Function at 0x1400073f0
Capabilities:
Accept command line arguments
Enumerate gui resources

Disassembly:
push rbx
push rdi
sub rsp, 0x2b8
mov rax, qword [0x140096008]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov ebx, 0xfffffffe
lea ecx, [rbx + 3]
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x68]
lea edx, [rbx + 0x2a]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140007497
lea r8, [rsp + 0x70]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14000748c
mov rax, qword [rsp + 0x70]
lea r9d, [rbx + 0x12]
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x7c], rax
xor edx, edx
xor eax, eax
mov dword [rsp + 0x78], 1
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x84], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
test rax, rax
je 0x1400076b2
cmp dword [rsp + 0x60], 4
jl 0x1400076a9
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400076a9
mov rcx, qword [rdi + 0x10]
xor edx, edx
mov qword [rsp + 0x2d0], rbp
mov qword [rsp + 0x2d8], rsi
mov qword [rsp + 0x2e0], r14
mov r14d, dword [rsp + 0x60]
lea r8d, [rdx + 0xa]
mov qword [rsp + 0x2b0], r15
mov r15, qword [rdi + 8]
call fcn.1400020f9
mov rcx, qword [rdi + 0x18]
xor edx, edx
mov ebp, eax
lea r8d, [rdx + 0xa]
call fcn.1400020f9
mov esi, eax
test eax, eax
jne 0x14000758b
test ebp, ebp
je 0x140007689
cmp r14d, 4
jle 0x140007689
mov rcx, qword [rdi + 0x20]
lea r8d, [rsi + 0xa]
xorps xmm0, xmm0
xor eax, eax
xor edx, edx
mov qword [rsp + 0x88], rax
movups xmmword [rsp + 0x78], xmm0
call fcn.1400020f9
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x88], eax
lea rcx, [0x140003729]
call qword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [rsp + 0x84]
test esi, esi
jne 0x14000758f
jmp 0x140007689
test ebp, ebp
je 0x1400075b1
movabs r9, 0xead293602fcf9778
lea r8, str._bsfbkmwuKfmfOvI
mov rdx, r15
mov ecx, esi
call fcn.1400016c7
mov ebx, eax
jmp 0x140007689
lea rcx, str.KERNEL32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movabs r8, 0xc82efdf78201df87
lea rdx, str.HxjcQrmkb
mov rcx, rax
call fcn.140001a96
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call rax
mov rsi, rax
test rax, rax
je 0x140007684
movabs rax, 0x350bfacdf81b2018
lea r8, str.Emod_cefubWkbgk
mov qword [rsp + 0x58], rax
movabs r9, 0x7c3371986918e8f6
lea rax, str.DnafGhjlsX
mov rdx, r15
mov qword [rsp + 0x50], rax
mov rcx, rsi
movabs rax, 0x57135138eb08ff1c
mov qword [rsp + 0x48], rax
lea rax, str.ZhagHzfd_
mov qword [rsp + 0x40], rax
movabs rax, 0xadc6a7b9acd73c9b
mov qword [rsp + 0x38], rax
lea rax, str.__wrl_KeghiCt
mov qword [rsp + 0x30], rax
movabs rax, 0x81bf81adc9456b35
mov qword [rsp + 0x28], rax
lea rax, str.Rqbr_TcnorBnlgwz
mov qword [rsp + 0x20], rax
call fcn.1400017da
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140007689
mov ebx, 0xfffffffd
mov r14, qword [rsp + 0x2e0]
mov rsi, qword [rsp + 0x2d8]
mov rbp, qword [rsp + 0x2d0]
mov r15, qword [rsp + 0x2b0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400025e0
add rsp, 0x2b8
pop rdi
pop rbx
ret