Function at 0x1400f03bc
Capabilities:
Accept command line arguments
Get common file path
Get hostname
Get session user name

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x470]
sub rsp, 0x570
mov rax, qword [0x14017da30]
xor rax, rsp
mov qword [rbp + 0x460], rax
xor r15d, r15d
mov r14, r8
mov rdi, rdx
cmp word [0x140192fa0], r15w
mov rsi, rcx
lea rbx, [0x1401395bc]
je 0x1400f044d
lea rcx, str.Application:
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
lea rdx, str.Application:
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
lea rdx, [0x140192fa0]
mov rcx, rdi
call fcn.1400f2ddc
mov rcx, rbx
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
mov rdx, rbx
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
cmp word [0x1401931b0], r15w
je 0x1400f04a0
lea rcx, str.Version:
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
lea rdx, str.Version:
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
lea rdx, [0x1401931b0]
mov rcx, rdi
call fcn.1400f2ddc
mov rcx, rbx
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
mov rdx, rbx
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x60]
mov dword [rsp + 0x30], shutdown
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x1400f0501
lea rcx, str.Computer:
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
lea rdx, str.Computer:
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.1400f2ddc
mov rcx, rbx
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
mov rdx, rbx
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
lea rcx, [rsp + 0x50]
mov edx, 0x400
mov r8d, 1
call fcn.1400e2544
lea rax, [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x60]
call qword [rax]
lea rcx, [rsp + 0x38]
call fcn.1400f014c
cmp qword [rsp + 0x70], r15
je 0x1400f05a0
lea rcx, [rbp - 0x68]
xor r8d, r8d
xor edx, edx
call fcn.1400e879c
lea rcx, str.IP_Address:
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
lea rdx, str.IP_Address:
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, qword [rdi + 8]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rbx
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
mov rdx, rbx
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x40]
mov dword [rsp + 0x30], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1400f0601
lea rcx, str.User:
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
lea rdx, str.User:
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
lea rdx, [rbp + 0x40]
mov rcx, rdi
call fcn.1400f2ddc
mov rcx, rbx
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
mov rdx, rbx
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
lea rdx, [rbp - 0x40]
mov r8d, 0x40
mov rcx, rsi
call fcn.1400f02dc
lea rcx, str.Date:
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
lea rdx, str.Date:
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.1400f2ddc
lea r12, str._________________________________________r_n
cmp qword [rsi + 0x18], r15
je 0x1400f0692
lea rcx, str._r_n_r_nError_Reason:_r_n
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_nError_Reason:_r_n
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rdx, rdi
mov rcx, rsi
call fcn.1400efa94
mov rax, qword [0x14017d970]
cmp qword [rax + 8], r15
je 0x1400f06ec
lea rcx, str._r_n_r_nUser_Message:_r_n
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_nUser_Message:_r_n
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rdx, qword [0x14017d970]
mov rcx, rdi
add rdx, 0x10
call fcn.1400f2ddc
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400f06fd
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.1400efafc
cmp qword [rsp + 0x70], r15
je 0x1400f0768
lea rcx, [rbp - 0x68]
xor r8d, r8d
xor edx, edx
call fcn.1400e879c
lea rcx, str._r_n_r_nSystem_Error:_r_n
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_nSystem_Error:_r_n
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, qword [rdi + 8]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400f0779
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.1400efbb0
cmp qword [rsp + 0x70], r15
je 0x1400f07e4
lea rcx, [rbp - 0x68]
xor r8d, r8d
xor edx, edx
call fcn.1400e879c
lea rcx, str._r_n_r_nCOM_Error:_r_n
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_nCOM_Error:_r_n
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, qword [rdi + 8]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x20]
cmp qword [rsi + 0x18], r15
je 0x1400f082f
lea rcx, str._r_n_r_nRegisters:_r_n
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_nRegisters:_r_n
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rdx, rdi
mov rcx, rsi
call fcn.1400efa38
lea rcx, str._r_n_r_nCPU:_r_n
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_nCPU:_r_n
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, rdi
call fcn.1400efd94
lea rcx, str._r_n_r_nOperating_System:_r_n
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_nOperating_System:_r_n
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, rdi
call fcn.1400efde8
lea rcx, str._r_n_r_nMemory_Usage:_r_n
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_nMemory_Usage:_r_n
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, rdi
call fcn.1400efe44
mov rcx, rbx
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
mov rdx, rbx
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
cmp qword [rsi + 0x18], r15
je 0x1400f0937
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, str.Interrupted_Thread
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov r8d, eax
mov rdx, rdi
call fcn.1400eda60
test r14, r14
je 0x1400f094a
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.1400ee580
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, str.Command_Line:_r_n
mov rbx, rax
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
mov r9, qword [rcx]
lea rdx, str.Command_Line:_r_n
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rdx, rbx
mov rcx, rdi
call fcn.1400f2ddc
lea rdx, [rbp + 0x250]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1400f09f7
lea rcx, str._r_n_r_nCurrent_Directory:_r_n
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_nCurrent_Directory:_r_n
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
lea rdx, [rbp + 0x250]
mov rcx, rdi
call fcn.1400f2ddc
lea rcx, str._r_n_r_nEnvironment_Variables:_r_n
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
lea rdx, str._r_n_r_nEnvironment_Variables:_r_n
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, r12
call sub.MSVCR120.dll_strlen
mov rcx, qword [rdi + 8]
mov rdx, r12
mov r9, qword [rcx]
mov r8, rax
call qword [r9 + 0x18]
mov rcx, rdi
call fcn.1400efea0
test r14, r14
je 0x1400f0a4c
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.1400eec68
lea rax, [0x1401371f8]
mov qword [rsp + 0x50], rax
lea rax, [0x140137210]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
movsxd rcx, dword [rax + 4]
lea rax, [0x140137238]
mov qword [rsp + rcx + 0x58], rax
mov rax, qword [rsp + 0x58]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x40]
mov dword [rsp + rcx + 0x54], edx
mov rcx, qword [rbp - 0x78]
call sub.MSVCR120.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rbp + 0x460]
xor rcx, rsp
call fcn.14010a480
add rsp, 0x570
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret