Function at 0x1400f0abc
Capabilities:
Accept command line arguments
Get common file path
Get hostname
Get session user name

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x690]
sub rsp, 0x790
mov rax, qword [0x14017da30]
xor rax, rsp
mov qword [rbp + 0x680], rax
mov rdi, rcx
mov rcx, rdx
mov rsi, r8
mov rbx, rdx
mov byte [rdx + 0x24], 0x20
mov dword [rdx + 0x20], 2
call fcn.1400fbcbc
lea rdx, [rbp - 0x20]
mov r8d, 0x40
mov rcx, rdi
call fcn.1400f02dc
lea rax, [0x140139818]
xor r14d, r14d
cmp qword [rdi + 0x18], r14
lea r9, str.snapshot
lea r8, str._r_n_This__s_was_automatically_generated_r_n_by_BugTrap_for_Win64_x64_on__s_r_n
cmovne r9, rax
lea rax, [rbp - 0x20]
lea rcx, [rbp + 0x480]
mov edx, 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR120.dll_swprintf_s]
lea rdx, [rbp + 0x480]
mov rcx, rbx
call fcn.1400fb5b0
lea rdx, str.report
mov rcx, rbx
call fcn.1400fbd24
lea r8, [0x1401398f8]
lea rdx, str.version
mov rcx, rbx
call fcn.1400fb154
lea r8, str.Win64_x64
lea rdx, str.platform
mov rcx, rbx
call fcn.1400fb860
lea r8, [0x140192fa0]
lea rdx, str.application
mov rcx, rbx
call fcn.1400fb860
lea r8, [0x1401931b0]
lea rdx, str.version
mov rcx, rbx
call fcn.1400fb860
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x30], shutdown
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x1400f0be4
mov word [rsp + 0x38], r14w
lea r8, [rsp + 0x38]
lea rdx, str.computer
mov rcx, rbx
call fcn.1400fb860
mov rcx, rbx
call fcn.1400f01a0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x270]
mov dword [rsp + 0x30], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x1400f0c26
mov word [rbp + 0x270], r14w
lea r8, [rbp + 0x270]
lea rdx, str.user
mov rcx, rbx
call fcn.1400fb860
lea rdx, [rsp + 0x60]
mov r8d, 0x40
mov rcx, rdi
call fcn.1400f0364
lea r8, [rsp + 0x60]
lea rdx, str.timestamp
mov rcx, rbx
call fcn.1400fb860
mov rdx, rbx
mov rcx, rdi
call fcn.1400edda8
mov r8, qword [0x14017d970]
lea rdx, str.usermsg
add r8, 0x10
mov rcx, rbx
call fcn.1400fb860
mov rdx, rbx
mov rcx, rdi
call fcn.1400ee13c
mov rdx, rbx
mov rcx, rdi
call fcn.1400ee1ec
cmp qword [rdi + 0x18], r14
je 0x1400f0caf
mov rdx, rbx
mov rcx, rdi
call fcn.1400edf60
mov rdx, rbx
mov rcx, rdi
call fcn.1400ee2c4
mov rdx, rbx
mov rcx, rdi
call fcn.1400ee408
mov rdx, rbx
mov rcx, rdi
call fcn.1400ee4b0
lea rdx, str.threads
mov rcx, rbx
call fcn.1400fbd24
cmp qword [rdi + 0x18], r14
je 0x1400f0d08
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, str.interrupted
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, rdi
mov r8d, eax
mov rdx, rbx
call fcn.1400edbc8
test rsi, rsi
je 0x1400f0d1b
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.1400ee6a0
mov rcx, rbx
call fcn.1400fb950
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, str.cmdline
mov r8, rax
mov rcx, rbx
call fcn.1400fb860
lea rdx, [rbp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1400f0d53
mov word [rbp + 0x60], r14w
lea r8, [rbp + 0x60]
lea rdx, str.curdir
mov rcx, rbx
call fcn.1400fb860
mov rcx, rbx
call fcn.1400efef4
test rsi, rsi
je 0x1400f0d81
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.1400eed30
mov rcx, rbx
call fcn.1400fb950
mov rcx, rbx
call fcn.1400fb8fc
mov rcx, qword [rbp + 0x680]
xor rcx, rsp
call fcn.14010a480
add rsp, 0x790
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret