Function at 0x140002b00
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x140050240]
xor rax, rsp
mov qword [rbp + 0x98], rax
mov qword [rbp - 0x38], rcx
xor r12d, r12d
mov byte [rbp - 0x7e], r12b
mov byte [rbp - 0x7f], r12b
mov r13d, 0x270f
mov r14b, r12b
mov byte [rbp - 0x80], r12b
mov qword [rbp - 8], r12
mov qword [rbp + 8], r12
mov qword [rbp + 0x10], 7
mov qword [rbp + 0x78], r12
movdqa xmm0, xmmword [0x140042580]
movdqu xmmword [rbp + 0x88], xmm0
mov dword [rbp - 0x30], r12d
lea rdx, [rbp - 0x30]
mov rcx, r8
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r15, rax
mov esi, r12d
mov ebx, dword [rbp - 0x30]
test ebx, ebx
jle 0x140002c0b
mov rdi, rax
mov r14d, r13d
lea rdx, str._remotedebug
mov rcx, qword [rdi]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x140002bad
mov byte [rbp - 0x7e], 1
jmp 0x140002bfd
lea rdx, str._wait
mov rcx, qword [rdi]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x140002bc6
mov byte [rbp - 0x7f], 1
jmp 0x140002bfd
lea rdx, str._remoteport
mov rcx, qword [rdi]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x140002bfd
lea eax, [rsi + 1]
cmp ebx, eax
jle 0x140002bf9
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
mov r13d, eax
dec eax
mov ebx, dword [rbp - 0x30]
cmp eax, 0xfffe
jbe 0x140002bfd
movzx r13d, r14w
inc esi
add rdi, 8
cmp esi, ebx
jl 0x140002b94
mov r14b, byte [rbp - 0x80]
test r15, r15
je 0x140002c51
mov qword [rbp - 0x78], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov r8d, 8
lea rdx, str._client
lea rcx, [rbp - 0x78]
call fcn.140003454
lea r9, [rbp + 0x78]
lea r8, [rbp - 0x78]
mov edx, dword [rbp - 0x30]
mov rcx, r15
call fcn.1400045a0
mov r14b, al
lea rcx, [rbp - 0x78]
call fcn.140003170
mov qword [rbp + 0x58], r12
movdqa xmm0, xmmword [0x140042580]
movdqu xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x38], r12
movdqu xmmword [rbp + 0x48], xmm0
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], 7
lea rcx, [rbp - 0x28]
call fcn.14000b2d8
mov ebx, eax
test r14b, r14b
jne 0x140002c9e
mov r14b, 1
lea rdx, str.Business1
lea rcx, [rbp + 0x78]
call fcn.1400031d4
test ebx, ebx
js 0x14000302f
test r14b, r14b
je 0x14000302f
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
mov rcx, qword [rbp - 0x18]
sub rax, rcx
cmp rax, 1
jb 0x140003098
lea r9, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r9, qword [rbp - 0x28]
mov qword [rsp + 0x30], 1
lea rsi, [0x140042578]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x28]
mov dl, byte [rbp - 0x80]
lea rcx, [rbp + 0x18]
call fcn.1400037f8
lea r8, str.Microsoft.SharePoint.dll
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x58]
call fcn.14000337c
mov rbx, rax
lea rax, [rbp + 0x58]
cmp rax, rbx
je 0x140002d66
lea rcx, [rbp + 0x58]
call fcn.140003170
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x58], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x68], xmm1
xor r14d, r14d
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
jmp 0x140002d69
xor r14d, r14d
lea rcx, [rbp - 0x58]
call fcn.140003170
lea rcx, [rbp + 0x18]
call fcn.140003170
mov rax, rdi
mov rcx, qword [rbp - 0x18]
sub rax, rcx
cmp rax, 1
jb 0x14000309e
lea r9, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r9, qword [rbp - 0x28]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x28]
mov dl, byte [rbp - 0x80]
lea rcx, [rbp + 0x18]
call fcn.1400037f8
lea r8, str.LoggingPlatform.dll
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x58]
call fcn.14000337c
mov rbx, rax
lea rax, [rbp + 0x38]
cmp rax, rbx
je 0x140002e08
lea rcx, [rbp + 0x38]
call fcn.140003170
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x48], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
lea rcx, [rbp - 0x58]
call fcn.140003170
lea rcx, [rbp + 0x18]
call fcn.140003170
lea rdx, [rbp + 0x78]
lea rcx, [rbp - 8]
call fcn.1400030a4
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 8
cmovae rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x140002fa0
lea rdx, str.InitLogging
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x140002fa0
mov dword [rbp - 0x2c], 3
mov qword [rbp - 0x58], r14
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov r8d, 0x14
lea rdx, str.OfficePrivacySetting
lea rcx, [rbp - 0x58]
call fcn.140003454
mov qword [rbp - 0x78], r14
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov r8d, 0x25
lea rdx, str.SoftwareMicrosoftOneDriveAccounts_
lea rcx, [rbp - 0x78]
call fcn.140003454
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x78]
mov rcx, 0xffffffff80000001
call fcn.14000d2c8
lea rcx, [rbp - 0x78]
call fcn.140003170
lea rcx, [rbp - 0x58]
call fcn.140003170
mov rcx, qword [rbp + 8]
sub rdi, rcx
cmp rdi, 9
jb 0x140003092
lea rax, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rax, qword [rbp - 8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.ListSync_
lea r8, [rbp - 8]
mov dl, byte [rbp - 0x80]
lea rcx, [rbp + 0x18]
call fcn.1400037f8
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 8
cmovae rcx, qword [rbp + 0x18]
mov byte [rsp + 0x68], 1
mov eax, dword [rbp - 0x2c]
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x58], rcx
mov dword [rsp + 0x50], 3
mov byte [rsp + 0x48], 1
mov byte [rsp + 0x40], 1
mov al, byte [rbp - 0x7f]
mov byte [rsp + 0x38], al
mov word [rsp + 0x30], r13w
mov al, byte [rbp - 0x7e]
mov byte [rsp + 0x28], al
mov dword [rsp + 0x20], 0x1e
mov r9d, 0x64
lea r8d, [r9 + 1]
lea rdx, str.Nucleus
lea rcx, str.MicrosoftNucleus_Trace_Session
mov rax, rsi
call qword [case.0x140031eec.0]
lea rcx, [rbp + 0x18]
call fcn.140003170
lea rcx, [rbp + 0x58]
cmp qword [rbp + 0x70], 8
cmovae rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x140002ff3
lea rdx, str.StartNucleusClient
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140002ff3
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rdx, qword [rbp - 8]
mov r9d, dword [rbp - 0x30]
mov r8, r15
mov rcx, qword [rbp - 0x38]
call qword [case.0x140031eec.0]
mov r12d, eax
test rbx, rbx
je 0x140003013
lea rdx, str.UninitLogging
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140003013
call qword [case.0x140031eec.0]
test rdi, rdi
je 0x140003021
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x14000302f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [rbp - 0x28]
call fcn.140003170
lea rcx, [rbp + 0x38]
call fcn.140003170
lea rcx, [rbp + 0x58]
call fcn.140003170
lea rcx, [rbp + 0x78]
call fcn.140003170
lea rcx, [rbp - 8]
call fcn.140003170
mov eax, r12d
mov rcx, qword [rbp + 0x98]
xor rcx, rsp
call fcn.140034370
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140002aec
int3
call fcn.140002aec
int3
call fcn.140002aec
int3