Function at 0x2100d3600
Capabilities:
Accept command line arguments
Create process on windows
Resolve function by parsing pe exports
Resume thread
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
mov eax, 0xffffffff
lea r13, [0x210273880]
mov qword [rcx + 0x1b8], rax
mov r12, rcx
mov qword [rsp + 0x1b8], rdx
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
call sym.GetCurrentProcess
mov rcx, rax
call sym.GetPriorityClass
mov ebp, eax
test byte [0x210273880], 1
jne 0x2100d3cc8
lea rcx, [0x210297435]
lea r9, [0x2102d1cc0]
mov qword [r12 + 0x1b0], 0
mov r8d, 3
mov qword [r12 + 0x1c0], 0
mov edx, 0x40000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call sym.CreateFileA
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x2100d3ca0
call sym.CloseHandle
mov rax, qword [0x21023d810]
or ebp, 0x400
mov ebx, dword [rax + 0x4920]
test ebx, ebx
jle 0x2100d3728
or ebp, 4
mov r10d, dword [0x2102f71e4]
xor eax, eax
test r10d, r10d
je 0x2100d3743
mov r9d, dword [0x2102f71e0]
test r9d, r9d
setne al
mov byte [r12 + 8], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x2102d1ca0]
call sym.CreateEventA
mov qword [rsp + 0x68], rax
test rax, rax
je 0x2100d4345
mov rax, qword [rsp + 0x68]
mov qword [r12 + 0x80], rax
mov rax, qword gs:[0x30]
mov r8, qword [rax + 8]
mov rax, qword gs:[0x30]
mov qword [r12 + 0x198], r8
mov rax, qword [rax + 0x1478]
mov qword [r12 + 0x188], rax
test rax, rax
je 0x2100d3d90
mov ecx, dword [0x21034b024]
mov rdx, qword [rsp + 0x1b8]
mov rax, rcx
neg rcx
and rdx, rcx
mov qword [r12 + 0x190], rdx
mov rdx, qword gs:[0x30]
mov rdx, qword [rdx + 8]
lea rcx, [rdx - 0x3200]
cmp qword [0x21024fae8], rcx
je 0x2100d3bf0
cmp qword [rdx - 0x1c08], 0
je 0x2100d3bf0
mov rax, qword [rdx - 0x1c08]
mov rax, qword [rax + 0x48]
mov qword [r12 + 0x1a0], rax
test byte [0x210273880], 1
jne 0x2100d3cf0
lea rdi, [rsp + 0xf0]
xor eax, eax
mov ecx, 0xd
mov edx, 0xffffffff
mov qword [rsp + 0x60], rdi
lea r14, [r12 + 0x10]
rep stosq qword [rdi], rax
mov ecx, 0x1a0
mov qword [rsp + 0x138], r14
mov word [rsp + 0x132], cx
lea rcx, [0x21024fba0]
mov dword [rsp + 0xf0], 0x68
call method.muto.acquire_unsigned_int_
mov dword [rsp + 0x7c], eax
call sym.RevertToSelf
mov rax, qword [0x21023d808]
xor edx, edx
mov rcx, r14
mov qword [r12 + 0x30], rax
call method.child_info.prefork_bool_
mov rax, qword [0x21025fe48]
mov rsi, qword [r12]
mov r8d, dword [rax + 0xdfb4]
test r8d, r8d
js 0x2100d3dc0
movzx eax, byte [rsi]
or al, byte [0x2102f7104]
lea r15, [0x2102f7100]
mov rdx, rsi
mov ebx, eax
je 0x2100d38c5
mov rcx, r15
call method.dll_list.request_forkables__
mov rdx, qword [r12]
mov byte [rsi], bl
cmp byte [rdx], 0
movzx eax, byte [r12 + 0x38]
jne 0x2100d3c90
or eax, 8
mov byte [r12 + 0x38], al
lea rcx, [rsp + 0x88]
lea rsi, [0x21023eea0]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov eax, dword [rax - 0x2cc8]
mov dword [rsp + 0x88], eax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov eax, dword [rax - 0x2cc4]
mov dword [rsp + 0x8c], eax
call method.tmp_pathbuf.w_get__
mov r8, qword [0x21025fcf8]
mov r9d, 0x1000
mov rbx, rax
mov rax, qword [0x21023d810]
mov rcx, rbx
mov rdx, qword [rax + 0x4790]
mov dword [rsp + 0x20], 0
call sym.__sec_user_void__void__void__unsigned_int__int_
test rax, rax
lea rax, [0x2102d1cc0]
cmove rbx, rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x58], rax
lea rax, [r12 + 0x1c0]
mov qword [rsp + 0x70], rax
mov rax, qword [0x2102f7138]
test rax, rax
je 0x2100d3c00
mov r8, qword [rax + 0x90]
test r8, r8
je 0x2100d399f
cmp word [r8], 0
jne 0x2100d39a6
lea r8, [rax + 0x98]
mov edx, 0x8000
mov rcx, rsi
call method.dll_list.form_shortname_wchar_t__unsigned_long__wchar_t_const_
cmp word [rsi], 0
je 0x2100d3c00
mov rdi, rsi
test byte [r13], 1
jne 0x2100d3dd8
mov qword [r12 + 0x1c0], 0
call sym.GetCommandLineW
mov dword [rsp + 0x28], ebp
mov r9, rbx
mov r8, rbx
mov rdx, rax
mov rax, qword [rsp + 0x58]
mov rcx, rdi
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x60]
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x40], rax
call sym.CreateProcessW
test eax, eax
je 0x2100d3de8
test byte [r13], 1
jne 0x2100d3c60
mov rcx, qword [0x21023d810]
mov edx, dword [rcx + 0x4920]
test edx, edx
jle 0x2100d3a63
mov edx, dword [rsp + 0xa0]
add rcx, 0x4900
call method.dtable.fixup_before_fork_unsigned_int_
mov rcx, qword [rsp + 0x98]
call sym.ResumeThread
mov rcx, qword [rsp + 0x98]
call sym.CloseHandle
mov rax, qword [rsp + 0x90]
mov rcx, r15
mov qword [r12 + 0x1c0], rax
call method.dll_list.release_forkables__
mov edx, dword [rsp + 0xa0]
mov rcx, r13
call method.strace.write_childpid_int_
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0xa0]
mov rcx, r14
mov r9d, 0x493e0
call method.child_info.sync_int__void__unsigned_int_
test al, al
jne 0x2100d3e48
mov eax, dword [r12 + 0x74]
mov r8d, dword [rsp + 0xa0]
lea rdx, str.forked_process__u_died_unexpectedly__retry__d__exit_code__y
mov rcx, r12
mov dword [rsp + 0x20], eax
mov r9d, dword [r12 + 0x3c]
call method.frok.error_char_const__..._
test al, al
je 0x2100d397c
mov dword [r12 + 0x1bc], 0xb
mov rax, qword [0x21023d810]
mov byte [rsp + 0xc8], 1
cmp qword [rax + 0x4878], 0
je 0x2100d3b17
mov rcx, qword [rax + 0x4870]
call sym.ImpersonateLoggedOnUser
mov eax, dword [rsp + 0x7c]
test eax, eax
je 0x2100d3b3f
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 8]
lea rcx, [0x21024fba0]
sub rdx, 0x3200
call method.muto.release__cygtls_
mov rcx, qword [r12 + 0x1c0]
test rcx, rcx
je 0x2100d3b65
mov edx, 1
call sym.TerminateProcess
cmp qword [rsp + 0xb8], 0
je 0x2100d3d38
mov rcx, qword [rsp + 0x68]
call sym.CloseHandle
test byte [0x210273880], 1
jne 0x2100d3d68
mov r12d, 0xffffffff
mov edx, dword [rsp + 0x88]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov dword [rax - 0x2cc8], edx
mov edx, dword [rsp + 0x8c]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov dword [rax - 0x2cc4], edx
cmp byte [rsp + 0xc8], 0
je 0x2100d3bd8
cmp qword [rsp + 0xd8], 0
je 0x2100d3bd8
lea rcx, [rsp + 0xb0]
call method.pinfo.release__
mov eax, r12d
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [0x21034b1a0]
imul eax, dword [rdx]
jmp 0x2100d3806
mov rax, qword [0x21024fce8]
lea rdi, [rax + 0x18]
test byte [r13], 1
je 0x2100d39cb
mov rdx, qword [rsp + 0x58]
add rax, 0x18
mov dword [rsp + 0x30], ebp
mov rcx, r13
mov qword [rsp + 0x28], rax
lea r9, str.CreateProcessW___W___W__0__0__1___y__0__0___p___p_
lea r8, str.int_frok::parent_volatile_char_
mov qword [rsp + 0x40], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x38], rdx
mov edx, 0x10
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100d39cb
mov eax, dword [rsp + 0xa0]
lea r9, str.forked_pid__u
mov edx, 0x40
mov rcx, r13
lea r8, str.int_frok::parent_volatile_char_
mov dword [rsp + 0x20], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100d3a32
and eax, 0xfffffff7
jmp 0x2100d38d9
mov rax, qword [0x21023d810]
or ebp, 0x408
mov r11d, dword [rax + 0x4920]
test r11d, r11d
jg 0x2100d3725
jmp 0x2100d3728
mov dword [rsp + 0x20], eax
lea r9, [0x21029743d]
mov edx, 0x40
mov rcx, r13
lea r8, str.int_frok::parent_volatile_char_
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100d36ad
mov qword [rsp + 0x38], rax
mov rax, qword [r12 + 0x188]
lea r9, str.stack___bottom__p__top__p__addr__p__guardsize__ly
mov rcx, r13
mov edx, 0x40
mov qword [rsp + 0x30], rax
mov rax, qword [r12 + 0x190]
mov qword [rsp + 0x20], r8
lea r8, str.int_frok::parent_volatile_char_
mov qword [rsp + 0x28], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100d381b
mov rcx, qword [r12 + 0x1c0]
mov r12d, 0xffffffff
call sym.CloseHandle
mov rcx, qword [rsp + 0x68]
call sym.CloseHandle
test byte [0x210273880], 1
je 0x2100d3b82
nop word [rax + rax]
lea r9, str.returning__1
lea r8, str.int_frok::parent_volatile_char_
mov edx, 0x40
mov rcx, r13
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100d3b7c
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x10]
mov qword [r12 + 0x190], rax
mov qword [r12 + 0x188], rax
mov rax, 0xffffffffffffffff
jmp 0x2100d3806
mov rdx, rsi
mov ebx, 1
lea r15, [0x2102f7100]
jmp 0x2100d38c5
mov rax, qword [0x21024fce8]
jmp 0x2100d3c16
call sym.GetLastError
mov edx, 0xd
mov ecx, eax
call sym.geterrno_from_win_error_unsigned_int__int_
lea rdx, str.CreateProcessW_failed_for__W
mov rcx, r12
mov dword [r12 + 0x1bc], eax
mov rax, qword [0x21024fce8]
lea r8, [rax + 0x18]
call method.frok.error_char_const__..._
mov rcx, r15
call method.dll_list.release_forkables__
mov rax, qword [rsp + 0x58]
mov qword [rax], 0
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
jmp 0x2100d3af2
mov rax, qword [0x21023d810]
cmp qword [rax + 0x4878], 0
je 0x2100d3e65
mov rcx, qword [rax + 0x4870]
call sym.ImpersonateLoggedOnUser
mov ecx, dword [rsp + 0xa0]
lea r15, [rsp + 0xb0]
call sym.cygwin_pid_unsigned_int_
mov rcx, r15
xor r9d, r9d
mov r8d, 0x1001
mov dword [r12 + 0x1b8], eax
mov edx, eax
call method.pinfo.init_int__unsigned_int__void_
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
je 0x2100d4135
mov rdx, qword [0x21024fce8]
add rcx, 0x18
mov eax, dword [rdx + 0xfd58]
add rdx, 0x18
mov dword [rcx + 0xfd40], eax
call sym.msys_2.0.dll_wcscpy
mov rax, qword [rsp + 0xd8]
mov rcx, qword [r12 + 0x48]
mov edx, dword [rsp + 0xa0]
mov dword [rax + 0x14], edx
mov rax, qword [r12 + 0x1c0]
mov qword [rsp + 0xb8], rax
call sym.CloseHandle
