002eb5
inc eax
mov qword [rbp - 0x60], r14
mov dword [rbp - 0x58], eax
mov rax, rbx
mov dword [rbp - 0x54], ebx
test r12, r12
je 0x140002ee3
mov rcx, r12
mov rax, r9
inc rax
cmp byte [r12 + rax], bl
jne 0x140002ed8
jmp 0x140002eea
lea rcx, [0x14000b164]
inc eax
mov qword [rbp - 0x50], rcx
mov dword [rbp - 0x48], eax
lea rax, [rsp + 0x48]
mov qword [rbp - 0x40], rax
lea rax, [rsp + 0x4c]
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x44], ebx
mov qword [rbp - 0x38], r8
mov qword [rbp - 0x28], r8
movzx eax, word [0x14000d67a]
lea rcx, str.ETW0
mov dword [rsp + 0x5c], eax
xor r9d, r9d
mov rax, qword [0x14000f008]
xor r8d, r8d
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x60], rdx
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x58], 0xb000000
movzx eax, word [rax]
mov dword [rbp - 0x78], eax
lea rax, [0x14000d684]
mov qword [rbp - 0x70], rax
lea rax, [0x14000d704]
sub eax, ecx
mov dword [rbp - 0x74], 2
mov rcx, qword [0x14000f020]
mov dword [rbp - 0x68], 0x37
mov dword [rbp - 0x64], 1
mov dword [rsp + 0x34], eax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
call qword [sym.imp.ADVAPI32.dll_EventWriteTransfer]
mov rcx, qword [0x14000f020]
call qword [sym.imp.ADVAPI32.dll_EventUnregister]
mov eax, edi
mov qword [0x14000f020], rbx
mov dword [section..data], ebx
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.140007520
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret