Function at 0x180002410
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
mov qword [rsp + 0x58], rdi
mov esi, r12d
mov ebx, r12d
mov r14, rcx
mov bpl, 1
test rsi, rsi
je 0x180002477
mov rdi, qword [rsi]
mov eax, dword [rsi + 8]
mov rcx, rdi
test rdi, rdi
je 0x180002455
test eax, eax
je 0x180002455
mov ecx, eax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rsi]
test rcx, rcx
je 0x180002463
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsi], r12
mov qword [rsi + 4], r12
mov rcx, rsi
mov qword [rsi + 8], r12
mov dword [rsi], r12d
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbx, rbx
je 0x1800024b9
mov rdi, qword [rbx]
mov eax, dword [rbx + 8]
mov rcx, rdi
test rdi, rdi
je 0x180002497
test eax, eax
je 0x180002497
mov ecx, eax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800024a5
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], r12
mov qword [rbx + 4], r12
mov rcx, rbx
mov qword [rbx + 8], r12
mov dword [rbx], r12d
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [r14 + 0x18]
mov rbx, r12
mov dword [r14 + 0x10], r12d
test rsi, rsi
je 0x1800024f6
mov rdi, qword [rsi]
mov eax, dword [rsi + 8]
mov rcx, rdi
test rdi, rdi
je 0x1800024e4
test eax, eax
je 0x1800024e4
mov ecx, eax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rsi]
test rcx, rcx
je 0x1800024f2
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsi], r12
mov dword [rsi + 8], r12d
mov rcx, qword [r14 + 0x20]
test rcx, rcx
je 0x180002509
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [r14 + 0x20], r12
mov qword [r14 + 0x20], r12
mov qword [r14 + 0x28], r12
mov qword [r14 + 0x30], r12
mov word [r14 + 0x38], r12w
test bpl, bpl
jne 0x18000252c
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18000252f
xor bpl, bpl
mov edx, 0x10
lea ecx, [rdx + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x1800026a9
mov rcx, qword [r14]
lea rdx, str.Delay
mov r8, rax
call fcn.180002300
test eax, eax
je 0x180002435
cmp dword [rsi + 8], 4
jne 0x180002435
mov rax, qword [rsi]
mov ecx, dword [rax]
mov dword [r14 + 0x10], ecx
mov rdi, qword [rsi]
mov eax, dword [rsi + 8]
mov rcx, rdi
test rdi, rdi
je 0x180002591
test eax, eax
je 0x180002591
mov ecx, eax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rsi]
test rcx, rcx
je 0x18000259f
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsi], r12
mov qword [rsi + 4], r12
mov rcx, rsi
mov qword [rsi + 8], rbx
mov dword [rsi], ebx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [r14 + 0x10]
mov rsi, r12
test eax, eax
je 0x180002435
cmp eax, 0xffffffff
je 0x180002435
mov r8, qword [r14 + 0x18]
lea rdx, [0x180003198]
mov rcx, qword [r14]
call fcn.180002300
test eax, eax
je 0x180002435
mov edx, 0x10
lea ecx, [rdx + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1800026a0
mov rcx, qword [r14]
lea rdx, str.Hosts
mov r8, rax
call fcn.180002300
test eax, eax
je 0x180002435
cmp dword [rbx + 8], r12d
je 0x180002435
mov rcx, qword [rbx]
lea rdx, [r14 + 0x28]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [r14 + 0x20], rax
mov rdi, qword [rbx]
mov eax, dword [rbx + 8]
mov rcx, rdi
test rdi, rdi
je 0x18000264f
test eax, eax
je 0x18000264f
mov ecx, eax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rbx]
test rcx, rcx
je 0x18000265d
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], r12
mov qword [rbx + 4], r12
mov rcx, rbx
mov qword [rbx + 8], r12
mov dword [rbx], r12d
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, r12
cmp qword [r14 + 0x20], r12
je 0x180002435
cmp dword [r14 + 0x28], 2
jb 0x180002435
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]