Function at 0x140001d28
Capabilities:
Accept command line arguments
Execute command
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x820]
sub rsp, 0x920
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
and dword [rbp + 0x830], 0
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rbp + 0x830]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea rcx, [0x140001020]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov edx, 0xa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140001070]
call fcn.140001cbc
lea rcx, [0x1400010c0]
call fcn.140001cbc
mov edx, 0xb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140001148]
call fcn.140001cbc
mov edx, 9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140001160]
call fcn.140001cbc
mov edx, 0xf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
cmp dword [rbp + 0x830], 3
jge 0x140001ecc
lea rcx, [0x1400011b0]
call fcn.140001cbc
lea rcx, [0x1400011b0]
call fcn.140001cbc
lea rcx, [0x1400011d0]
call fcn.140001cbc
lea rcx, [0x140001248]
call fcn.140001cbc
lea rcx, [0x140001280]
call fcn.140001cbc
lea rcx, [0x1400012c0]
call fcn.140001cbc
lea rcx, [0x1400012f0]
call fcn.140001cbc
lea rcx, [0x140001328]
call fcn.140001cbc
lea rcx, [0x140001340]
call fcn.140001cbc
lea rcx, [0x1400013d0]
call fcn.140001cbc
lea rcx, [0x140001440]
call fcn.140001cbc
lea rcx, [0x1400014b0]
call fcn.140001cbc
lea rcx, [0x140001530]
call fcn.140001cbc
lea rcx, [0x140001590]
call fcn.140001cbc
lea rcx, [0x1400015a0]
call fcn.140001cbc
lea rcx, [0x140001600]
call sub.msvcrt.dll_system
lea r11, [rsp + 0x920]
mov eax, 1
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x478
call sub.msvcrt.dll_memset
mov rdx, qword [rbx + 8]
lea rcx, [rbp + 0x128]
call sub.msvcrt.dll_wcscpy
mov rdx, qword [rbx + 8]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_wcscpy
mov rcx, qword [rbx + 8]
call fcn.140001964
test al, al
je 0x140002083
lea rcx, [rbp + 0x128]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathStripPathW]
mov rdx, qword [rbx + 0x10]
lea rcx, [rbp + 0x330]
call sub.msvcrt.dll_wcscpy
lea rcx, [rbp + 0x330]
call fcn.140001bc0
movzx ecx, word [rbp + 0x330]
call sub.msvcrt.dll_iswdigit
lea rcx, [rbp + 0x330]
test eax, eax
je 0x140001f69
lea r8, [rbp + 0x394]
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_StrToIntExW]
jmp 0x140001f75
and dword [rbp + 0x394], 0
call sub.msvcrt.dll__wcslwr
and dword [rbp + 0x838], 0
lea rcx, [0x140001608]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rcx, rax
lea rdx, [rbp + 0x838]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rbp + 0x838]
test r8d, r8d
je 0x140001eb2
xor edx, edx
lea ecx, [rdx + 0x2a]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140001eb2
mov edx, 8
lea rcx, [rbp + 0x3a0]
lea rax, [rsp + 0x20]
lea r8d, [rdx + 0x78]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
add rax, r8
movups xmmword [rcx + 0x60], xmm0
add rcx, r8
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140001fdc
movups xmm0, xmmword [rax]
lea r8, [0x140001988]
mov rdx, rbx
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
mov rax, qword [rax + 0x70]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
mov qword [rcx + 0x70], rax
lea rcx, [rbp + 0x3a0]
call fcn.140001758
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]