Function at 0x10002119c
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
xor r13d, r13d
mov qword [0x100036150], rcx
mov ebp, r13d
mov r12d, r13d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [0x100036150]
mov rdx, rax
call fcn.10002263c
lea esi, [r13 + 1]
lea r14, [0x100003740]
cmp eax, r13d
mov ebx, eax
jge 0x1000211f7
lea r8, [0x100003718]
mov edx, 0x75a
jmp 0x10002121f
cmp eax, esi
je 0x10002123a
mov rcx, qword [0x100036228]
cmp rcx, r13
je 0x10002122c
call fcn.100024dd4
cmp eax, r13d
mov ebx, eax
jge 0x100021229
lea r8, [0x100003758]
mov edx, 0x765
mov rcx, r14
call fcn.1000267e8
jmp 0x10002123a
mov r12d, esi
call fcn.10002012c
mov ebx, eax
call fcn.1000203c4
mov ebp, eax
lea rcx, [0x100036138]
xor r8d, r8d
mov edx, 0xd60000
call sub.ntdll.dll_WinSqmStartSession
mov r8, qword [0x1000361f0]
mov rdi, rax
cmp r8, r13
jne 0x100021269
mov r8, qword [0x100036220]
cmp r8, r13
je 0x100021276
mov edx, 0x10be
mov rcx, rax
call sub.ntdll.dll_WinSqmSetString
mov r8d, ebx
mov edx, 0x10bf
mov rcx, rdi
call sub.ntdll.dll_WinSqmSetDWORD
mov r8d, dword [0x1000361c4]
mov edx, 0x10bd
mov rcx, rdi
call sub.ntdll.dll_WinSqmSetDWORD
mov rcx, rdi
call sub.ntdll.dll_WinSqmEndSession
cmp dword [0x1000361b0], r13d
jne 0x100021617
cmp ebx, r13d
jne 0x1000213f2
mov rdi, qword [0x100036208]
cmp dword [0x1000361ac], r13d
je 0x100021367
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
or r8, 0xffffffffffffffff
mov qword [rsp + 0x40], rdi
mov r11, rax
xor eax, eax
mov rcx, r8
repne scasw ax, word [rdi]
mov rdi, r11
lea r9, [rsp + 0x40]
not rcx
mov dword [rsp + 0x4c], r13d
mov qword [rsp + 0x50], r11
sub rcx, rsi
mov dword [rsp + 0x5c], r13d
lea edx, [rcx + rcx + 2]
mov rcx, r8
mov r8d, 2
repne scasw ax, word [rdi]
mov dword [rsp + 0x48], edx
lea rdx, [0x100001738]
not rcx
sub rcx, rsi
lea eax, [rcx + rcx + 2]
mov rcx, qword [0x100036a00]
mov dword [rsp + 0x58], eax
call qword [sym.imp.ADVAPI32.dll_EventWrite]
mov rdi, qword [0x100036208]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [0x100003778]
mov edx, 0x783
mov r9, rdi
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.1000267e8
jmp 0x100021657
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
or r8, 0xffffffffffffffff
mov qword [rsp + 0x40], rdi
mov r11, rax
xor eax, eax
mov rcx, r8
repne scasw ax, word [rdi]
mov rdi, r11
lea r9, [rsp + 0x40]
not rcx
mov dword [rsp + 0x4c], r13d
mov qword [rsp + 0x50], r11
sub rcx, rsi
mov dword [rsp + 0x5c], r13d
lea edx, [rcx + rcx + 2]
mov rcx, r8
mov r8d, 2
repne scasw ax, word [rdi]
mov dword [rsp + 0x48], edx
lea rdx, [0x1000016e8]
not rcx
sub rcx, rsi
lea eax, [rcx + rcx + 2]
mov rcx, qword [0x100036a00]
mov dword [rsp + 0x58], eax
call qword [sym.imp.ADVAPI32.dll_EventWrite]
mov rdi, qword [0x100036208]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [0x1000037b0]
mov edx, 0x788
jmp 0x100021352
cmp ebx, esi
je 0x100021617
cmp ebx, 0x80242017
jne 0x100021474
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
or rcx, 0xffffffffffffffff
lea r9, [rsp + 0x40]
