Function at 0x140001030
Capabilities:
Accept command line arguments
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3d8]
sub rsp, 0x4d8
lea rcx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x1400010f6
lea rdx, str.IsWow64Process
mov qword [rsp + 0x4d0], r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetProcessUserModeExceptionPolicy
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessUserModeExceptionPolicy
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test r14, r14
je 0x1400010e5
test rdi, rdi
je 0x1400010e5
test rax, rax
je 0x1400010e5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x408]
call r14
test eax, eax
je 0x1400010e5
cmp dword [rbp + 0x408], 0
je 0x1400010e5
lea rcx, [rbp + 0x410]
call rsi
test eax, eax
je 0x1400010e5
mov ecx, dword [rbp + 0x410]
and ecx, 0xfffffffe
call rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r14, qword [rsp + 0x4d0]
mov edx, 1
lea rcx, section..text
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
xor esi, esi
xor ecx, ecx
mov edi, esi
mov byte [rbp - 0x20], sil
mov ebx, 0x2710
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
or eax, 1
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
nop
movzx ecx, byte [rax]
cmp cl, 0x20
je 0x14000113d
cmp cl, 9
jne 0x140001142
inc rax
jmp 0x140001130
cmp cl, 0x22
jne 0x140001174
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
je 0x140001162
cmp cl, 0x22
je 0x140001162
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
jne 0x140001152
movzx ecx, byte [rax]
mov rdx, rax
inc rax
cmp cl, 0x22
cmovne rax, rdx
jmp 0x140001198
test cl, cl
je 0x140001198
movzx edx, cl
nop dword [rax + rax]
cmp cl, 0x20
je 0x140001198
cmp dl, 9
je 0x140001198
movzx edx, byte [rax + 1]
inc rax
movzx ecx, dl
test dl, dl
jne 0x140001180
movabs r8, 0x100000201
movzx ecx, byte [rax]
cmp cl, 0x20
je 0x1400011af
cmp cl, 9
jne 0x1400011b4
inc rax
jmp 0x1400011a2
test cl, cl
je 0x1400012dc
sub cl, 0x2d
test cl, 0xfd
je 0x140001268
mov rcx, rsi
nop dword [rax + rax]
movzx edx, byte [rax]
test dl, dl
je 0x14000125e
inc rax
mov byte [rbp + rcx - 0x20], dl
movzx edx, byte [rax]
test dl, dl
je 0x14000125b
inc rax
mov byte [rbp + rcx - 0x1f], dl
movzx edx, byte [rax]
test dl, dl
je 0x14000124d
inc rax
mov byte [rbp + rcx - 0x1e], dl
movzx edx, byte [rax]
test dl, dl
je 0x14000123f
inc rax
mov byte [rbp + rcx - 0x1d], dl
movzx edx, byte [rax]
test dl, dl
je 0x140001231
mov byte [rbp + rcx - 0x1c], dl
inc rax
add rcx, 5
cmp rcx, 0x3e8
jl 0x1400011d0
mov byte [rbp + rcx - 0x20], sil
jmp 0x1400011a2
add rcx, 4
mov byte [rbp + rcx - 0x20], sil
jmp 0x1400011a2
add rcx, 3
mov byte [rbp + rcx - 0x20], sil
jmp 0x1400011a2
add rcx, 2
mov byte [rbp + rcx - 0x20], sil
jmp 0x1400011a2
inc rcx
mov byte [rbp + rcx - 0x20], sil
jmp 0x1400011a2
movzx ecx, byte [rax + 1]
add rax, 2
cmp cl, 0x3f
je 0x1400012d2
cmp cl, 0x48
je 0x1400012d2
cmp cl, 0x63
je 0x14000128d
cmp cl, 0x68
je 0x1400012d2
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movzx edx, byte [rax]
lea ecx, [rdx - 0x30]
cmp cl, 9
ja 0x1400012d2
mov ebx, esi
movzx ecx, dl
nop dword [rax]
cmp dl, 0x30
jl 0x1400012bf
movsx ecx, cl
lea ebx, [rbx + rbx*4]
inc rax
lea ebx, [rbx - 0x18]
lea ebx, [rcx + rbx*2]
movzx ecx, byte [rax]
movzx edx, cl
cmp cl, 0x39
jle 0x1400012a0
movsx rcx, byte [rax]
cmp cl, 0x20
ja 0x1400012d2
bt r8, rcx
jb 0x1400011a2
mov edi, 1
jmp 0x1400011a2
cmp byte [rbp - 0x20], sil
je 0x1400013d2
test edi, edi
jne 0x1400013d2
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x20]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rsi
xor r8d, r8d
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 1
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x80], rsi
mov word [rbp - 0x4e], si
mov qword [rbp - 0x48], rsi
mov dword [rbp - 0x54], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140001362
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax + rbx*2]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x14000138a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rbx + rbx*2]
add eax, ecx
mov dword [rbp + 0x400], eax
jmp 0x1400013af
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp + 0x400]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1400013af
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax + rbx*4]
mov dword [rbp + 0x400], ecx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbp + 0x400]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rbp + 0x408]
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea rdx, str.SALSPAWN:_Spawn_for_Open_Salamander__Copyright__C__1998_2023_Open_Salamander_Authors_n_nUsage:_salspawn_____switch____executable___exe_params__n_nAvailable_switches:_n____h_H___this_help_screen_n__c_num____sets_base_of_SALSPAWN_error_level_to__num__n_n
mov r8d, 0xdd
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_ExitProcess]