Function at 0x1404400de
Capabilities:
Accept command line arguments
Create thread

Disassembly:
push rsi
clc
sub rsp, 0x70
jmp 0x1404400e9
mov dword [rsp + 0x3c], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x3c]
mov cl, 0x95
cmovae cx, ax
setne cl
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
movsxd r8, dword [rsp + 0x3c]
movzx si, sil
lea rsi, [rsp + 0x40]
movsx ecx, r10w
cmovno cx, r15w
mov rcx, rsi
mov rdx, rax
call fcn.140440467
lea rax, [0x1400b8ec8]
test r10, r11
cmp ax, 0x4f19
cmp rsi, rax
jmp 0x140440147
je 0x1404402b2
mov rcx, qword [0x1400b8ec8]
test r12w, bx
test r9b, 0xe4
test rcx, rcx
jmp 0x140440164
je 0x1404401c9
mov rdx, qword [0x1400b8ed8]
sub rdx, rcx
test rbp, 0x21826adf
cmp rdx, 0x1000
jb 0x1404401c4
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
cmp r12w, 0x4471
jmp 0x14044019b
sub rcx, rax
stc
cmp rcx, 0x20
jmp 0x1404401a8
jae 0x14044045c
add rdx, 0x27
bswap rcx
movzx ecx, bx
movsx ecx, r8w
mov rcx, rax
jmp 0x1404401c4
call fcn.1401fd7f8
movaps xmm0, xmmword [rsp + 0x40]
jmp 0x1404401d3
movups xmmword [0x1400b8ec8], xmm0
movzx ax, r12b
mov rax, qword [rsp + 0x50]
mov qword [0x1400b8ed8], rax
jmp 0x1404401f0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
mov rcx, qword [0x1400b8ee0]
cmp r8, rcx
test rcx, rcx
jmp 0x140440213
je 0x14044027c
mov rdx, qword [0x1400b8ef0]
jmp 0x140440225
sub rdx, rcx
test r10b, 0x22
test r14b, r12b
cmp bh, 0xe9
cmp rdx, 0x1000
jmp 0x14044023e
jb 0x140440277
mov rax, qword [rcx - 8]
test dil, r15b
add rcx, 0xfffffffffffffff8
cmp bpl, cl
sub rcx, rax
cmp rcx, 0x20
jmp 0x14044025e
jae 0x14044045c
add rdx, 0x27
movzx rcx, sp
movsxd rcx, r14d
mov rcx, rax
jmp 0x140440277
call fcn.1401fd7f8
lea rax, [rsp + 0x58]
xchg cl, cl
movups xmm0, xmmword [rsp + 0x58]
movsx cx, dh
jmp 0x140440295
movups xmmword [0x1400b8ee0], xmm0
mov rcx, qword [rsp + 0x68]
mov qword [0x1400b8ef0], rcx
jmp 0x1404402ad
jmp 0x140440326
mov rcx, qword [0x1400b8ee0]
stc
jmp 0x1404402bf
test rcx, rcx
jmp 0x1404402c7
je 0x140440339
mov rdx, qword [0x1400b8ef0]
clc
sub rdx, rcx
cmp rdx, 0x1000
jmp 0x1404402e4
jb 0x140440315
mov rax, qword [rcx - 8]
cmp r12b, 0x41
clc
add rcx, 0xfffffffffffffff8
clc
test r8w, 0x7560
sub rcx, rax
cmc
cmp rcx, 0x20
jae 0x14044045c
add rdx, 0x27
xchg ch, cl
mov rcx, rax
call fcn.1401fd7f8
lea rax, [0x1400b8ee0]
jmp 0x140440326
xorps xmm0, xmm0
movups xmmword [rax], xmm0
sal rcx, cl
xchg ch, cl
mov qword [rax + 0x10], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jmp 0x140440346
je 0x14044039b
mov rdx, qword [rsp + 0x50]
clc
sub rdx, rcx
test r15b, r12b
cmp rdx, 0x1000
jmp 0x140440364
jb 0x140440396
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
clc
cmc
cmp rcx, 0x20
jmp 0x140440380
jae 0x14044045c
add rdx, 0x27
movzx rcx, r13w
mov rcx, rax
jmp 0x140440396
call fcn.1401fd7f8
call fcn.140056e60
mov ecx, 0x58
jmp 0x1404403aa
call fcn.1404444b1
mov rsi, rax
mov rcx, rax
jmp 0x1404403ba
call fcn.1403b1448
mov qword [0x1400b8ec0], rsi
mov rcx, rsi
call fcn.1403b19f6
mov qword [rsp + 0x28], 0
sbb r8b, 0xa2
mov dword [rsp + 0x20], 0
lea r8, [0x14005d5f0]
cmp r15b, 0xc0
jmp 0x1404403f3
sub ecx, ecx
clc
stc
sub edx, edx
cmp r12w, 0x2855
jmp 0x140440405
xor r9d, r9d
jmp 0x14044040d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [0x1400b8ec0]
jmp 0x14044041f
call fcn.140133c0d
call fcn.140433bd5
mov eax, dword [0x1400dd058]
sal r10b, 0x1a
mov r10, 0xffffffffffffffff
xor edx, edx
jmp 0x140440441
syscall
xor eax, eax
add rsp, 0x70
movsx rsi, sp
not sil
cmova si, r15w
pop rsi
jmp 0x14044045b
ret
call fcn.1404b256e
int3