mov rdi, rax
mov qword [rsp + 0x40], rax
xor eax, eax
repne scasw ax, word [rdi]
lea rdx, [0x100001728]
mov r8d, esi
not rcx
mov dword [rsp + 0x4c], r13d
sub rcx, rsi
lea eax, [rcx + rcx + 2]
mov rcx, qword [0x100036a00]
mov dword [rsp + 0x48], eax
call qword [sym.imp.ADVAPI32.dll_EventWrite]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [0x1000037f0]
mov r9d, ebx
mov edx, 0x79c
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.1000267e8
call fcn.100027748
jmp 0x100021609
lea rdx, [rsp + 0x90]
mov ecx, ebx
mov qword [rsp + 0x90], r13
call fcn.100021dec
mov rdi, qword [0x100036208]
cmp eax, r13d
jl 0x100021561
cmp dword [0x1000361ac], r13d
je 0x1000214dd
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rsi, qword [rsp + 0x90]
mov edx, ebx
mov r8, rsi
mov r9, rax
mov rcx, rdi
call fcn.100026a38
mov rdi, qword [0x100036208]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [0x100003860]
mov edx, 0x7aa
jmp 0x100021514
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rsi, qword [rsp + 0x90]
mov edx, ebx
mov r8, rsi
mov r9, rax
mov rcx, rdi
call fcn.1000268fc
mov rdi, qword [0x100036208]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [0x1000038b0]
mov edx, 0x7af
mov qword [rsp + 0x30], rax
mov r9, rdi
mov rcx, r14
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ebx
call fcn.1000267e8
xor r9d, r9d
mov edx, 0xea60
mov qword [rsp + 0x28], rsi
lea ecx, [rdx + 2]
lea r8d, [r9 + 0x10]
mov dword [rsp + 0x20], ebx
call fcn.100021bb0
cmp rsi, r13
je 0x100021609
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x100021609
cmp dword [0x1000361ac], r13d
je 0x1000215a2
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rsi, [0x100003ad8]
mov edx, ebx
mov r9, rax
mov r8, rsi
mov rcx, rdi
call fcn.100026a38
mov rdi, qword [0x100036208]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [0x1000038f8]
mov edx, 0x7b9
jmp 0x1000215d8
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rsi, [0x100003ad8]
mov edx, ebx
mov r9, rax
mov r8, rsi
mov rcx, rdi
call fcn.1000268fc
mov rdi, qword [0x100036208]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r8, [0x100003938]
mov edx, 0x7be
mov qword [rsp + 0x28], rax
mov r9, rdi
mov rcx, r14
mov dword [rsp + 0x20], ebx
call fcn.1000267e8
xor r9d, r9d
mov edx, 0xea60
lea r8d, [r9 + 0x10]
mov qword [rsp + 0x28], rsi
lea ecx, [rdx + 2]
mov dword [rsp + 0x20], ebx
call fcn.100021bb0
cmp dword [0x1000361b8], r13d
je 0x100021617
call fcn.100020bac
cmp ebx, r13d
jge 0x100021657
lea rdx, [rsp + 0x90]
mov ecx, ebx
mov qword [rsp + 0x90], r13
call fcn.100021dec
mov rdx, qword [rsp + 0x90]
lea r8, [0x100001b60]
mov qword [rsp + 0x20], rdx
mov r9d, ebx
mov rcx, r14
mov edx, 0x7ce
call fcn.1000267e8
cmp r12d, r13d
je 0x100021661
call fcn.100024ef0
lea rcx, [0x100036150]
call fcn.100022b40
mov edx, ebx
and edx, 0x1fff0000
cmp edx, 0x70000
jne 0x100021680
movzx ebx, bx
cmp ebp, r13d
lea r11, [rsp + 0x60]
cmove ebp, ebx
mov rbx, qword [r11 + 0x38]
mov eax, ebp
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret