Function at 0x1400013b0
Capabilities:
Accept command line arguments
Access pe header
Create thread
Inject thread

Disassembly:
push rbp
push rbx
push r12
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
call fcn.14000180c
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r12d, r12d
lea rdx, [rbp + 0x77]
mov rcx, rax
mov dword [rbp + 0x77], r12d
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [rbp + 0x77], 4
mov rbx, rax
jne 0x14000172f
mov r8, qword [rax + 0x10]
lea rcx, [0x140003010]
mov edx, 0x104
call qword [sym.imp.ntdll.dll_wcscpy_s]
test eax, eax
jne 0x14000172f
mov r8, qword [rbx + 0x18]
lea edx, [rax + 0x40]
lea rcx, [0x140003218]
call qword [sym.imp.ntdll.dll_wcscpy_s]
test eax, eax
jne 0x14000172f
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x6f]
lea rdx, [0x140002190]
mov dword [rbp + 0x6f], r12d
call sub.ntdll.dll_swscanf_s
cmp eax, 1
jne 0x14000172f
mov rax, qword [rbx + 8]
mov qword [rsp + 0x98], rdi
cmp word [rax], 0x30
jne 0x140001475
movzx eax, word [rax + 2]
mov ecx, 0xffdf
sub ax, 0x58
test cx, ax
jne 0x140001475
movsxd rax, dword [rbp + 0x6f]
mov rdi, rax
jmp 0x14000149c
mov eax, dword [rbp + 0x6f]
cmp eax, 0xffffffff
jne 0x140001486
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x6f], eax
mov r8d, eax
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov eax, dword [rbp + 0x6f]
test rdi, rdi
jne 0x1400014c3
test eax, eax
je 0x140001725
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x98]
add rsp, 0xa0
pop r12
pop rbx
pop rbp
ret
mov dword [rbp - 0x19], r12d
mov dword [rbp + 0x7f], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x14000171c
lea rdx, [rbp + 0x7f]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x14000171c
mov eax, dword [rbp + 0x7f]
cmp dword [rbp - 0x19], eax
jne 0x14000171c
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0x90], r13
lea r13, [0x140000000]
mov qword [rsp + 0x80], r15
mov rcx, r13
mov qword [rsp + 0x88], r14
mov r15, r12
call sub.ntdll.dll_RtlImageNtHeader
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
xor edx, edx
mov rcx, rdi
mov ebx, dword [rax + 0x50]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x1400016a1
mov rdx, rax
mov rcx, r13
call fcn.140001000
mov r15, rax
test rax, rax
je 0x1400016a1
mov r9d, ebx
mov qword [rsp + 0x20], r12
mov r8, rax
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400016a1
mov rcx, r13
call sub.ntdll.dll_RtlImageNtHeader
xorps xmm0, xmm0
mov rbx, r13
mov r14d, dword [rax + 0x50]
add r14, r13
movups xmmword [rbp - 0x11], xmm0
movups xmmword [rbp - 1], xmm0
movups xmmword [rbp + 0xf], xmm0
cmp r13, r14
jae 0x140001627
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x28], r12
lea r9, [rbp - 0x11]
mov rcx, rax
mov qword [rsp + 0x20], 0x30
xor r8d, r8d
mov rdx, rbx
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x140001697
mov rax, qword [rbp - 0x11]
lea r8, [rbp + 7]
sub rax, qword [rbp - 9]
lea rdx, [rbp - 0x19]
mov r9d, dword [rbp + 0x13]
add rax, rsi
mov qword [rbp - 0x19], rax
mov rcx, rdi
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
call sub.ntdll.dll_NtProtectVirtualMemory
test eax, eax
js 0x140001697
add rbx, qword [rbp + 7]
cmp rbx, r14
jb 0x1400015c0
lea rcx, [0x140001290]
mov qword [rsp + 0x30], r12
mov r9, rsi
mov dword [rsp + 0x28], r12d
sub r9, r13
lea rax, [0x140003010]
add rax, r9
xor r8d, r8d
add r9, rcx
mov qword [rsp + 0x20], rax
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
je 0x1400016a1
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x7f]
mov dword [rbp + 0x7f], r12d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbp + 0x7f]
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1400016ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test r15, r15
je 0x1400016d2
mov qword [rbp - 0x19], r15
mov qword [rbp + 0x7f], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x8000
lea r8, [rbp + 0x7f]
mov rcx, rax
lea rdx, [rbp - 0x19]
call sub.ntdll.dll_NtFreeVirtualMemory
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
test rsi, rsi
je 0x140001704
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0xc0]
mov eax, ebx
jmp 0x1400014af
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x57
jmp 0x1400014af
mov eax, 0x57
add rsp, 0xa0
pop r12
pop rbx
pop rbp
ret