mov rax, qword [r12 + 0x40]
mov rdx, r15
mov qword [r12 + 0x48], 0
mov qword [r12 + 0x40], 0
mov ecx, 1
mov qword [rsp + 0xc0], rax
call sym.proc_subproc_unsigned_int__unsigned_long_
test eax, eax
sete byte [rsp + 0xc8]
je 0x2100d40e4
test byte [0x210273880], 1
jne 0x2100d4169
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
sub rax, 0x3200
cmp qword [0x21024fae8], rax
je 0x2100d4189
mov rax, qword [sym.msys_2.0.dll__impure_ptr]
lea r9, str.impure
lea r10, [rax + 0x760]
mov rcx, qword [r12]
mov rdx, qword [rsp + 0x1b8]
movzx r8d, byte [rcx]
mov rcx, qword [r12 + 0x1c0]
mov qword [rsp + 0x30], r9
lea r9, str.stack
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], r10
xor r8d, 1
mov qword [rsp + 0x38], rax
mov rax, qword [r12 + 0x198]
movzx r8d, r8b
mov qword [rsp + 0x20], rdx
mov edx, 1
mov qword [rsp + 0x28], rax
call sym.child_copy_void__bool__bool__::_
lea rcx, [0x21024fba0]
mov ebx, eax
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 8]
sub rdx, 0x3200
call method.muto.release__cygtls_
test bl, bl
je 0x2100d40fd
mov dword [0x2102f7130], 2
lea rbp, [0x2102f7140]
jmp 0x2100d401a
cmp dword [rbp + 0x58], 2
je 0x2100d4196
mov rbp, qword [rbp]
test rbp, rbp
jne 0x2100d4010
nop dword [rax + rax]
mov qword [0x2102f7128], 0
mov rcx, qword [rsp + 0x68]
call sym.SetEvent
test byte [0x210273880], 1
jne 0x2100d42cf
mov rax, qword [rsp + 0xd8]
mov r8, qword [rsp + 0x70]
mov r9d, 0x493e0
mov rcx, r14
mov edx, dword [rax]
call method.child_info.sync_int__void__unsigned_int_
test al, al
je 0x2100d431d
cmp byte [r12 + 8], 0
je 0x2100d40ae
mov dword [0x2102f7130], 3
lea r14, [0x2102f7140]
jmp 0x2100d409b
cmp dword [r14 + 0x58], 3
je 0x2100d4378
mov r14, qword [r14]
test r14, r14
jne 0x2100d4090
mov qword [0x2102f7128], 0
mov rdx, r15
mov ecx, 2
call sym.proc_subproc_unsigned_int__unsigned_long_
test eax, eax
sete byte [rsp + 0xc8]
jne 0x2100d42ef
mov dword [r12 + 0x1bc], 0xb
mov byte [rsp + 0xc8], 1
jmp 0x2100d3b3f
mov dword [r12 + 0x1bc], 0xb
mov byte [rsp + 0xc8], 1
jmp 0x2100d3b17
call sym.msys_2.0.dll___errno
mov r9d, dword [r12 + 0x74]
mov r8d, dword [rsp + 0xa0]
mov rcx, r12
mov eax, dword [rax]
lea rdx, str.pid__u__exitval__p
mov dword [r12 + 0x1bc], eax
call method.frok.error_char_const__..._
mov byte [rsp + 0xc8], 1
jmp 0x2100d3b3f
call sym.msys_2.0.dll___errno
mov edx, 0xb
mov eax, dword [rax]
cmp eax, 0xc
cmovne eax, edx
mov dword [r12 + 0x1bc], eax
test byte [0x210273880], 1
jne 0x2100d42a7
mov byte [rsp + 0xc8], 1
jmp 0x2100d3b17
lea r9, str.child_is_alive__but_stopped_
lea r8, str.int_frok::parent_volatile_char_
mov edx, 0x40
mov rcx, r13
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100d3f3a
xor r9d, r9d
xor r10d, r10d
xor eax, eax
jmp 0x2100d3f6f
mov qword [0x2102f7128], rbp
lea rsi, str.linked_dll_bss
lea rdi, str.int_frok::parent_volatile_char_
lea rbx, str.linked_dll_data
nop word [rax + rax]
test byte [r13], 1
jne 0x2100d4260
mov rax, qword [r12]
mov rcx, qword [r12 + 0x1c0]
mov r9, rbx
mov edx, 1
movzx r8d, byte [rax]
mov qword [rsp + 0x48], 0
mov rax, qword [rbp + 0x38]
xor r8d, 1
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x30]
movzx r8d, r8b
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x20]
mov qword [rsp + 0x20], rax
call sym.child_copy_void__bool__bool__::_
test al, al
je 0x2100d427c
mov rbp, qword [0x2102f7128]
mov eax, dword [0x2102f7130]
jmp 0x2100d423a
cmp eax, 4
je 0x2100d4250
cmp eax, dword [rbp + 0x58]
je 0x2100d4250
mov rbp, qword [rbp]
test rbp, rbp
jne 0x2100d4230
jmp 0x2100d4028
mov qword [0x2102f7128], rbp
jmp 0x2100d41b8
lea r9, str.copying_data_bss_of_a_linked_dll
mov r8, rdi
mov edx, 0x40
mov rcx, r13
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100d41c3
call sym.msys_2.0.dll___errno
lea rdx, str.couldnt_copy_linked_dll_data_bss
mov rcx, r12
mov eax, dword [rax]
mov dword [r12 + 0x1bc], eax
call method.frok.error_char_const__..._
mov byte [rsp + 0xc8], 1
jmp 0x2100d3b3f
lea r9, [0x210297584]
lea r8, str.int_frok::parent_volatile_char_
mov edx, 0x10
mov rcx, r13
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov byte [rsp + 0xc8], 1
jmp 0x2100d3b17
lea r9, str.signalled_child
lea r8, str.void_resume_child_HANDLE_
mov edx, 0x40
mov rcx, r13
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100d404a
mov rcx, qword [rsp + 0x68]
call sym.SetEvent
test byte [0x210273880], 1
jne 0x2100d4470
mov rcx, qword [rsp + 0x68]
call sym.CloseHandle
mov r12d, dword [r12 + 0x1b8]
jmp 0x2100d3b82
mov dword [r12 + 0x1bc], 0xb
lea rdx, str.died_waiting_for_dll_loading
mov rcx, r12
call method.frok.error_char_const__..._
mov byte [rsp + 0xc8], 1
jmp 0x2100d3b3f
call sym.GetLastError
mov edx, 0xd
mov ecx, eax
call sym.geterrno_from_win_error_unsigned_int__int_
mov rcx, r12
lea rdx, str.unable_to_allocate_forker_finished_event
mov dword [r12 + 0x1bc], eax
mov r12d, 0xffffffff
call method.frok.error_char_const__..._
jmp 0x2100d3bb6
mov qword [0x2102f7128], r14
lea rsi, str.loaded_dll_bss
lea rbp, str.copying_data_bss_for_a_loaded_dll
lea rdi, str.int_frok::parent_volatile_char_
lea rbx, str.loaded_dll_data
nop dword [rax + rax]
test byte [r13], 1
jne 0x2100d443c
mov rax, qword [r12]
mov rcx, qword [r12 + 0x1c0]
mov r9, rbx
mov edx, 1
movzx r8d, byte [rax]
mov qword [rsp + 0x48], 0
mov rax, qword [r14 + 0x38]
xor r8d, 1
mov qword [rsp + 0x40], rax
mov rax, qword [r14 + 0x30]
movzx r8d, r8b
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
mov rax, qword [r14 + 0x28]
mov qword [rsp + 0x28], rax
mov rax, qword [r14 + 0x20]
mov qword [rsp + 0x20], rax
call sym.child_copy_void__bool__bool__::_
test al, al
je 0x2100d4454
mov r14, qword [0x2102f7128]
mov eax, dword [0x2102f7130]
jmp 0x2100d4423
cmp eax, 4
je 0x2100d4430
cmp eax, dword [r14 + 0x58]
je 0x2100d4430
mov r14, qword [r14]
test r14, r14
jne 0x2100d4418
jmp 0x2100d40a3
mov qword [0x2102f7128], r14
jmp 0x2100d43a0
mov r9, rbp
mov r8, rdi
mov edx, 0x40
mov rcx, r13
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100d43ab
call sym.msys_2.0.dll___errno
mov eax, dword [rax]
mov byte [rsp + 0xc8], 1
mov dword [r12 + 0x1bc], eax
jmp 0x2100d3b3f
lea r9, str.signalled_child
lea r8, str.void_resume_child_HANDLE_
mov edx, 0x40
mov rcx, r13
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100d4306